REST API
JSON over HTTPS with one X-API-KEY header and rate-limit headers on every response.
Solutions
For Developers APIs, SDKs & security tools
REST API, TypeScript SDK and OpenAPI 3.1 spec, with 50 free requests a month and a browser playground.
No credit card required · Free API key
- Free requests per month
- 50
- Official SDK, in TypeScript
- 1
- Cached lookup
- <100ms
- OpenAPI spec version
- 3.1
Capabilities
Key features at a glance.
API Playground
Run real requests from the browser before writing code.
Reference docs
Every endpoint with parameters, responses and curl, Python and Node examples.
Open Source
The TypeScript SDK is open source on GitHub.
Fast cached lookups
Warm-cache reads measured at 76–97 ms; cold lookups depend on upstream sources.
Applications
Use cases to evaluate first.
App Security
Check a URL before redirecting users, or an IP before trusting a request.
CI/CD Integration
Check URLs and domains referenced in code or config during CI.
Security Tools
Build internal security tools on the same data and endpoints.
Research
Query indicators, CVEs and ransomware data for research.
FAQ
Frequently asked questions.
Is the free tier really free?
50 API requests/month, 60 requests/minute. No expiry or credit card.
What SDKs are available?
The official SDK is TypeScript/JavaScript (@ismalicious/sdk on npm). Other languages use the REST API with X-API-KEY, or generate a client from OpenAPI.
What does the documentation cover?
Every endpoint with parameters, response fields and curl, Python and Node examples, plus an interactive playground.
Can I use it in production?
The API runs in production and its live health is published on our status page. We do not offer a contractual uptime SLA on self-serve plans.
Research
Related articles from the research blog.
Blog post
API Integration for Threat Intelligence: Automate Your Security
Discover how integrating threat intelligence APIs can transform your security infrastructure. Learn best practices for automated threat detection, continuous monitoring, and documented integration with your existing systems.
Read more
Blog post
Bulk IP and Domain Lookups: Designing Indicator Enrichment That Survives Real Volume
One incident produces hundreds of indicators, and per-indicator lookups are where triage stalls. Here is how to build a batch enrichment pipeline that respects quotas, deduplicates properly, and fails gracefully.
Read more
Blog post
STIX/TAXII Threat Feeds: Operational Guide for OpenCTI, MISP, and SIEM Pipelines
How to wire STIX 2.1 and TAXII 2.1 collections into OpenCTI, MISP, or your SIEM — what to poll, how to handle confidence and aging indicators, and where enrichment APIs fit alongside feed ingestion.
Read moreTest it with your own indicators.
The free plan includes 50 lookups a month. Check the sources and limits, then connect the API.
No credit card required · Free API key