The Criminal IP Operation for ThreatQ enhances analyst workflows by integrating rich contextual intelligence on internet-connected systems directly into the platform. Criminal IP provides detailed insights such as open ports, vulnerabilities, WHOIS data, and other network attributes that help identify malicious activity and strengthen the evaluation of indicators of compromise (IOCs).

The integration provides the following operation action:

• Criminal IP Query IP - queries Criminal IP for contextual information on IP addresses.
• Criminal IP Get Domain Reports - performs a domain reports lookup against Criminal IP.

The integration is compatible with IP Address and FQDN indicator types.