# isMalicious (ismalicious.com)

Looks up IPs, domains and URLs against threat sources and returns verdicts with the evidence behind them.

- Atlas card: https://inite.ai/en/atlas/ismalicious.com
- Site: https://ismalicious.com
- For: Security teams and developers checking suspicious IPs, domains and URLs, and feeding threat intel into SIEMs or apps.
- Categories: security
- Use not measured/100 · alive 92/100

## Used for

- Investigate an IP, domain or suspicious link with sourced evidence
- Import threat indicators into a SIEM or OpenCTI over STIX/TAXII
- Check indicators from your code via a REST API

## Price

- from 49 EUR/month, free plan (read 2026-10-19 on https://ismalicious.com/pricing)

## For developers

- OpenAPI: https://ismalicious.com/openapi.json (55 paths)
- API docs: https://ismalicious.com/api-docs
- MCP server: com.ismalicious/mcp-server (namespace; open on 2026-10-19, 8 tools)
- Status page: https://ismalicious.com/resources/status
- Read 2026-10-19

## MCP server, measured daily

Server: https://api.ismalicious.com/mcp, checked every day since 2026-10-19 (3 checks).

- Answered: measuring, 3 daily checks so far
- Median first answer: 536 ms
- Sign-in: none
- Context its tool definitions take: about 3406 tokens (8 tools)
- Tool definitions: A, 100/100
- Method: https://inite.ai/en/atlas/mcp/report

## Your data

- Certifications stated: none
- Read 2026-10-19

---

Source: INITE Atlas, https://inite.ai/en/atlas/ismalicious.com. JSON: https://inite.ai/api/atlas/ismalicious.com. MCP: https://inite.ai/api/mcp (atlas_lookup).