dead-drop
Security
Ephemeral zero-knowledge encrypted data sharing
No keyCORSHTTPS
isMalicious
Reputation of IPs, domains, URLs and file hashes from aggregated threat feeds, plus CVE lookups
API key
Required
HTTPS
Supported
Browser calls
No, needs a proxy
Status
Not yet checked
How to call it
A starting template for isMalicious. Replace ENDPOINT with the path from the official documentation, which we link above rather than guess at.
# Requires an API key. Check the docs for whether it goes in a header or a query parameter.
curl -s "https://ismalicious.com/ENDPOINT" \
-H "Authorization: Bearer YOUR_API_KEY" \
-H "Accept: application/json"This API does not send CORS headers, so a browser will block a direct call from your front end. Call it from your server, or put a small proxy in front of it.
Where this listing comes from
Aggregated from one public source (public-apis), then normalised and checked by us.
Report an issue with this listing ↗Other Security APIs
See all 84 →IPGuardian
Security
Check IP addresses against 140+ public threat intelligence blocklists
No keyCORSHTTPS
Microsoft Security Response Center (MSRC)
Security
Programmatic interfaces to engage with the Microsoft Security Response Center (MSRC)
No keyCORSHTTPS
National Vulnerability Database
Security
U.S. National Vulnerability Database
No keyCORSHTTPS
Presend
Security
Security and developer utility API -- malware, vulnerability, and domain checks, no signup
No keyCORSHTTPS
FishFish
Security
FishFish is an automated service designed to quickly detect and mitigate phishing threats before they can be exploited for malicious purposes. It provides a streamlined solution for identifying harmful resources efficiently.
No keyCORSHTTPS
isMalicious — common questions
Answered from what our own scheduled checks found, not from the provider's marketing.
Is isMalicious free to use?
isMalicious is listed in our free catalogue, but it requires an API key, so you will need to register before your first call. Providers frequently reserve higher limits and commercial use for paid plans.
Does isMalicious need an API key?
Yes. isMalicious authenticates with an API key. Keep it server-side rather than in browser code, because anything in your frontend bundle is readable by anyone who opens developer tools.
Can I call isMalicious from browser JavaScript?
Not directly. isMalicious did not return CORS headers when we checked, so the browser will block your page from reading the response even though the request itself succeeds. Call it from a server, or put a small proxy in front of it.
Is isMalicious available over HTTPS?
Yes. isMalicious serves over HTTPS, so you can call it from a secure page without triggering a mixed-content block.