search_indicators

com.ismalicious/mcp-server · Verify this server

Find the domains isMalicious lists that look like a brand or domain (e.g. "paypal", read as paypal.com, or "login.paypal.com"): typosquats, homoglyphs, the same name on other TLDs or hosting platforms, or wrapped in phishing words such as login or secure. The default API returns them most dangerous first, at most 500, with the searched name itself first when it is listed; other API bases can have different bounds. `total_hits` counts this API sample. `truncated: true` means results were omitted; `null` means completeness is unknown. An empty answer does not prove no lookalike exists: only listed domains are returned, and a name buried in a longer hostname is not matched. Follow up with check_indicator or check_indicators for verdicts. Cost: one request of the monthly quota, on the default https://ismalicious.com/api as on the Rust API host (https://api.ismalicious.com).