Criminal IP Brand is a threat intelligence platform that aggregates infrastructure-focused cyber threat data across approximately 4.2 billion IP addresses and hundreds of millions of domains. The system employs AI/ML algorithms to analyze HTML patterns, detect anomalies, and generate risk scores on a five-level scale from SAFE to CRITICAL, classifying assets including VPN, TOR, proxy, hosting, and scanner IPs. Core search functions encompass Asset Search for IP risk scores and ownership details; Domain Search for phishing and certificate evaluation; Exploit Search for CVE and exploit code retrieval; and Image Search for identifying vulnerable assets. The platform maintains historical fingerprints of detected sites and supports persistent monitoring through re-registration detection, server and infrastructure reuse analysis, and cloned site identification. It correlates WHOIS data, hosting details, and real IP addresses to attribute operators behind fraudulent sites, and generates evidence-ready reports compiling screenshots, site metadata, operator intelligence, and activity history.
The platform provides multiple URL scanning options—Full Scan, Phishing Scan, Lite Scan, and Quick Scan—accessible via web interface or RESTful APIs organized under a versioned path structure, with endpoints for IP summaries, hosting information, VPN detection, privacy threat assessments, banner searches, and statistical analyses. A unified credit system governs asset searches, domain searches, and URL scans across tiered membership plans, with API access supported across all tiers and advanced functionalities such as bulk queries, Real IP detection, hacking group analysis, and data downloads available through the Enterprise Plan. The suite integrates with security operations tools including SIEMs, IDS, EDR, spam filters, firewalls, fraud detection systems, and the Logpresso SOAR platform, and integrates with the Criminal IP ASM attack surface management solution for external asset exposure analysis and supply chain security insights. The product holds PCI DSS v4.0.1 Level 1 certification.
