Search for information on
Criminal IP Search Tip
Best Practices
Cybersecurity News
API Integration
We provide straightforward, easy-to-use APIs that are designed to block risk-scored IPs or malicious domain links. Use Criminal IP code samples to seamlessly integrate all other functions and the database in your organization's infrastructure.
- Identification of VPN/hosting/Tor of the accessed IP
- Detection of malicious domain links
- Management of attack surface vulnerabilities within an organizational infrastructure
→ root@criminalip ~ % |
{
"ip": "8.8.8.8",
"score": { "inbound": "Moderate", "outbound": "Low" },
"country": "United States",
"country_code": "us",
"region": "California",
"city": "Los Angeles",
"isp": "GOOGLE",
"org_name": "Google",
"as_no": 15169,
"postal_code": "90009",
"latitude": 34.0544,
"longitude": -118.2441,
"status": 200
}
→ root@criminalip ~ % |
{
"ip": "8.8.8.8",
"score": { "inbound": "Moderate", "outbound": "Low" },
"country": "United States",
"country_code": "us",
"region": "California",
"city": "Los Angeles",
"isp": "GOOGLE",
"org_name": "Google",
"as_no": 15169,
"postal_code": "90009",
"latitude": 34.0544,
"longitude": -118.2441,
"status": 200
}
→ root@criminalip ~ % |
How API works
Criminal IP’s API integration will detect and block potential malicious users accessing login services in real time.
FAQMost frequently asked questions about Criminal IP
Frequently Asked Questions
What is Criminal IP?
Criminal IP is a Cyber Threat Intelligence (CTI) search engine that scans the open ports of IP addresses worldwide daily to discover all devices connected to the Internet. Using AI-based technology, it identifies malicious IP addresses and domains and provides a 5-level risk assessment. The data is indexed with various filters and tags for effective searching. Additionally, it can be integrated with other systems through an API.
What are some functions of Criminal IP?
You can search for vulnerabilities and all devices connected to the Internet, such as IP addresses, domains, IoT, and ICS. It provides four search functions: Asset, Domain, Image, and Exploit, and five intelligence functions: Banner Explorer, Vulnerability, Statistics, Element Analysis, and Maps, along with an API.
Where can Criminal IP be used?
Criminal IP allows you to search or inquire via an API threat intelligence on all devices, servers, and domains connected to the Internet. It can be used for cyber security, attack surface management, penetration testing, vulnerability and malware analysis, as well as for investigation and research. For example, when a new vulnerability or ransomware is discovered, you can determine how many PCs or servers are vulnerable or infected, and check whether the IP address or domain in use is also vulnerable. Additionally, it scans in real-time for malicious URLs generated by hackers and phishing URLs, allowing you to analyze threat information without directly accessing them. To see more examples on how to use Criminal IP, please refer to the Best Practice page.
How frequently does Criminal IP update data?
Criminal IP constantly collects and updates data in real-time.
Which Internet browsers can be used for Criminal IP?
As Criminal IP is a web-based search engine, it is accessible via computers, mobile devices, and tablets. It is specially optimized for Chrome browsers.
Do I need a separate program installation?
Criminal IP does not require a separate program installation. It is available as a SaaS service, accessible from anywhere with Internet access via web, tablet, or mobile devices.
Do you have any sample codes for Criminal IP?
Criminal IP provides sample codes for each Search and Intelligence function, including API. For more information, please refer to the Sample Code page.
How do I create a Criminal IP account?
You can create a Criminal IP account on the Register page using your email, Google, or Twitter account.
I want to change my account email.
Once an email account is created, you cannot change your registered email. If you still need to change it, please contact Customer Support.
I would like to receive recent news about Criminal IP.
Follow Criminal IP's official Twitter account to receive the latest news about Criminal IP. In addition, you can receive the weekly Criminal IP newsletter by activating the 'Subscribe to the CIP Newsletter' checkbox on the My Information page.
Criminal IP Search Quick Guide
What is "Asset Search"?
Asset Search is a search feature that provides the risk level of an IP address in 5 stages and comprehensive information including Domain, Open Ports, vulnerabilities, WHOIS information, and screenshots associated with that IP address. For more information, please refer to the Asset Search page.
What is "Domain Search"?
Domain Search is a search feature that provides information about URLs. By scanning a URL, you can check in real-time whether a site is a phishing site or contains malware, as well as the connected IP addresses, subdomains, network logs, and technologies that were used. For more information, please refer to the Domain Search page.
What is "Image Search"?
Image Search is a search feature that provides image information on devices, websites, and corporate or personal information that are exposed to the Internet. For more information, please refer to the Image Search page.
What is "Exploit Search"?
Exploit Search is a search feature that maps exploitable vulnerabilities based on searches for CVE IDs, vulnerability types, platforms, and more in real-time. For more information, please refer to the Exploit Search page.
What is "Banner Explorer"?
Banner Explorer is an intelligence feature that provides threat intelligence information classified into product and service categories such as cryptocurrency, database, and IoT. For more information, please refer to the Banner Explorer page.
What is "Vulnerability"?
Vulnerability is an intelligence feature that provides information on attack surface exposure and vulnerability of assets via classification by CVE ID and product name, which helps proactively monitor vulnerabilities of the applications in use. For more information, please refer to the Vulnerability page.
What is "Statistics"?
Statistics is an intelligence feature that provides a dashboard with 10-day statistical graphs that determine the maliciousness of IP addresses and domain information, as well as the presence of VPNs. For more information, please refer to the Statistics page.
What is "Element Analysis"?
Element Analysis is an intelligence feature that provides the results of analyzing assets and vulnerability data according to the desired filters and elements. For more information, please refer to the Element Analysis page.
What is "Maps"?
Maps is an intelligence feature that provides a visual representation of the country and location information for an IP address on a map, as well as statistics by AS name, product, and country. For more information, please refer to the Maps page.
Which filters are available for "Asset Search"?
Asset Search provides filters to enhance search accuracy and convenience. Please refer to the Filters page.
Which filters are available for "Image Search"?
Image Search provides filters to enhance search accuracy and convenience. Please refer to the Filters page.
Which filters are available for "Exploit Search"?
Exploit Search provides filters to enhance search accuracy and convenience. Please refer to the Filters page.
Which tags can I use for "Asset Search"?
Asset Search provides tags to enhance search accuracy and convenience. Please refer to the Tags page.
Which tags can I use for "Image Search"?
Image Search provides tags to enhance search accuracy and convenience. Please refer to the Tags page.
What categories are searchable through "Banner Explorer"?
Banner Explorer provides category-specific searches for cryptocurrencies, databases, industrial control systems, IoT, network infrastructure, and video games. For more information, please refer to the Banner Explorer page.
Which products are searchable through "Vulnerability"?
Vulnerability provides various major product categories such as MySQL, Linux, WebLogic Server, and HTTP server that help you easily search for vulnerabilities in specific products. For more information, please refer to the Vulnerability page.
What can I search for on the "Element Analysis" page?
You can search for all assets and vulnerabilities collected by Criminal IP by country, service, ASN, product, and port number.
API Quick Guide
Where can I get an API Key?
You can copy your API Key on the My Information page after signing up and logging in to your account.
Where can I get the API codes?
You can use API codes for each function on the API page.
Do I need to use a separate software for API?
No separate software is required.
How do I make API calls?
After copying the issued API Key, you can use the command line on the API page or use various application codes in the GitHub to call the API and check the results as a JSON response.
Is there a limit on the number of API calls?
The number of available API calls varies depending on the credits provided by each plan. Please refer to the Pricing page for the number of credits provided by each plan.
What is the API call speed?
When using the Enterprise plan, high-speed APIs within 1 second are supported. For more information, please refer to the Pricing page.
Which data can be provided through the API?
All threat intelligence of Criminal IP is equally provided as APIs. For more information, please refer to the API page.
How can the Criminal IP API be utilized?
Criminal IP API can be easily applied to databases and security systems in use. It can be used to block account takeover, credential stuffing, and malicious access by determining the maliciousness and vulnerability information of IPs and domains in real-time, and protect customers and assets.
Questions for Membership
Do you have a free plan?
If a customer creates an account but does not pay for a plan, the Free Membership plan will be automatically applied. Free Membership provides a certain amount of credits that can be used to access Criminal IP features. Once all the free credits have been used, customers can upgrade to a paid plan at any time. Upgrading to a paid plan will provide access to more search criteria and search results.
What if the free plan does not meet my needs?
You can use three paid plans for monthly subscriptions, Lite, Medium, and Pro. These plans offer a much larger amount of credits than the Free Membership plan and allow you to use more features and filters. Additionally, with the Enterprise plan, you can use all features without any limit on data volume. For more information, please refer to the Pricing page.
Is it possible to get unlimited access to the database?
Yes, it is possible. With the Enterprise plan, you can use all the data and features without any limitations. For more information, please refer to the Pricing page.
How can I check my payment information?
You can check your current paid plan, payment history, and payment method information on the My Order page.
What if I want to change my plan?
If you are currently using the Free Membership, you can choose the appropriate plan on the Pricing page to start subscribing to a paid plan. If you are already using a paid plan, you can change or cancel your plan on the
Which payment methods are accepted?
Criminal IP offers various payment methods by country. Credit card payment is available by default and simple payment methods such as PayPal are supported. Enterprise customers can Contact Us to select a separate payment option.
I want to cancel my plan.
You can cancel your plan anytime on the My Order page after logging in to Criminal IP. Even if you cancel your plan, you can continue to use the service until the next regular payment date. If you have any additional questions regarding plan cancellation, please contact customer support at any time.
I want to delete my account.
After logging into your account, you can access the membership withdrawal page and proceed after agreeing. When you delete your account, all your search and account history as well as remaining credits will be deleted and permanently removed.
I have a question about the Enterprise plan.
Please contact us through the Contact Us page.
More questions?
What if I have other questions?
If you already have a Criminal IP account, please contact us through the customer support page for inquiries. For inquiries regarding the Enterprise membership, or if you do not have an account, please contact us through the Contact Us page.
