Investigate an IP, domain or suspicious link. See the sources behind the verdict. Bring the intelligence into your SIEM, product or AI assistant. Start with 50 free API checks per month. The IsMalicious Free subscription plan costs €0 per month.
Example verdict
Malicious| Evidence | Finding | Source |
|---|---|---|
| Reputation | MaliciousSource: Blocklists | Blocklists |
| Activity | Command & controlSource: Observations | Observations |
| Network | Ports 443 · 8443Source: ASN · ports | ASN · ports |
Understand why something was flagged, see the evidence behind it, and make informed decisions in the tools you already use.
Jean-Vincent · Founder of IsMalicious
English audio · English and French captions
Hi, I'm Jean, founder of IsMalicious. We help you investigate suspicious IPs, domains and URLs, and understand the evidence behind the signals. You can use that intelligence in your AI tools through MCP, in your SIEM with STIX and TAXII, or in your own applications through our API. We built this because a threat label alone isn't enough. You need sources and context to make a decision you can explain.
External threat intelligence to compare with the tools your team already uses. Start with the workflow you can evaluate.
For SOC, MDR, MSSP and network teams using OpenCTI, MISP, a SIEM or a firewall. Compare indicators, import behavior and maintenance effort with your existing sources.
Collection rebuilds and your polling schedule are separate. Verify freshness and false positives before using indicators in blocking rules.
Pro: €99/month. Enterprise: quotation. TAXII polling is outside the lookup quota.
For developers and security product vendors. Run a reputation lookup, inspect the JSON and compare the available source evidence with what your product already knows.
Fields depend on the indicator, plan and available sources. Missing data requires further investigation. Redistribution and OEM rights require an agreement.
The free API key includes 50 lookups/month. Scans have a separate allowance.
For analysts already using a compatible AI assistant. Install the MCP server, run an actual indicator check and compare the context with your existing investigation tools.
Your workflow must call the tool and interpret its result. An unknown indicator or an allow decision is not proof of safety.
Use an API key. Reputation checks and prompt-injection scans have separate quotas.
Comparing before you choose? See the data products: blocklists, malware hashes and STIX/TAXII feeds, or how isMalicious compares with VirusTotal, AbuseIPDB and urlscan.io.
Inspect the sources behind each result. Use 3 access methods to bring the data into your product, your security tools, or your AI assistant.
A REST API designed for developers. Get reputation, sources, categories, and history in a single JSON response. Start with 50 free checks per month. SDKs, OpenAPI spec, and copy-paste examples included. The IsMalicious Free subscription plan costs €0 per month. Use an API key with the HTTP GET /api/check endpoint.
No Card Required
A captured TAXII sample, imported and read back in a local OpenCTI instance. Check what transferred, what changed and what still needs validation in your tool.
An internal TAXII sample was imported into a disposable local OpenCTI instance and read back through GraphQL. This is a local validation, not a customer deployment.
Collection: malicious-ips
TAXII capture:
Readback verified:
TAXII capture: 2 pages. More pages remained; the collection was not fully captured.
Validity dates changed during import. The cause is not established; verify expiration behavior in the workflow you evaluate.
No customer deployment or automated polling was validated.
Validate pagination, expiration and import effort in your own tool. This internal sample establishes neither a customer deployment nor a measured gain.
An internal TAXII sample was imported into a disposable local OpenCTI instance and read back through GraphQL. This is a local validation, not a customer deployment.
No Observable or firewall export was established. Indicator enrichment and an export that requires Observables are different workflows.
No automated TAXII polling, customer production deployment, MISP/SIEM import or detection accuracy was validated.
The public catalogue lists feed entries and their configured status. These entries are different from contributing sources in the current corpus or live enrichment providers.
| Source | Type |
|---|---|
| AbuseIPDB | ip |
| URLhaus | url |
| Community IOC feeds | mixed |
| IsMalicious | multi |
12 free lookup tools, no account needed. Every tool runs against the same current dataset as the API.
Fire real requests against the live API from your browser — no key, no setup, instant JSON.
Reputation, geolocation, and abuse history for any IPv4/IPv6.
Threat verdicts and enrichment for any domain.
Scan links for phishing, malware, and redirects.
MD5, SHA-1, SHA-256 against malware corpora.
Registration records with risk signals parsed out.
Historical resolutions to trace infrastructure.
Spot newly-registered domains — a top phishing signal.
Every domain hosted behind an IP address.
Map the attack surface of any domain.
Ownership and reputation of network blocks.
Paste a list of indicators, triage them in one pass.
curl -d "email=you@example.com" https://ismalicious.com/api/keys/instant50 free requests/month · instant API key · no signup form
Get started with basic threat intelligence. Perfect for individuals and small projects.
Live STIX/TAXII feeds for MISP, OpenCTI and your SIEM, plus 10,000 API checks/month.
For organizations that need higher volumes and help integrating threat intelligence into their tools.
A sample from our live feed. Registered users see the full picture.
| Ransomware Activity | |
| high severityVadeto Group | qilin · Not FoundOct 9 |
|---|---|
| high severityAnne Arundel County | rhysida · Government & DefenseOct 9 |
| high severityfleetworksinc.com | threeam · TransportationOct 9 |
| high severityDW McMillan Memorial Hospital | thegentlemen · HealthcareOct 9 |
| Recent CVEs | |
| high severityCVE-2026-79842 | An authentication bypass vulnerability exists in HPE Intelligent Management Center (iMC) prior to v7.3 E0713CVSS 9.1 |
| high severityCVE-2026-78406 | IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allo…CVSS 9.8 |
| high severityCVE-2026-78401 | IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allo…CVSS 9.8 |
Vulnerability enrichment adds severity, known exploitation and a dated estimate. Inspect this captured API example alongside the primary sources.
CVE-2024-3400
Palo Alto Networks PAN-OS / GlobalProtect
API capture:
EPSS is a model estimate for the next 30 days. FIRST score date: Oct 08, 2026, checked separately.
This API example does not validate a feed import or protection of an asset.
Open the current CVE recordCheck provenance, overlaps, useful additions, dates and import effort against your internal tools and CERT sources. No customer comparison or measured gain is established by these snapshots.
CVSS describes severity. EPSS estimates exploitation probability over the next 30 days; it is not certainty. These signals do not measure IsMalicious detection accuracy.
The EPSS date was checked separately with FIRST. The captured IsMalicious response does not return that score date. CISA KEV dates are historical catalogue dates.
Product context does not verify an installed version or an affected-package match.
The captured CVSS vector is absent and lastModified is empty. This is a selected response excerpt, not a coverage benchmark.
Reproduce the API lookup:
GET https://api.ismalicious.com/cve/CVE-2024-3400Use authorized account credentials. This capture used an internal paid account; Free-tier access was not demonstrated.
{
"id": "CVE-2024-3400",
"severity": "CRITICAL",
"cvssScore": 10,
"cvssVector": null,
"published": "2024-04-12T08:15:06.230+00:00",
"lastModified": "",
"epssScore": 0.99999,
"isKev": true,
"kev": {
"listed": true,
"dateAdded": "2024-04-12T00:00:00+00:00",
"dueDate": "2024-04-19T00:00:00+00:00"
}
}Anything else? Reach out to us.
Diagnose SERVFAIL using detailed DNS errors, the DS/DNSKEY chain and signatures, then verify the repair with DNSSEC validation enabled.
Reconstruct DNS address changes using dated responses, caches and network views, without confusing TTL with the lifetime of a threat.
Separate nonexistent names, negative caching, filtering and suspicious activity before treating NXDOMAIN errors as a security incident.
Trace CNAME records, identify the provider, and inspect transmitted cookies before deciding whether a subdomain should remain authorized.
Distinguish domain parking, expiration, and malicious behavior. Examine actual use and choose a restriction supported by the evidence.
Use RDAP events, statuses, and contacts to document a suspicious domain without misattributing an identity or claiming an unproven compromise.