Check any domain, IP, URL or hash before you trust it.
Free lookups with a 0–100 risk score, the sources that matched, WHOIS, DNS and history. Same data over the API.
- Active sources
- 725
- Free lookup tools
- 16
- Risk score on every lookup
- 0–100
- Free API requests per month
- 50
Read an example threat report.
Illustration dated 2026-09-01. Indicators, providers, scores and observations are fictional. This is not a current result for these addresses.
Example requestGET /api/check?query=192.0.2.42
192.0.2.42
Network context
Open ports (3)
An open port describes an exposed service. Additional evidence is needed to assess whether it is being abused.
Sources flagging
2of 3 sources
Confidence
75 %
The score and confidence are illustrative values. Confidence describes support for the assessment; it is not a percentage of sources or a probability of compromise.
Example categories
Example source observations
| Source | Observation |
|---|---|
| Example feed A | Flagged |
| Example feed B | Flagged |
| Example feed C | Not listed |
“Not listed” means this source has no listing in the example. It is not a clean bill of health.
How to interpret it
Compare source observations, dates and technical context before taking action. This example makes no attribution to a threat actor.
Real reports depend on the indicator, available sources and access level. Missing data is shown explicitly. These panels illustrate how to read the data; they are not an API response schema.
Pick the lookup. Every tool is free to try.
- Domain ReputationRisk score, threat categories and source evidence for any domain.
- IP ReputationCheck IP addresses for malicious activity with geolocation and ASN data.
- URL ScannerDomain, certificate and phishing verdict for any link.
- File Hash ReputationCheck MD5, SHA-1 and SHA-256 hashes against known malware indicators.
- Domain AgeCheck domain registration date and flag newly registered domains.
- WHOIS LookupDomain registration data, ownership, and nameserver information.
- DNS HistoryPast DNS records with first-seen and last-seen dates.
- Subdomain ScannerSubdomains from certificate transparency logs and passive DNS.
- Reverse IP LookupDomains hosted on an IP address.
- ASN LookupAutonomous System information and network owner data.
- Bulk CheckCheck a batch of domains, IPs and URLs in one request, sized by your plan.
- Historical ReputationDetection timeline and past reports over up to 90 days.
- Email ReputationCheck an email address for disposable providers and reported abuse.
- Phone Number CheckCheck phone numbers for reported scam activity.
- Crypto Wallet CheckCheck cryptocurrency addresses for reported scams and malicious activity.
- Password Breach CheckerIs a password in known breach dumps? Hashed in your browser, SHA-1 and NTLM.
Get a free API key.
Start with 50 free API requests per month. No credit card required.
curl -d "email=you@example.com" https://ismalicious.com/api/keys/instant50 free requests/month · instant API key · no signup form
Guides and research
Domain Reputation Monitoring: Which Changes Need Action?Track domain reputation over time: distinguish a new phishing report from expected DNS changes, then decide what to verify before restricting access.
Domain Lookup: How to Identify Malicious Websites Before They StrikeMalicious websites are the launchpad for phishing, malware distribution, and credential theft. Learn how domain lookup tools use reputation data, WHOIS analysis, and threat feeds to identify dangerous domains before your users click.
Threat Hunting: Proactive Security Detection Beyond Automated AlertsWaiting for alerts means waiting for attacks to succeed. Learn how proactive threat hunting helps security teams discover hidden threats, improve defenses, and stay ahead of sophisticated adversaries.