Threat Intelligence Database

Access 31M+ malicious IPs, domains, and comprehensive cyberthreat data from 524 trusted sources

Capabilities

What Powers
the Platform

Multi-Source Aggregation

Aggregate data from Shodan, GreyNoise, AbuseIPDB, community threat feeds, and other configured providers. One lookup returns source-attributed results.

Threat IntelData EnrichmentIOC Feeds

AI-generated Analysis

LLM-generated summaries transform raw enrichment data into specific intelligence with context-aware threat narratives tailored to your environment.

AI-generated assessmentContextual IntelGenAI Security

MITRE ATT&CK Mapping

Automatically map IOCs to MITRE ATT&CK techniques based on threat tags and enrichment findings. Accelerate triage and build structured threat models.

MITRE ATT&CKTTPsThreat Modeling

Data Sources

594+ Verified Intelligence Sources

Real-time threat intelligence aggregated from industry-leading providers, community feeds, and proprietary detection engines.

594/643

domain281

ip240

mixed26

hash13

Source	Type	Tier
AbuseIPDB	ip	A
URLhaus	url	A
Community IOC feeds	mixed	B
IsMalicious	multi	A

+590More Sources

Comprehensive Threat Intelligence & Cybersecurity Database

IsMalicious provides the most comprehensive threat intelligence database for cybersecurity professionals. Our database aggregates data from 524 trusted sources to deliver continuous monitoring against cyber threats.

Use it as a lookup database, a blocklist source, or a SOC enrichment layer for IP reputation, domain reputation, URL scanning, CVE context, and ransomware intelligence.

Category	Coverage
Malicious IP Database - 7.5M+ Threatening IPsOur comprehensive malicious IP database identifies and tracks IP addresses involved in cyberattacks, malware distribution, phishing campaigns, and network abuse. Each IP is enriched with geolocation data, ASN information, threat categories, and confidence scores. Use our IP blocklist API to automatically block malicious traffic before it reaches your infrastructure.	34M+ Malware IPs12M+ Phishing Servers8M+ Botnet C223M+ DDoS Sources18M+ Brute Force15M+ Spam/Abuse
Malicious Domain Database - 400M+ Threatening DomainsTrack malicious domains across the entire web. Our domain blocklist includes phishing sites, malware hosting domains, scam websites, adware networks, and tracking domains. Every domain is analyzed with WHOIS data, SSL certificates, and threat intelligence from 524 sources, updated in real-time to catch newly registered phishing sites.	45M+ Phishing Sites89M+ Malware Hosts32M+ Scam Domains28M+ Adware Networks67M+ Tracking Domains11M+ C2 Servers
Phishing Database - Stop Credential TheftOur specialized phishing database tracks 45M+ credential harvesting sites, fake login pages, and brand impersonation domains. Detect phishing attacks in real-time with our advanced phishing detection API that analyzes domain similarity, SSL certificates, and visual characteristics.	Brand impersonation detectionNewly registered domain monitoringVisual similarity analysisEmail link scanning
Malware & Adware IntelligenceComprehensive malware database covering ransomware, trojans, viruses, spyware, and more. Our adware blocklist protects users from invasive advertising, unwanted software, and aggressive marketing tactics. Includes vulnerability information and IOC data for incident response.	12M+ Ransomware34M+ Trojans28M+ Adware8M+ Spyware
Tracking Domain Database - Protect User PrivacyBlock invasive surveillance with our tracking domain database. Identify 67M+ analytics scripts, tracking pixels, fingerprinting services, and data brokers. Ensure GDPR compliance and protect user privacy by blocking unwanted tracking at the DNS or application level.	GDPR CompliantPrivacy-FirstAd-Free Browsing
Vulnerability Database - Proactive SecurityBeyond blocklists, our vulnerability database provides deep intelligence on security weaknesses, exposed services, weak SSL certificates, open ports, and CVE mappings. Perfect for security audits, penetration testing, and continuous vulnerability management.	SSL/TLS certificate analysisOpen port detectionCVE mappingMisconfiguration alerts

Continuously updated intelligence & Developer Tools

Real-Time Cyberthreat Intelligence

24/7 monitoring - Instant threat data updates
524 sources - Commercial, open-source, and community feeds
Multi-category - Malware, phishing, adware, tracking, spam
Confidence scoring - Reduce false positives

Blocklist API for Developers

RESTful API with comprehensive documentation
Sub-100ms response times for continuous monitoring
Flexible rate limits scaling with your needs
JSON responses with detailed threat metadata

Database Coverage & Statistics

0M+

Threat Records

524

Intelligence Sources

0M+

New Threats (24h)

Use Cases for Our Threat Intelligence Database

Firewall and IDS/IPS - Block malicious IPs at the network perimeter
SIEM integration - Enrich security events with threat intelligence
Email security - Detect phishing domains and malicious links
Web application firewalls - Real-time request validation
Threat hunting - Proactive security investigations
Incident response - Fast IOC validation and enrichment

FAQ

Frequently Asked Questions

What types of threats does the database include?

The database covers malicious IPs, domains, and URLs across every major threat category: phishing sites, malware hosts, botnet command-and-control infrastructure, ransomware indicators, adware networks, tracking domains, and vulnerability intelligence with CVE mappings.

How often is the database updated?

The database is refreshed daily, with continuous ingestion from our source network around the clock. Newly registered domains, fresh phishing sites, and emerging threat infrastructure are added as sources report them, so blocklists and API responses always reflect current threat data.

Is there a free tier?

Yes. The free plan includes 30 checks per month and a free API key — no credit card required. It is a full-featured way to evaluate the database before upgrading to a paid plan for higher volume.

Can I export blocklists?

Yes. Blocklist exports are available on paid plans in formats ready for firewalls, DNS resolvers, and SIEM ingestion. PDF report exports are available for free.

Where does the data come from?

Threat data is aggregated from configured commercial, open-source, and community sources. Each source is reliability-weighted, and results expose source agreement and conflicts so analysts can review confidence.

Start Using Our Threat Intelligence Database

Free tier available - No credit card required

Get Started View API Documentation OpenAPI Spec

Data ProductsBlocklists, STIX/TAXII, NRD, MMDB, and specialty feeds IP & Domain BlocklistsReady-to-consume lists for perimeter controls