Anti-Virus Cloud Engine (ACE)

A hosted web API and data feeds that let your application check the reputation and risk of every file, site or IP address against an extensive in-the-cloud database — before the user opens it.

Request an API trial Pricing

ACE blocks malicious files, exploited vulnerabilities and Internet threats — malware URLs, IP addresses, command-and-control servers and phishing. Responses come in JSON, XML or plain text, so the service fits into any product or infrastructure.

What you can build with ACE

EDR and endpoint protection

Add cloud reputation to a new or existing endpoint detection and response product.

Zero-day protection

Catch new and previously unseen malware that local signatures do not know yet.

Web filtering

Block malicious and phishing sites in browsers, proxies, gateways and routers.

Anti-virus and anti-spyware

Use ACE as a second opinion next to your own scanner.

Upload scanning

Check files that users upload to your web site or service.

Link protection

Block links to known malware pages in mail, chats and forums.

TDL: Top Domain List

20 million ranked domains, each classified as safe or dangerous. Continuously updated and delivered straight into your database via SQL replication.

Two lists, clearly separated

Safe and dangerous domains are kept apart rather than mixed in one ranking, and each list is ranked on its own.

Safe domains

  • Trusted baseline for allowlisting
  • Fewer false positives in detection
  • Ranked by prominence and activity

Dangerous domains

  • Ready-to-use blocklist
  • Phishing, malware, fraud and other threats
  • Ranked so you can prioritize the most active threats

Pricing

  • ACE subscriptions $1200 per month.
  • For businesses and corporations that need enterprise features.
  • SQL database replication with our server as slave and have full database copy.
  • No minimum period — start or stop at any time.
  • Discount for start-ups and non-profit organisations for the first two years.

Minimum billing: one month. You can cancel your API account at any time. Cancellation will take effect at the end of your current billing period. You will not receive a refund for billing that has already occurred.

Why TDL

  • Depth. 20 million ranked domains reach the long tail of the internet: regional sites, niche services, newly active domains and infrastructure that top-1M lists never cover.
  • Always current. The list is updated continuously, not on a daily or monthly schedule. New threats appear in your data as soon as they are classified.
  • Widest source coverage. Classification and ranking are built from the widest possible range of independent sources, cross-checked to give a reliable verdict for each domain.
  • Built for security. Other rankings measure web traffic. TDL is designed from the start for threat detection, filtering and reputation scoring.
  • NDA and full rights. Every customer works with us under an NDA, and receives full rights to use the data in their own products and services, without the attribution requirements or usage restrictions that come with public lists.

Real-time data feeds and SQL replication

For partners who need large volumes of data we provide real-time feeds of malware URLs, samples, IP addresses and more, in the format you choose. Contact sales to discuss your needs.

Try it now

Check web siteIs the site in the malware URL list? MD5 searchLook up a file by its MD5 hash Live statisticsInternet threats right now

Free samples of our data are available as a public IOC feed.

Signature database: 9,123,552 malware definitions, last update +69949 (Oct, 13 2026 08:10 EET).