Criminal IP Reviews & Product Details

Criminal IP brings IP, domain, open port, and vulnerability data into a single search interface, so I do not need to jump between several tools during an investigation. The risk scoring gives a quick read on whether an IP or domain deserves attention, and the asset search makes it easy to see what is exposed and which CVEs may apply. The API and browser extension also help fit it into daily workflows without much setup. Review collected by and hosted on G2.com.

The breadth of data comes with a learning curve. It took some time to learn the search filters and query options well enough to get precise results. Some of the more advanced features also depend on the plan or credit limits, and the community resources and third-party tutorials are thinner than for longer-established threat intelligence platforms. Review collected by and hosted on G2.com.

Criminal IP is a useful threat intelligence platform for IP reputation and security assessment. It provides detailed information on IP addresses, including threat indicators, open ports, vulnerabilities, and related infrastructure. The platform is helpful for validating suspicious IP addresses and supporting cybersecurity risk assessments, particularly when evaluating third-party or partner connections. Review collected by and hosted on G2.com.

The main limitation is that some threat intelligence results may require additional validation, as reputation scores or classifications can occasionally be unclear Review collected by and hosted on G2.com.

What I like best about Criminal IP is its real-time IP threat scoring and scoring accuracy. The inbound/outbound threat analysis and inbound risk classification (VPN, Tor, Proxy, Scanner detection) make it exceptionally easy to triage alerts and filter out false positives during daily SOC monitoring. Review collected by and hosted on G2.com.

The pricing tiers feel a bit steep for smaller teams, especially considering the relatively tight monthly API credit limits. Running bulk scans or integrating continuous enrichment into a busy SIEM burns through credits faster than expected. Review collected by and hosted on G2.com.

The real-time IP threat intelligence and automated domain scanning APIs are fast, intuitive, and easy to integrate into security triage pipelines. The risk scoring breakdown, VPN/proxy detection, and open-port banners provide clear, actionable context when investigating malicious infrastructure and phishing redirectors. Review collected by and hosted on G2.com.

The free tier API credits and monthly scan allowances are fairly restrictive when conducting continuous threat hunting across multi-domain campaigns. In addition, deeper historical DNS pivots and full certificate transparency tracking occasionally require higher-tier enterprise subscriptions. Review collected by and hosted on G2.com.

Criminal IP makes it easy to investigate IP addresses, domains, and internet-facing assets in one place. The threat intelligence, risk scores, and exposure data help speed up security research and make it easier to identify suspicious infrastructure and prioritize potential risks. Review collected by and hosted on G2.com.

Some of the reports contain a large amount of technical information, so new users may need some time to understand all of the available data and features. More guided explanations and workflow-based examples could make the platform easier to use at first. Review collected by and hosted on G2.com.

I like Criminal IP TI for its ease of use and the rich information it provides for searches. The drill-down capability is excellent, allowing me to start from a domain search and then drill down to each associated asset for an in-depth view. The domain and asset search is straightforward, with optional filters that save time and money. Having all results in one single view increases productivity. I also appreciate that the initial setup was very easy, just requiring account creation and login. Additionally, I find the results better and pricing more favorable compared to Shodan.io. Review collected by and hosted on G2.com.

Sometimes the time it takes to do a full scan on demand is too long and fails. Also, creating a PDF report of all vulnerabilities for all assets is difficult. Review collected by and hosted on G2.com.

The best part for me is the convenience. Instead of gathering information from several different sources, Criminal IP gives me a broad view of an IP or domain in seconds. It's fast, intuitive, and helps streamline security investigations. Review collected by and hosted on G2.com.

I don't have any major complaints, but I think the user onboarding experience could be improved a bit. Since the platform provides a wide range of security data, a few more guided explanations for beginners would be helpful. Review collected by and hosted on G2.com.

Criminal IP is a security analysis tool designed to help professionals detect and investigate online threats, often used in the context of threat intelligence. Review collected by and hosted on G2.com.

it must be used ethically and in compliance with the applicable laws. Review collected by and hosted on G2.com.

I mainly use Criminal IP TI as a preemptive defense tool to keep track of our global assets and verify the reputation of IPs accessing our services. I appreciate the 'asset search' feature because it's like a search engine for all our internet-facing assets, making it faster than running manual scans. I can see exactly what ports are open and what banners are being exposed in just a few clicks. The ability to pull real-time threat intelligence directly into our code is a game-changer, making it easy to automate the blocking of suspicious IPs based on their risk score. The API is clean and straightforward to set up, which allowed us to pull live threat data within the first hour of setting it up. Review collected by and hosted on G2.com.

If I had to pick something, I'd say the sheer volume of data can be a bit overwhelming sometimes. Since Criminal IP picks up everything, it occasionally flags IPs that are just harmless scanners or benign bots, which creates a bit of 'alert fatigue' for us. I wish there were more fine-tuned pre-filtering options to automatically weed out the 'noisy' but harmless data. Also the dashboard customization could be a bit more flexible. As a developer, I love building my own views, so having a more 'drag-and-drop' style dashboard to monitor our specific assets would be a huge plus. Review collected by and hosted on G2.com.

The feature I use most is the search for IP addresses and domains. I like that I can quickly see exposed services, open ports, SSL certificate information, reputation data, and known vulnerabilities without having to switch between multiple websites.

Before using Criminal IP, I usually had several browser tabs open to collect this information. Now I can review everything from one interface, which makes investigations much faster. The layout is clean, the searches are responsive, and the threat intelligence helps me decide which findings deserve a closer look. I also like the AI-powered insights because they provide additional context that would otherwise take longer to gather manually. Review collected by and hosted on G2.com.

The biggest challenge is the learning curve. Since the platform includes many search filters and investigation features, it takes some time to understand how to get the most out of everything it offers.

I think the experience would improve with more interactive onboarding, real-world investigation examples, and guided walkthroughs for new users. I would also welcome more native integrations with SIEM and SOAR platforms so investigation results can be shared more easily with the rest of the security workflow. Review collected by and hosted on G2.com.