What AI SPERA does

AI SPERA is a Seoul-headquartered (Seongdong-gu) cybersecurity company operating the Criminal IP platform, an AI-powered threat intelligence (CTI) and attack surface management (ASM) search engine that continuously scans approximately 4.3 billion IP addresses globally in real time. The platform is structured around four product modules: Criminal IP TI (threat intelligence search engine exposed via web UI, REST API, database, and feeds for investigating IPs, domains, ownership, abuse records, malware associations, passive DNS history, and scanner activity); Criminal IP ASM (continuous external asset discovery with AI Agent risk identification, dark web monitoring, OSINT, and risk scoring beyond CVEs); Criminal IP FDS (real-time traffic analysis for bot activity, spoofed IPs, credential stuffing, and AI-powered fraud detection at large volume); and Criminal IP Brand (AI/ML-driven brand protection scanning global domains for phishing, counterfeit, and impersonating sites, with HTML pattern verification and operator attribution). In June 2026 the company introduced AITEM (AI-based Threat Exposure Management), a conceptual framework integrating agentic AI into the Continuous Threat Exposure Management (CTEM) cycle with natural language security operations, automated asset-owner identification, CVE impact triage, shadow AI detection, and guided remediation. The platform is offered through a self-serve search engine at search.criminalip.io, a freemium tier with signup credits, monthly and annual subscriptions, credit-based usage pricing, and quote-based B2B enterprise licensing with volume discounts, supplemented by API and data-feed consumption through 30+ named integration partners including Splunk, IBM QRadar, Palo Alto Cortex XSOAR, Tenable, Fortinet, Cisco, Securonix ThreatQ, Sumo Logic, Snowflake, VirusTotal, Wazuh, Tines, and STIX, plus listings on AWS Marketplace, Azure Marketplace, and Microsoft AppSource. AI SPERA distributes via direct enterprise sales, a formal channel partner and MSSP program, a technology alliance program, and PLG, targeting financial services and government as primary verticals with healthcare, gaming, and manufacturing as secondary; the platform is reported as used across more than 150 countries with alliances with more than 40 security firms, and the company holds KISA CSAP SaaS certification and the 2025 Korean Minister of Science and ICT Award.

Name

AI SPERA

Legal name

AI Spera Inc.

Website

https://criminalip.io

Company type

Private

Founded year

2017

Operating status

Operating

Headcount range

51–100 employees

Short description

AI SPERA operates Criminal IP, an AI-driven threat intelligence and attack surface management search engine scanning 4.3 billion IPs in real time. It serves financial services, government, healthcare, gaming, and manufacturing customers across 150+ countries via subscriptions, APIs, and marketplace listings.

Ownership category

akta.pro rank

Product category

Threat Intelligence and Attack Surface Management

akta.pro primary industry

Enterprise AI Governance, Risk & Compliance Platforms (Model Risk, Audit, Policies) (HDAEANAE)

akta.pro secondary industries

Model Governance, Risk & Compliance (GRC) Platforms (HDAAAKAA), Audit, Explainability & Accountability Tooling (traceability, reporting) (HDAAAKAL), Responsible AI, Security & Privacy Platforms (Safety, Guardrails, PII) (HDAEANAG)

Keywords

• Threat intelligence platform
• Attack surface management
• Fraud detection system
• Brand protection software
• Cyber threat intelligence

Headquarters

HQ city

Seongdong

HQ country

South Korea

HQ region

Asia

Offices2 records

Markets served

GTM type

B2B

Offering type

Software

Cost components

Technology or R&D, Personnel, Infrastructure, Marketing or Sales, Operations

Revenue model

1. Criminal IP Subscription: Monthly recurring subscription service (Criminal IP 이용권) where usage fees are automatically charged each month through the member's registered payment method, with automatic renewal of usage period and volume. Annual billing option is also supported.
2. Credit-based Pay-as-you-go: Account-based credits that can only be used within their validity period, are non-refundable and non-carry-over after expiration, and may be reclaimed upon Terms violation — supports usage-based consumption within subscriptions.
3. Freemium Tier: Free account registration with signup credits that grant limited search queries and API access, designed to drive product-led acquisition into paid tiers.
4. B2B Enterprise Licensing: Bulk sale of Criminal IP paid services tailored to specific corporations, with volume- and use-case-based discounts and authorized reseller arrangements that allow resellers to charge for and distribute the service to end customers.
5. API / Data Feeds (Indirect via Integration Partners): Revenue generated through API and database/feed access consumed by integration partners and embedded into SIEM, SOAR, TIP, and other security platforms (e.g., QRadar, Cortex XSOAR, ThreatQ, Splunk, Tenable, Fortinet, Cisco).

Pricing tiers

Go-to-market motion7 records

Distribution channels6 records

Marketing channels11 records

Core offering

AI SPERA sells the Criminal IP platform, an AI-powered cyber threat intelligence (CTI) and attack surface management (ASM) search engine that continuously scans approximately 4.3 billion IP addresses globally and delivers real-time IP, domain, and asset reputation data. The platform is offered as four modules — TI (search and investigation), ASM (asset discovery and risk identification), FDS (fraud detection), and Brand (phishing/counterfeit detection) — exposed through a web UI, REST API, database, feeds, and 30+ pre-built integrations with SIEM, SOAR, TIP, and cloud platforms.

Product overview

AI SPERA delivers the Criminal IP cybersecurity platform as a unified Threat Intelligence platform composed of four core modules: Criminal IP TI (threat intelligence search engine), Criminal IP ASM (attack surface management with AI-powered risk identification), Criminal IP FDS (fraud detection / traffic analysis), and Criminal IP Brand (brand protection via AI/OSINT). The platform is exposed through a Search Engine interface and a REST API integrated with 30+ security vendors (Cisco, Splunk, IBM QRadar, Palo Alto Cortex XSOAR, Tenable, Fortinet, Securonix ThreatQ, Wazuh, Tines, Sumo Logic, Snowflake, VirusTotal, Maltego, etc.), and is distributed via AWS Marketplace, Azure Marketplace, and Microsoft AppSource. In June 2026 AI SPERA introduced AITEM (AI-based Threat Exposure Management), a conceptual framework integrating agentic AI into the Continuous Threat Exposure Management (CTEM) cycle as the next chapter of Attack Surface Management. The platform is used across more than 150 countries and has formed alliances with more than 40 security firms.

Differentiator

Problem solved

Functional benefit

Brands

• Criminal IP: AI-powered cybersecurity search engine and threat intelligence platform; the company's flagship brand umbrella for its TI, ASM, FDS, and Brand product lines.
• Criminal IP TI
• Criminal IP ASM
• Criminal IP FDS
• Criminal IP Brand

Products and services

• Criminal IP TI (Threat Intelligence) Threat intelligence search engine that empowers analysts to investigate IPs, domains, and threat infrastructure in real time, uncovering ownership, abuse records, malware associations, passive DNS history, and scanner activity via Filters and Tags designed for threat hunters; available through web UI, integration-ready API, database, and feeds for security teams and SOCs.
• Criminal IP ASM (Attack Surface Management) Continuous external Attack Surface Management that discovers exposed assets — domains, IPs, ports, and services — across cloud infrastructure and shadow IT, with AI-powered risk identification, Risks Beyond CVEs, Dark Web Monitoring, and Open Source Intelligence (OSINT) for enterprise security teams.
• Criminal IP FDS (Fraud Detection System) Integrated threat-intelligence and traffic-analysis module that monitors incoming traffic in real time to detect bot activity, spoofed IPs, automated attacks, and credential stuffing using IP reputation, behavior patterns, and AI-powered detection at large volume, for fraud, risk, and security operations teams.
• Criminal IP Brand (Brand Protection) Brand protection module that continuously scans global domains to detect phishing, counterfeit, and impersonating sites using an AI/ML engine that verifies HTML patterns and structures, with operator attribution, real IP detection, persistent monitoring, and evidence-ready reports for legal action by brand, marketing, and security teams.
• Criminal IP Platform (Unified Threat Intelligence Suite) Unified Criminal IP cybersecurity platform combining the TI, ASM, FDS, and Brand modules with a search engine, REST API, database/feeds, and 30+ integrations to SIEM, SOAR, TIP, XDR, data warehouse, and cloud marketplace ecosystems for enterprise and government buyers.
• Criminal IP Search Engine Public-facing search engine interface providing real-time exploration of approximately 4.3 billion IPs to proactively detect cyber threats, with Asset Search, Domain Search, Image Search, Exploit Search, Banner Explorer, Vulnerability, Statistics, Element Analysis, Maps, and Hacking Group intelligence for analysts and researchers.

Quantifiable outcome

• Real-time monitoring and analysis of approximately 4.3 billion IP addresses globally
• +3 more outcomes

Segments5 records

Ideal customer profiles6 records

Technology focussed Yes

API detail

Has API

Yes

API docs

API detail

Core technology

AI maturity

App detail

Integration35 records

AI capability13 records

Feature7 records

Partnerships

Nine partnerships are on record, tiered flagship, core and minor.

• Securonix (ThreatQ Platform)flagshipTechnology or Integration · 1 May 2026Partnership to integrate Criminal IP's real-time IP threat intelligence into Securonix's ThreatQ Platform. Enables automated enrichment of IP indicators with maliciousness scores, VPN detection, remote access exposure, open port data, and vulnerability context for security operations teams.
• IBM QRadarflagshipTechnology or Integration · 1 February 2026Criminal IP integrated with IBM QRadar SIEM and QRadar SOAR to deliver real-time IP-based threat intelligence directly into SOC workflows. Includes two pre-built SOAR playbooks for IP threat enrichment and URL scanning, enabling automatic risk-level assessment (High/Medium/Low) of firewall traffic IP addresses.
• Palo Alto Networks Cortex XSOARflagshipTechnology or Integration · 1 December 2025Criminal IP officially integrated into Palo Alto Networks' Cortex XSOAR security orchestration platform via the Cortex Marketplace. Embeds real-time external threat context, exposure intelligence, and automated multi-stage scanning directly into XSOAR's orchestration engine for autonomous incident response.
• CiscocoreTechnology or IntegrationNamed API integration partner for embedding Criminal IP's threat intelligence into Cisco security products and workflows via the public API integrations gallery.
• TenablecoreTechnology or IntegrationNamed API integration partner listed on Criminal IP's public integrations page, enabling joint threat-intelligence and vulnerability workflows.
• FortinetcoreTechnology or IntegrationNamed API integration partner listed in the Criminal IP integrations gallery for embedding threat intelligence into Fortinet security infrastructure.
• SplunkcoreTechnology or IntegrationNamed integration partner via Splunkbase and the public Criminal IP API integrations gallery, enabling SIEM-based threat-intelligence enrichment.
• ThreatQuotientcoreTechnology or IntegrationNamed integration partner via the Criminal IP integrations gallery, enabling Threat Intelligence Platform (TIP) interoperability.
• Kivuto OnTheHubminorChannel Partner/ Reseller/ DistributorListed on the Criminal IP integrations gallery as a distribution partner for academic/education licensing.

Scale indicators7 records

Recent moves8 records

Expansion highlights6 records

Direct peers

• Recorded Future: Threat intelligence platform providing real-time intelligence on IPs, domains, malware, and adversary infrastructure, with global enterprise/government coverage. Direct overlap with Criminal IP TI and ASM capabilities, though Recorded Future operates at significantly larger scale (owned by Mastercard).
• Shodan: Internet-wide scanning and search engine for exposed devices and assets, providing IP/host intelligence across billions of addresses. Closely comparable to Criminal IP's core internet telemetry and search-engine positioning.
• Censys: Internet intelligence platform offering continuous scanning of hosts, certificates, and services for attack surface management and threat hunting. Direct competitor in ASM/CTI with overlapping API-first data products.
• GreyNoise Intelligence: Threat intelligence platform focused on internet scanning noise, mass-exploitation, and IP reputation. Comparable in IP-reputation data layer and SOAR/SIEM integration approach.
• ThreatQuotient: Threat intelligence platform that aggregates and operationalizes threat data inside enterprise SOCs, with deep SIEM/SOAR integrations. Comparable as a TIP competitor and as an existing Criminal IP integration partner.

Broad incumbents

• Mandiant (Google Cloud): Google-owned cyber threat intelligence and incident response provider with deep adversary intelligence and managed defense. Broad incumbent in the same threat intelligence category as Criminal IP TI.
• CrowdStrike: Endpoint and extended detection platform that has expanded into threat intelligence, ASM (Falcon Surface), and agentic AI-driven SOC workflows. Competes indirectly as a broader security platform consuming and producing threat data.
• VirusTotal (Google): File, URL, and IP/domain intelligence service integrated into many security stacks. Listed as a Criminal IP integration partner and a comparable threat-data aggregation service.
• Tenable: Vulnerability management and external attack surface vendor with a global enterprise install base. Competes in the ASM category (Tenable.asm) and is named as a Criminal IP integration partner.

Emerging players

• BinaryEdge: Internet-wide scanning and asset intelligence platform providing IP/port/service data with API access. Comparable to Criminal IP's data layer but smaller and more developer-focused.

Market position

Strengths5 records

Weaknesses5 records

Competitive moat6 records

Key risks6 records

Key highlights7 records

Customer concentration

• Xx.com/CriminalIP_US
• YouTubeyoutube.com/@criminalip1070
• LinkedInlinkedin.com/company/criminalip
• Facebookfacebook.com/aispera

Compliance5 records

Revenue estimate

Valuation estimate

Number of profiles

Profiles3 records

Subsidiaries1 record

Funding overview

Funding rounds4 records

Investors7 records

Funding detail is available on the Subscription and Enterprise plan.Contact sales →

M&A

Investments

M&A and investment is available on the Subscription and Enterprise plan.Contact sales →

Frequently asked questions about AI SPERA