Criminal IP ASM is an attack surface management (ASM) solution developed by AI Spera that integrates continuous asset discovery with threat intelligence and AI-driven risk prioritization. The platform discovers and enriches assets—including IP addresses, domains, subdomains, and certificates—with contextual data such as exposure status, association with malicious infrastructure (e.g., C2 servers, torrent activity, anonymous VPNs, Tor, and proxy IP addresses), and risk scores categorized as low, medium, or high. It aggregates information from open-source intelligence (OSINT), deep web, and dark web sources to identify exposed documents, leaked API keys, hidden assets, and compromised credentials. AI algorithms analyze global threat data, correlating vulnerabilities, exploits, and emerging attack patterns with organizational assets to provide real-time intelligence for prioritization and remediation.
The solution supports integration with existing security workflows through the Criminal IP API, enabling execution from the Logpresso SOAR platform across Standard, Enterprise, Sonar, and Maestro deployments for automated monitoring of exposed IT assets. It provides real-time monitoring, daily scanning, and customizable threat data feeds with API access for automated enrichment of security tools. Statistical commands accessible via the Criminal IP API include national, ASN, service, product, and port statistics, as well as asset searches, favicon statistics, IP summaries, VPN diagnostic history, and service status queries. The platform also offers reporting on asset inventories, vulnerability status, and risk distribution to facilitate investigation and reduction of blind spots in the organization's attack surface.
