For scripts, scanners & AI agents
You hit a rate limit. Here is the sanctioned path.
The report pages and their live streams are metered for humans: every open triggers a fan-out to rate-limited upstream sources, so anonymous automation gets refused past a small burst. The data itself is not closed - there are four supported ways to consume it programmatically, three of them free.
curl -d "email=you@example.com" https://ismalicious.com/api/keys/instant500 free requests/month · instant API key · no signup form
Four supported ways in
Free API key
Create an account and get a key with a monthly check allowance on the REST API - JSON responses, documented, versioned. No scraping, no HTML parsing, no token games.
Create a free accountMCP server for AI agents
If the caller is an AI agent, plug in our MCP server: scan_before_use checks content for prompt injection and its links against ~30M indicators before your agent consumes it; check_url gates a single fetch.
MCP setup guideTypeScript SDK
The official client wraps auth, retries and typing for the whole REST surface. One install, no HTTP boilerplate.
API documentationTAXII 2.1 feed
Need the corpus rather than lookups? Pro and Enterprise plans poll our STIX/TAXII collections - malicious IPs, domains and URLs - straight into OpenCTI, MISP or your SIEM. Feed polling is exempt from the request quota.
See plansWhat is refused, and why
- Anonymous report streams without a page token are served from cache only. A cold miss returns 429 - the live fan-out costs us rate-limited upstream calls.
- Declared crawlers keep the report pages and cached verdicts, but never trigger live enrichment.
- Per-IP anonymous API burst is 10 requests/hour. A free key raises it by an order of magnitude and makes your usage attributable - which is what lets us keep the anonymous tier open at all.