Threat Intelligence in
ChatGPT
Look up IPs, domains, hashes, and emails without leaving your chat. Results include current source evidence and reputation data.
How It Works
Direct threat intelligence integration
Ask a Question
Paste an IP, domain, or hash into ChatGPT and ask if it is malicious.
Real-time Lookup
The GPT queries isMaliciousAPI to check configured sources instantly.
Get Analysis
Receive a comprehensive threat report with risk scores and context.
Capabilities
What you can do with the isMalicious GPT
Threat Intel
Check IPs, domains, URLs, and hashes against indexed records.
Ransomware
Search for active ransomware groups, victims, and IoCs.
Domain Search
Find typosquatting domains and phishing infrastructure.
Email Risk
Evaluate email reputation, breaches, and mail security.
See it in Action
Is the IP 45.33.32.156 malicious?
This IP is confirmed malicious and is currently acting as a C2 server for Cobalt Strike.
- Detected by 25 security engines
- Associated with Lazarus Group activity
- Hosted on known bulletproof hosting
Data provider: isMalicious.com
Get Unlimited Checks
The usage limit is 5 checks per day for free users. Create an account to get your API key and enable unlimited threat analysis in ChatGPT.
Frequently Asked Questions
Is the GPT free to use?
Yes! You get 5 free checks per day. For unlimited checks, you can link your isMalicious API key (available with any free or paid account).
How accurate is the data?
The GPT queries the live isMalicious database, which aggregates indexed threat records from configured sources in real-time.
Can I use my own API key?
Absolutely. Just tell the GPT "I want to use my API key" or provide it in the chat instruction to bypass the daily limit.
Does it check for ransomware?
Yes, it can search for ransomware victims, groups, and associated infrastructure using our dedicated ransomware intelligence feed.
Is my data private?
Queries sent to the GPT are processed by our API solely to provide the threat report. We do not store your personal conversations, but we do log the threat indicators (IPs, domains) for analytics.