Criminal IP is a cyber threat intelligence search engine developed by AI Spera, a South Korean cybersecurity company. It scans the global internet and scores IP addresses and domains based on risk factors including open ports, vulnerabilities, phishing indicators, and malicious activity. MAGO is a domain intelligence platform with automated OSINT reconnaissance. Both analyze domains, but Criminal IP emphasizes threat scoring while MAGO focuses on comprehensive domain intelligence.
What Criminal IP Does
Criminal IP scans the internet and assigns risk scores to IP addresses and domains. It indexes open ports, identifies vulnerabilities, detects phishing sites, and flags malicious infrastructure. The platform provides five search modules: Asset Search (IP/domain lookup), Domain Search (website analysis), Image Search (favicon-based discovery), Exploit Search (CVE correlation), and Statistics (aggregate threat data).
Criminal IP's risk scoring system rates IPs and domains as Safe, Low, Moderate, Dangerous, or Critical based on multiple factors. The platform is particularly strong at identifying malicious infrastructure, phishing sites, and compromised hosts. It provides both a web interface and API for integration.
What MAGO Does
MAGO chains multiple OSINT sources into automated domain intelligence workflows. Starting from a domain name, MAGO discovers subdomains, enumerates DNS records, analyzes WHOIS data, searches certificate transparency logs, audits HTTP headers, fingerprints technology stacks, and checks threat intelligence feeds. The automated spell chaining produces comprehensive reports with severity ratings and remediation guidance.
Where Criminal IP focuses on scoring how dangerous an IP or domain is, MAGO focuses on mapping the complete attack surface of a domain and identifying specific security improvements.
Feature Comparison
| Feature | MAGO | Criminal IP |
|---|---|---|
| Primary focus | Domain intelligence | Threat scoring |
| Risk scoring | Per-finding severity | Overall IP/domain risk score |
| Subdomain discovery | Yes (multi-source) | Via domain search |
| DNS analysis | Full enumeration | Basic |
| Header auditing | Yes (OWASP grading) | Basic security checks |
| Technology detection | Yes | Yes |
| Phishing detection | Via threat intel feeds | Native detection engine |
| Malware indicators | Via OTX/ThreatFox/URLhaus | Native scanning |
| Favicon search | No | Yes (image-based discovery) |
| Exploit correlation | No | Yes (CVE matching) |
| WHOIS analysis | Yes (correlation) | Basic |
| Certificate transparency | Yes | Certificate analysis |
| Automated chaining | Yes (spell pipelines) | No (individual queries) |
| Report generation | Yes (HTML/PDF) | Dashboard + export |
Pricing
| Plan | MAGO | Criminal IP |
|---|---|---|
| Free tier | 5 scans/month | 50 credits/month |
| Individual | $49/mo | $55/mo (Lite) |
| Professional | $149/mo | $219/mo (Medium) |
| Enterprise | Custom | Custom |
Pros and Cons
Criminal IP Pros
- Comprehensive threat scoring for IPs and domains
- Native phishing and malware detection
- Favicon-based asset discovery (unique feature)
- Exploit/CVE correlation database
- Five specialized search modules for different use cases
Criminal IP Cons
- Threat-focused -- less depth in DNS, WHOIS, and certificate analysis
- No automated reconnaissance chaining
- Credit-based pricing can be restrictive for heavy users
- Less comprehensive subdomain discovery
- No automated report generation with remediation guidance
MAGO Pros
- Deeper domain intelligence with DNS, WHOIS, and certificate analysis
- Automated spell chaining for complete domain reconnaissance
- Actionable reports with specific remediation steps
- Header auditing with OWASP compliance grading
- Simpler pricing without credit-based restrictions
MAGO Cons
- No native phishing or malware detection engine
- No favicon-based asset discovery
- No exploit/CVE correlation database
- Less focus on IP-level threat scoring
The Verdict
Criminal IP is a strong choice for threat intelligence analysts who need to quickly assess whether an IP or domain is malicious, with native phishing detection and CVE correlation that MAGO does not offer. MAGO is the better choice for security teams who need comprehensive domain intelligence with automated reconnaissance and actionable remediation guidance. For complete coverage, Criminal IP's threat scoring complements MAGO's domain intelligence: use Criminal IP to assess threat levels and MAGO to map the full attack surface with remediation priorities.
See Your Domain Through MAGO
Run a free domain intelligence scan and see how MAGO compares to Criminal IP.