API
Enrich your security product
Test reputation checks on your indicators. Inspect the response and source evidence before building an integration.
A free API key includes a monthly allowance for reputation checks.
Test the APIExplore lookup tools Real-time threat intelligence+317 515 threats indexed today
Threat intelligence. Evidence first.
Investigate an IP, domain or suspicious link. See the sources behind the verdict, then bring the intelligence into your SIEM, product or AI assistant.
Start an investigation
Output
From indicator to evidenceIllustrative example
203.0.113.42IPv4
ReputationBlocklists
ActivityObservations
NetworkASN · ports
Cross-reference
203.0.113.42IP
Example
Score92
Example verdict
Malicious| Reputation | Malicious Source: Blocklists |
|---|---|
| Activity | Command & control Source: Observations |
| Network | Ports 443 · 8443 Source: ASN · ports |
| Evidence | Finding | Source |
|---|---|---|
| Reputation | Malicious | Blocklists |
| Activity | Command & control | Observations |
| Network | Ports 443 · 8443 | ASN · ports |
- Evidence
- Multi-source
- Lookups
- Request-time
- Events
- As published
Trusted by security teams worldwide
Put the data to work
Start with the way your team works
Choose a first step you can evaluate in your own workflow.
STIX / TAXII
Bring threat feeds into your tools
Prepare a STIX/TAXII evaluation for OpenCTI, a SIEM, or a firewall. Define the collections and import workflow you need.
STIX/TAXII access requires Pro or Enterprise. Feed polling is outside the monthly lookup quota.
Evaluate a feed in my toolRead the OpenCTI guideMCP
Check from your AI assistant
Connect the MCP server to look up indicators, check links, and scan untrusted content within an agent workflow.
Connect with a free API key. Reputation checks and scans (prompt injection and email) have separate allowances.
Install the MCP serverTry the content scannerComparing before you choose? See the data products: blocklists, malware hashes and STIX/TAXII feeds, or how isMalicious compares with VirusTotal, AbuseIPDB and urlscan.io.
By the numbers
28M+
Threat Records
Malicious IPs, domains, URLs, and file hashes tracked across the globe — refreshed continuously.
726
Intelligence Sources
Configured feeds are reliability-weighted so SOC teams can see why a verdict was produced.
317K+
New Threats (24h)
Indicators indexed in the last day. Continuous monitoring means you always query the latest intelligence.
60%
Source Evidence
Assessments show contributing sources so analysts can review agreement and conflicts.
Current dataUpdated continuously
What's Happening Right Now
A sample from our live feed. Registered users see the full picture.
Current data
What's Happening Right Now
Updated continuously| Ransomware Activity | ||||
| high severitySlate Valley Unified School District | kairos · Education | — | Oct 1 | — |
| high severitysteelco | AuditTeam · Manufacturing | — | Oct 1 | — |
| high severityProMind IT | AuditTeam · Technology | — | Oct 1 | — |
| high severityDISK PRECISION GROUP - diskprecision.com | krybit · Manufacturing | — | Oct 1 | — |
| Recent CVEs | ||||
| medium severityCVE-2026-62060 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in captivat… | CVSS 7.6 | — | — |
| medium severityCVE-2026-62059 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ultimate… | CVSS 7.6 | — | — |
| medium severityCVE-2026-103338 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Unlimite… | CVSS 8.5 | — | — |
Logged-in users see the full record set, full IOC context, and real-time alertsFull feed →
Capabilities
What Powers the Platform
Inspect the sources behind each result, then bring the data into your product, your security tools, or your AI assistant.
No Card Required
Data Sources
835+ Verified Intelligence Sources
Real-time threat intelligence aggregated from industry-leading providers, community feeds, and proprietary detection engines.
835/1009
domain283
ip408
mixed40
hash30
| Source | Type | Reliability | Tier |
|---|---|---|---|
| AbuseIPDB | ip | A | |
| URLhaus | url | A | |
| Community IOC feeds | mixed | B | |
| IsMalicious | multi | A |
+831More Sources
Free tools
Try the Data Before You Sign Up
Twelve free lookups, no account needed. Every tool runs against the same current dataset as the API.
API Playgroundlive
Fire real requests against the live API from your browser — no key, no setup, instant JSON.
IP Lookup
Reputation, geolocation, and abuse history for any IPv4/IPv6.
Domain Check
Threat verdicts and enrichment for any domain.
URL Scanner
Scan links for phishing, malware, and redirects.
File Hash Lookup
MD5, SHA-1, SHA-256 against malware corpora.
WHOIS Lookup
Registration records with risk signals parsed out.
DNS History
Historical resolutions to trace infrastructure.
Domain Age
Spot newly-registered domains — a top phishing signal.
Reverse IP
Every domain hosted behind an IP address.
Subdomain Finder
Map the attack surface of any domain.
ASN Explorer
Ownership and reputation of network blocks.
Bulk Check
Paste a list of indicators, triage them in one pass.
curl -d "email=you@example.com" https://ismalicious.com/api/keys/instant500 free requests/month · instant API key · no signup form
What data does the API return?
Security score, threat reputation, WHOIS, geolocation, TLS certificates, vulnerabilities, identifier lists, and similar suspicious entities — all from a single query.
How often is data refreshed?
All data is refreshed once per day to ensure daily accuracy across all indexed records.
What are the API usage limits?
Anonymous visitors can run 10 checks per hour from the website. A free account or free API key raises that to 60 requests per minute and 500 checks per month. Paid plans scale from there: Pro includes 10,000 checks per month at 60 requests per minute, and Enterprise goes up to 1M checks per month.
Can I try before buying?
Yes. Create a free account for higher dashboard limits, or request an API key for programmatic access. Paid plans add higher throughput and commercial use.
Who is isMalicious for?
SOC teams, MSSPs, developers building security products, and anyone who needs fast IP, domain, URL, and hash reputation checks.
