Skip to main content

Features

One API for lookups, feeds and monitoring.

Reputation lookups, vulnerability monitoring, ransomware data, STIX/TAXII, streaming and webhooks, every score traced to its sources.

Get a free API keyRead the API docs

No credit card required · No monthly cap on website lookups · 250 API requests/month

Indexed indicators
31M+
Sources in the corpus
593
Cached lookup
<100ms
Free API requests per month
250

Capabilities

Core capabilities. Each one traced to its sources.

Reputation lookups

Look up an IP, domain, URL or file hash and see every contributing source.

  • IP
  • Domain
  • URL
  • Hash

Vulnerability monitoring

Watch a domain, a lockfile or a stack: we read the versions and match them to new CVEs, with EPSS, CISA KEV and vendor advisories.

  • OSV
  • EPSS
  • CISA KEV
  • GHSA
  • CERT-FR

STIX / TAXII 2.1

TAXII 2.1 collections of STIX 2.1 indicators for OpenCTI, MISP and SIEMs.

Ransomware intelligence

Victim records, group profiles and sector breakdowns from ransomware leak-site tracking.

  • Groups
  • Victims
  • Sectors

AI-generated assessment

Generated from a lookup’s evidence and mapped to MITRE ATT&CK, from the API (POST /ai-analysis) on every plan.

  • MITRE ATT&CK

Also in the same API

Quickstart

First call in 60 seconds. The free tier covers it.

Register, copy your API key from the dashboard, run a request.

Full API referenceTry in the playgroundBrowse all playbooks
# X-API-KEY = base64(apiKey:apiSecret)
curl -H "X-API-KEY: $(printf '%s' "$ISMALICIOUS_API_KEY:$ISMALICIOUS_API_SECRET" | base64 | tr -d '\n')" \
  "https://api.ismalicious.com/check/reputation?query=8.8.8.8"

Integrations

Fits the stack you run. STIX/TAXII, OpenAPI, signed webhooks.

SIEM & SOAR

  • Splunk
  • Elastic Security
  • Microsoft Sentinel
  • Wazuh
  • Cortex / TheHive
  • n8n
  • Tines
  • Torq

Threat intel platforms

  • OpenCTI
  • MISP
  • ThreatConnect
  • Anomali
  • Recorded Future
  • STIX 2.1
  • TAXII 2.1

Developer tools

  • JavaScript / TypeScript SDK
  • Python (requests/httpx)
  • Go (net/http)
  • Rust (reqwest)
  • curl / bash
  • OpenAPI 3.1 spec

Outputs

  • JSON
  • CSV
  • Plain text blocklists
  • Hosts file
  • STIX 2.1 bundles
  • Webhook signed payloads

Looking for a specific connector? Browse all integrations →

By role

Pick your guide. Same API, different jobs.

SOC teams

Enrich alerts and triage them with source-attributed context.

See guide

SIEM / detection engineers

Indicator feeds for Splunk, Elastic, Sentinel or your own pipeline.

See guide

Email security teams

Breach exposure, disposable domains and DNS checks for senders.

See guide

Firewall / network ops

Blocklists for iptables, pfSense, FortiGate and Palo Alto.

See guide

MSSPs

API and feeds for managed SOCs, with rights set by contract.

See guide

Developers

REST API, typed SDK, OpenAPI spec and a free API key.

See guide

Enterprise

On-premise on request, availability terms by contract, a named support contact, OIDC SSO and STIX/TAXII feeds.

See guide

Incident response

From one IOC to related infrastructure and MITRE context.

See guide

Plans

What each plan includes.

CapabilityFreeProEnterprise
Lookups (all observable types)250/month10K/month1M/month
API accessRate-limited✓✓
Monitored items & email alerts5 assets100 assets10,000 assets
Vulnerability monitoring1 domain + 1 lockfile25 sources100 sources
Bulk lookups10/request100/request500/request
Webhooks—Up to 10Up to 10
Stream API (SSE)—✓✓
STIX / TAXII—✓✓
AI-generated assessment✓✓✓
Ransomware intelligence✓✓✓
Email risk analysis✓✓✓
Phone & crypto scam checks✓✓✓
Unified analyze API✓✓✓
Downloadable blocklistsLite (first 10%)✓✓

Need higher volumes, on-prem or custom limits? See Enterprise →

FAQ

Frequently asked questions

What does Free include?

Website lookups with no monthly cap, plus 250 API requests a month with rate-limited API access and no credit card: dashboard, API key, 5 monitored items, vulnerability monitoring of 1 domain and 1 lockfile, ransomware and email risk data. Larger batches and webhooks need a paid plan; streaming and STIX/TAXII need Pro or Enterprise.

Which threat intelligence sources are aggregated?

NVD, CISA KEV, EPSS, GHSA, CERT-FR, AlienVault OTX, AbuseIPDB, Shodan, GreyNoise, URLhaus, Spamhaus, PhishTank and community feeds, among others. Every reputation result lists its contributing sources.

How does vulnerability monitoring differ from a CVE database lookup?

It reads the versions of what you run — a domain’s headers, page and exposed ports, a lockfile, or products you add — and matches them to new CVEs with the OSV and NVD version ranges. When a version cannot be read, the finding says “version not verified” rather than “affected”. Findings carry EPSS, CISA KEV, vendor advisories and exploit availability. One-off lookups stay available at /api/cve.

Do you support STIX and TAXII?

Yes. Pro and Enterprise include a TAXII 2.1 server with discoverable collections of STIX 2.1 objects, readable by OpenCTI, MISP and most SIEMs. Authentication is an API key; no broker needed.

How do bulk lookups work?

POST IPs, domains, URLs and hashes to /bulk/check: 10 per request on Free, 100 on Pro, 500 on Enterprise. Each entry returns its verdict and sources.

Are webhooks signed?

Yes. Payloads are HMAC-signed with a per-webhook secret and retried with exponential backoff on 5xx errors and timeouts. Events: threat.detected, monitor.alert, report.created, usage.warning.

Get a free API key No credit card.

Website lookups with no monthly cap and 250 API requests a month, with the dashboard, monitoring and vulnerability monitoring included.

Create free accountCompare plans

No credit card required · No monthly cap on website lookups · 250 API requests/month

Explore

Related pages to go further.

Threat Intelligence APIREST endpoints, SDKs, and auth for every checkIntegrationsOpenCTI, Cortex, SIEM, and webhook connectorsPricingFree tier through Enterprise — pick a plan