Criminal IP
Criminal IP provides threat intelligence solutions for uncovering exposed assets and detecting malicious infrastructure.
- Categories
- Threat intelligence, Attack surface management, Fraud and payment fraud prevention, OSINT tools
- Based in
- Torrance, South Korea
- Founded
- 2017
- Ownership
- Private
About Criminal IP
Criminal IP is a threat intelligence platform that helps organisations find exposed assets, spot malicious infrastructure and lower risk by adding context to security workflows. It sells to security teams across manufacturing, financial services, government, healthcare and gaming. Its main offerings are a search engine, attack surface management, fraud detection and threat intelligence delivered through API, database feeds or on-premise deployment. The search engine lets analysts look into IPs, domains and threat infrastructure as events happen, using filters and tags to see ownership, abuse records, malware links, passive DNS history and scanner activity. Criminal IP ASM scans external environments to find domains, IPs, ports and services, including cloud systems and shadow IT, and uses AI to rank risks beyond CVEs. Criminal IP FDS examines incoming traffic to catch bot activity, spoofed IPs and automated attacks. Threat intelligence feeds come in JSON, TXT, STIX 2 and MISP formats, and can be set to confidence thresholds to cut false positives. The company says its data is gathered by scanning global IPs, monitoring ports and running honeypot servers, with updates in real time.
Products
- Criminal IP Search EngineA tool for analysts to look into IPs, domains and threat infrastructure as events happen, with filters and tags for threat hunting.
- Criminal IP ASMAn attack surface management service that scans external environments to find exposed assets and uses AI to rank risks beyond CVEs.
- Criminal IP FDSA fraud detection system that examines incoming traffic in real time to spot bot activity, spoofed IPs and automated attacks.
- Criminal IP TIA threat intelligence offering that provides context on risks targeting infrastructure, available through API, database feeds or on-premise deployment.