www.criminalip.io
Open in
urlscan Pro
2606:4700:10::6816:314
Public Scan
Submitted URL: http://criminalip.io/
Effective URL: https://www.criminalip.io/
Submission: On January 12 via manual from US — Scanned from DE
Effective URL: https://www.criminalip.io/
Submission: On January 12 via manual from US — Scanned from DE
Form analysis 1 forms found in the DOM
<form class="form">
<div class="searchStyle__SearchInputWrap-sc-r3o27t-5 lggsSQ SearchInputWrap "><input data-role="inputbox" maxlength="100" placeholder="Try to search assets with the following filter examples below" value="" autocomplete="off" name="query"
class="searchStyle__SearchInput-sc-r3o27t-6 cquKTG"><button type="submit" title="search" class="searchStyle__SearchButton-sc-r3o27t-7 itaEil"></button></div>
</form>Text Content
Cybersecurity Search Engine | Criminal IP
* Search
* Intelligence
* Attack Surface Management
* Developer
* Resource
* About
* English
* English
* 日本語
* 한국어
* Beta service
* LoginRegister
SEARCH FOR INFORMATION ON EVERYTHING CONNECTED TO THE PUBLIC INTERNET.
SEARCH FOR INFORMATION ON COMPUTERS
CONNECTED TO THE PUBLIC INTERNET.
Top10KeywordIP
10
DisallowedHost at
10
138.204.71.90
1
audiocodes
1
183.179.107.23
2
PBX
2
128.192.16.20
3
|cmd |
3
102.154.48.40
4
webcam
4
137.184.116.126
5
twonky
5
70.33.103.110
6
Sagemcom
6
111.8.154.35
7
AudioCodes
7
122.11.137.149
8
Authinfo
8
18.209.91.146
9
"자료"
9
190.219.183.18
10
DisallowedHost at
10
138.204.71.90
1
audiocodes
1
183.179.107.23
AssetDomainImageCertificateExploit
AssetDomainImageCertificateExploit;
Look up my IP addressCreate a Free Account
CYBERSECURITY REPORT
Cybersecurity Report
DOCKER CONTAINER SECURITY RISKS FOR YOU TO BE AWARE OF
Docker is a virtualization platform based on container technology.
Virtualization is a technology that creates virtual machines to efficiently
utilize hardware, which is a physical resource. Depending on the virtualization
method, it is divided into virtual machines and containers. Container technol
December 30th 2022
Cybersecurity Report
ALGOLIA API KEY RAISES SEVERE HACKING CONCERNS
Algolia is a hosted search engine service for web surfing that uses a SaaS
model. This service can process searches quickly and ensure easy implementation
with websites and mobile applications by issuing an Algolia API key after
registration. Thousands of companies use Algolia for this advantage alo
December 6th 2022
Cybersecurity Report
EXPOSED REDIS SERVER, A DISTRIBUTOR OF COIN MINING MALICIOUS CODE
Redis (Remote Dictionary Server) is a non-relational database management system
for storing and managing unstructured data in a key-value structure.
Unstructured data is raw data that cannot be filtered without a fixed format,
and it includes various formats like web logs, XML, JSON, images, texts,
November 26th 2022
Cybersecurity Report
NEW OPENSSL VULNERABILITY : MORE THAN 14,000 UNPATCHED SERVERS
On October 31st 2022, a new OpenSSL vulnerability was discovered. The number of
the vulnerabilities were CVE-2022-3786 and CVE-2022-3602.This vulnerability is
related to X.509 Email Address Buffer Overflow. Especially when handling
Punycode, a X.509 certificate verification name constraint check fea
November 17th 2022
Cybersecurity Report
WEB SERVER VULNERABILITIES CAUSED BY SOFTWARE PACKAGE BUNDLE
Open-source web servers, especially Apache HTTP server, has seen an tremendous
increase in the number of vulnerabilities which hackers have been consistently
exploiting since 2017. Hackers exploit various vulnerabilities to attack web
servers, with one of the targets being web servers installed as s
November 9th 2022
Cybersecurity Report
CVE-2022-40684: FORTINET AUTHENTICATION VULNERABILITY THAT THREATENS FORTINET
USERS
On Oct. 7, 2022, less than a month after the ProxyNotshell attack that used MS
Exchange Server Zero-Day vulnerability, Fortinet authentication bypass
vulnerability CVE-2022-40684 was discovered. This vulnerability is threatening
users of Fortinet products like Fortigate, Fortiproxy and Fortiswitch M
November 3rd 2022
Cybersecurity Report
DOCKER CONTAINER SECURITY RISKS FOR YOU TO BE AWARE OF
Docker is a virtualization platform based on container technology.
Virtualization is a technology that creates virtual machines to efficiently
utilize hardware, which is a physical resource. Depending on the virtualization
method, it is divided into virtual machines and containers. Container technol
December 30th 2022
Cybersecurity Report
ALGOLIA API KEY RAISES SEVERE HACKING CONCERNS
Algolia is a hosted search engine service for web surfing that uses a SaaS
model. This service can process searches quickly and ensure easy implementation
with websites and mobile applications by issuing an Algolia API key after
registration. Thousands of companies use Algolia for this advantage alo
December 6th 2022
Cybersecurity Report
EXPOSED REDIS SERVER, A DISTRIBUTOR OF COIN MINING MALICIOUS CODE
Redis (Remote Dictionary Server) is a non-relational database management system
for storing and managing unstructured data in a key-value structure.
Unstructured data is raw data that cannot be filtered without a fixed format,
and it includes various formats like web logs, XML, JSON, images, texts,
November 26th 2022
Cybersecurity Report
NEW OPENSSL VULNERABILITY : MORE THAN 14,000 UNPATCHED SERVERS
On October 31st 2022, a new OpenSSL vulnerability was discovered. The number of
the vulnerabilities were CVE-2022-3786 and CVE-2022-3602.This vulnerability is
related to X.509 Email Address Buffer Overflow. Especially when handling
Punycode, a X.509 certificate verification name constraint check fea
November 17th 2022
Cybersecurity Report
WEB SERVER VULNERABILITIES CAUSED BY SOFTWARE PACKAGE BUNDLE
Open-source web servers, especially Apache HTTP server, has seen an tremendous
increase in the number of vulnerabilities which hackers have been consistently
exploiting since 2017. Hackers exploit various vulnerabilities to attack web
servers, with one of the targets being web servers installed as s
November 9th 2022
Cybersecurity Report
CVE-2022-40684: FORTINET AUTHENTICATION VULNERABILITY THAT THREATENS FORTINET
USERS
On Oct. 7, 2022, less than a month after the ProxyNotshell attack that used MS
Exchange Server Zero-Day vulnerability, Fortinet authentication bypass
vulnerability CVE-2022-40684 was discovered. This vulnerability is threatening
users of Fortinet products like Fortigate, Fortiproxy and Fortiswitch M
November 3rd 2022
Cybersecurity Report
DOCKER CONTAINER SECURITY RISKS FOR YOU TO BE AWARE OF
Docker is a virtualization platform based on container technology.
Virtualization is a technology that creates virtual machines to efficiently
utilize hardware, which is a physical resource. Depending on the virtualization
method, it is divided into virtual machines and containers. Container technol
December 30th 2022
Cybersecurity Report
ALGOLIA API KEY RAISES SEVERE HACKING CONCERNS
Algolia is a hosted search engine service for web surfing that uses a SaaS
model. This service can process searches quickly and ensure easy implementation
with websites and mobile applications by issuing an Algolia API key after
registration. Thousands of companies use Algolia for this advantage alo
December 6th 2022
Cybersecurity Report
EXPOSED REDIS SERVER, A DISTRIBUTOR OF COIN MINING MALICIOUS CODE
Redis (Remote Dictionary Server) is a non-relational database management system
for storing and managing unstructured data in a key-value structure.
Unstructured data is raw data that cannot be filtered without a fixed format,
and it includes various formats like web logs, XML, JSON, images, texts,
November 26th 2022
Cybersecurity Report
NEW OPENSSL VULNERABILITY : MORE THAN 14,000 UNPATCHED SERVERS
On October 31st 2022, a new OpenSSL vulnerability was discovered. The number of
the vulnerabilities were CVE-2022-3786 and CVE-2022-3602.This vulnerability is
related to X.509 Email Address Buffer Overflow. Especially when handling
Punycode, a X.509 certificate verification name constraint check fea
November 17th 2022
Cybersecurity Report
WEB SERVER VULNERABILITIES CAUSED BY SOFTWARE PACKAGE BUNDLE
Open-source web servers, especially Apache HTTP server, has seen an tremendous
increase in the number of vulnerabilities which hackers have been consistently
exploiting since 2017. Hackers exploit various vulnerabilities to attack web
servers, with one of the targets being web servers installed as s
November 9th 2022
Cybersecurity Report
CVE-2022-40684: FORTINET AUTHENTICATION VULNERABILITY THAT THREATENS FORTINET
USERS
On Oct. 7, 2022, less than a month after the ProxyNotshell attack that used MS
Exchange Server Zero-Day vulnerability, Fortinet authentication bypass
vulnerability CVE-2022-40684 was discovered. This vulnerability is threatening
users of Fortinet products like Fortigate, Fortiproxy and Fortiswitch M
November 3rd 2022
CRIMINAL IP SEARCH TIP
CHECK ‘FLIPPER ZERO (HACKER’S TAMAGOCHI)’ PHISHING SITE
Flipper Zero, a portable multitool for pentester is priced at $200, is a popular
product that has recently been sold out among penetration testers and hackers.
This, called ‘hacker’s Tamagochi’ due to its appearance, has been reviewed on
various security communities such as TikTok, Twitter, and Telegram. Popularity
skyrocketed, and ‘Flipper zero’ is flying off the shelves in an online store. A
recent article by Bleeping Computer reported phishing attackers seek chances,
from this situation, to fool customers through ‘Flipper Zero’ Phishing site
using cryptocurrencies such as Bitcoin pretending an official site. Of course, a
purchaser will get nothing.It’s an interesting irony that these hackers are
targeting hackers, penetration testers and security researchers vying to
purchase Flipper Zeroes for themselves.Flipper Zero Phishing Site vs. Official
SiteWe visited several Flipper Zero phishing sites found on SNS like
twitter.They camouflage with similar URLs and favicons that, if you are not a
frequent visitor, it is almost impossible to notice the phishing site as
below. Flipper Zero phishing siteOfficial Flipper Zero online storeFlipper Zero
phishing site (Left) and Official Flipper Zero online store (Right)Smart Way to
Check Fake Flipper Zero WebsitesWe can spot differences between the official
site and the phishing sites in the URL, page UI, logo, etc.A more accurate and
faster way to check is to use the OSINT search tool. On Criminal IP’s Domain
Search, input ‘flipperzerovendoronline[.]com‘, or
‘flipperzeroinstock[.]net‘ which is not yet known as phishing on Twitter and
other social networks. Then it will lead you to the result
below.flipperzerovendoronline[.]com Search Results
: https://www.criminalip.io/domain/report?scan_id=2878623flipperzeroinsock[.]net
Search Results : https://www.criminalip.io/domain/report?scan_id=2880403Search
Results of Flipper Zero Phishing Site on Criminal IPThe result shows that
phishing sites are using malicious domains, and the algorithm tells us the
phishing probability is over 50%.In particular, the Newborn Domain information
shows that it has been for one and a half months. Still, there are attempts to
generate new ‘Flipper Zero’ phishing sites that recommend being aware of the
OSINT tool to prevent being a victim.Some detecting tools for phishing rely on
user reports, Google results, and phishing check websites, but these are the
reactive approaches that only can detect after being reported. In other words,
it is impossible to detect newborn phishing sites.Domain Search search results
of malicious IP associated Flipper Zero phishing site with screenshotsCriminal
IP, a proactive way of detecting phishing sites, shows real-time screenshots,
technology used, and mapped IPs on ‘Domain Search’. This includes recently
emerging domains.Flipper Zero Phishing Attack Likely to SpreadIn TikTok, a video
platform, several users review the ‘Flipper Zero’ to upload hacking videos and
get thousands and millions of views. ‘Flipper Zero’ gets famous not only to
hackers but also to generals, so it is necessary to be aware of ways to check
phishing sites to prevent being victims.Lesson learned: Internet users should be
familiar with ‘Domain Search’ service using OSINT tool. Check out this article
on Instagram Phishing Scams for relevant information.
January 6th 2023
Read More
Search
IP CAMERA HACKING – A NIGHTMARE TO YOUR IOT CHRISTMAS GIFTS
Christmas, which many people look forward to, is the peak season for hackers to
spread malware, leak information, and conduct phishing scams. With all the
end-of-year celebrations and public holidays, there is a lack of security staff
monitoring the increase in online shopping and congratulatory messages being
sent. Hackers will take advantage of the loosening cyber defenses and carry out
cyber crimes. In particular, IoT and smart home products, which are becoming
increasingly popular Christmas gifts, are good targets for hackers to exploit.
Therefore, it is important to be careful of IoT and IP camera hackings that may
occur. If you happen to come across an incredibly cheap Christmas special-priced
IoT device, be careful, as devices sold at affordable prices often suggest that
they have security flaws.For example. an IP camera called Wireless IP Camera
(P2P) WIFICAM has an authentication bypass vulnerability (CVE-2017-8225), so
there have been many cases where the product was found to be infected with
botnets. Smart products with security flaws allow hackers to easily hack into
users’ accounts and access all their information. In all the IP cameras, AI
speakers, and cordless vacuum cleaners sold on Amazon, eBay, and AliExpress,
there is a good chance that it has already been hacked and is being used with
malicious intent.IP Cameras With Sub-Par Authentication Settings Are the Primary
Targets Hackers who hack robot vacuum cleaners and IP cameras monitor the homes
of their victims or illegally distribute videos of them. Devices that do not
have login authentication enabled or use a default password without changing
them are usually the prime target of attacks. Searching for exposed IP cameras
on the internet using Tag: IP Camera on Criminal IP Asset Search gives a total
of 428,473 results. [Criminal IP Search 101 – How to Find Exposed IP
cameras]https://www.criminalip.io/asset/search?query=tag%3A+%22IP+Camera%22Search
Query : Tag: IP CameraSearch For “tag: IP Camera” on Criminal IP Gives a Total
Result of 428,473 Exposed IP Camera ServersIn some cases, hacked IP camera
screens can be viewed without any login authentication. Hacked IP Camera
Screen Exposed to the Internet Without Any Login AuthenticationIoT Quitely
Becoming Infected Like a ZombieIf a vulnerability is found in an IoT device,
attackers can use the vulnerability to infect and inject malicious code. This
makes a zombie device for DDoS attacks.Inputting IoT keywords into the tag
filter helps you to identify exposed IoT products and
vulnerabilities.https://www.criminalip.io/asset/search?query=tag%3A+IoTSearch
Query : Tag: IoTSearch For “tag: IoT” on Criminal IP Gives a Total Result of
46,737 Exposed IoT ServersAmong them, one IoT device was discovered to have as
many as 39 vulnerabilities. This is something hackers can exploit for another
cyber attack or sell information about the device on the dark web. Exposed IoT
Server Intelligence Analysis Results, Found to have a Total of 39
VulnerabilitiesIoT Product, IP Camera Hacking Prevention ChecklistTo ensure an
exciting Christmas, not a security nightmare, the following security protocols
should be implemented:Use products that are known to be secure Set up login
authentication on devices and use complex passwords. Remember to change
passwords from time to time.Ensure all product software is updated to the latest
version Most importantly, it is imperative to regularly use Criminal IP to
ensure that your IoT is not exposed to the internet or has any
vulnerabilities.Please refer to our ‘Criminal IP Analysis Report on Overlooked
Multi-Function Printer Vulnerability’ article for more information on IoT device
vulnerability. Source : Criminal IP (https://www.criminalip.io)Related
Article(s) : Criminal IP Analysis Report on Overlooked Multi-Function Printer
Vulnerability
December 22nd 2022
Read More
Search
COBALT STRIKE BEACON: FINDING INFECTED BOTNET SERVERS
There have been multiple instances of Cobalt Strike (a penetration testing tool)
being used maliciously for ransomware attacks or intrusion into company internal
systems. This method of attack consists of using botnet to distribute Cobalt
Strike malware, and using ransomware and PC attacks to do so. This article,
therefore, discusses methods on finding web servers infected with Cobalt Strike
(for legal pentesting or due to malicious intent) with Criminal IP.What is
Cobalt Strike?Cobalt Strike is a paid penetration testing service, and plenty of
Red Team users use this software to simulate penetration attacks.Cobalt Strike
is a tool used for penetration testingHowever, not everyone uses Cobalt Strike
in legal capacity. Cyber attackers use a pirated version of this application to
launch attacks at vulnerable servers. Because of this, Cobalt Strike is both
classified as a useful pentesting tool and malware simultaneously. The legal
distribution of this pentesting tool means that it’s harder to determine
malicious attacks launched by this software. Because of this, the Google Cloud
Threat Intelligence team recently released opensource YARA rules for determining
malicious Cobalt Strike attacks.Detect BotNet Servers Infected With Cobalt
StrikeWhile we can determine Cobalt Strike attacks through open source YARA
rules, there is an easier way to find servers infected with this form of
malware. It’s simply a matter of using the Tag filter in Criminal IP’s Asset
Search.https://www.criminalip.io/ko/asset/search?query=tag:%20Cobalt%20StrikeSearch
Query : “tag: Cobalt Strike”Results shown for “tag: Cobalt Strike” on Criminal
IPAs shown in the results, there are a total of 102 servers infected with Cobalt
Strike out of all external servers. A big chunk of these servers are likely
BotNet servers infected with Cobalt Strike. However, there is likely a few
servers that have Cobalt Strike in their systems for legal penetration testing
reasons. However, the majority here have servers allowing external access and
therefore likelier to be infected for malicious purposes.but the servers shown
here are systems that allow for external access, which heightens the chance of
ransomware infection.China is No.1 Country With Most Cobalt Strike Infected
ServersA total of 54 botnet servers are located in China, making it the country
that owns most of the Cobalt Strike malware infected
servers.https://www.criminalip.io/ko/intelligence/element-analysis/search?query=tag%3A+Cobalt+StrikeCountry
statistics shown on Criminal IP determine that China owns the most Cobalt Strike
infected serversFurthermore, port statistics show that most servers have
infected port 80 or
8080.https://www.criminalip.io/intelligence/element-analysis/search?query=tag%3A+Cobalt+StrikeStatistics
shown regarding open ports of Cobalt Strike infected servers. As shown above,
most of them have infected port 80Cobalt Strike Beacon Malware-Infected BotNet
ServersWe can further analyze the IP intelligence of BotNet IP Addresses with
Beacon installed by Cobalt Strike through Criminal IP Asset Search.IP
Intelligence analysis results of BotNet servers infected with Beacon malware by
Cobalt StrikeThis IP address’s Inbound Critical Scoring yield a danger level of
99%. This is because Criminal IP detected that this IP could be used in a cyber
attack, or was used for it. Check the Cobalt Strike tag in TCP 80 of available
Banner Information to find Cobalt Strike data associated with the server.Data
about Cobalt Strike is included in Banner Information along with BotNet IP
address and open Port 80As shown above, Criminal IP can easily find servers
infected with Cobalt Strike Beacon. This can be detected through the Criminal IP
Search Engine. Users can automatically detect infected servers with APIs.
Furthermore, information about these infected BotNet servers can be gathered to
create an Inbound IP Blacklist to prevent these servers from spreading
malware.For more content related to this discussion, check out this article
about Cryptojacking, and how your device could potentially be mining crypto
behind your back.Source : Criminal IP (https://www.criminalip.io/)Related
Article(s) : Cryptojacking : Your Device is Mining Crypto Behind Your Back
November 24th 2022
Read More
Search
HOW TO ACCESS THE DARK WEB WITHOUT USING TOR
The most well-known method of accessing the dark web is through Tor browser. The
dark web sites on Tor have .onion attached right at the end of the web address,
and can only be accessed by said web browser. However, there are methods used to
access dark web sites without using Tor. In this article, we will cover how we
can access dark web sites with a regular browser, as well as the methods used to
identify and research actual dark web sites belonging to hacker groups.How to
Access the Dark Web with a Regular BrowserCan we access a website with the
.onion domain through Chrome, a regular web browser?We can access a dark web
site through a regular browser if it has a .ly attached right after the
domain. (While accessing the website is a possibility, we don’t recommend
it.)The onion.ly domain is a proxy server domain address provided by Tor2Web.
Tor2Web is a service dedicated to allow users access to Onion services from a
regular browser.Tor2Web’s guide page to Onion.ly Proxy Servers, one of the ways
used to access the dark webDark web sites that end in onion.ly and are in a
similar format as this one (hxxp://abcdxxx1234[.]onion.ly) and users can access
it with their standard browser, exactly as if it were accessed with Tor.Onion.ly
Domains used by HackersNotorious ransomware groups are the ones that use
onion.ly links most often. This is because when a victim’s computer is infected
by ransomware, attackers demand ransom through dark websites. They provide
onion.ly links so that victims can access the dark websites
with their regular browser. Read more about this in our LockBit 3.0 ransomware
case study, where we determine how ransomwares are distributed and what must be
done to prevent them.As we can see in the list below, plenty of actual
ransomware websites use onion.ly links. Provided below are actual ransomware
links found in ransomware distribution files, as well as a how to guide to
paying the ransom they demand.Maxey
Moverleyhxxp://omegalock5zxwbhswbiscxxxxvdulyvtqqbudqousisjgc7j7yd[.]onion[.]lyBlackbyte
Grouphxxp://jbeg2dct2zhku6c2vwnpxtmxxxxxnqvvpoiiwr5hxnc6wrp3uhnad[.]onion[.]lyDAIXIN
Teamhxxp://7ukmkdtyxdkdivtjad57klqnd3kdsmq6tpxxxxu76zzv3jvitlqd[.]onion[.]lyEverest
Ransom
Teamhxxp://ransomocmou6mnbquqzxxxxjk3o5qjsl3orawojexfook2j7esad[.]onion[.]ly/aboutInspecting
the Onion.ly domain with a Security OSINT Search EngineAs stated, onion.ly links
are but one method utilized in accessing the dark web, where clicking the link
will automatically redirect you to a dark web site. Accessing the link alone can
become a legal problem depending on the country you reside. Furthermore,
accessing web sites hosted by ransomware group hackers can lead users to
becoming a target as domain providers can easily accessing IP
addresses.https://www.criminalip.io/domain/report?query=http%3A%2F%2Fomegalock5zxwbhswbisc42o2q2i54vdulyvtqqbudqousisjgc7j7yd.onion.ly%2F scan_id=2310456Search
results for the onion.ly domain analyzed by Security OSINT search engine,
Criminal IPThe results show that the Abuse Record deems this link as a Phishing
URL.In addition, real-time website screenshots can be checked without direct
access, as shown below.Search results for the onion.ly domain analyzed by
Criminal IP. Live webpage screenshot availableScreenshot of dark web website
belonging to 0mega hacker group, found with Domain SearchUse these methods to
analyze dark web sites when necessary, all without installing the Tor web
browser.We recommend users to use Security OSINT search engines when trying to
obtain certain information regarding dark web as described in this
article.Source : Criminal IP (https://www.criminalip.io)Related Article(s)
: LockBit 3.0 Ransomware Case Study: A Huge Cybersecurity Risk
October 27th 2022
Read More
Search
BEST PRACTICES
CRIMINAL IP, SPLUNK INTEGRATED FDS APP RELEASED
If you are a Criminal IP and Spunk user, here’s good news! The Criminal IP and
Splunk integrated app that integrates the log analysis platform Splunk dashboard
and the Criminal IP FDS (Fraud Detection System) API function has been
released.You can now download Criminal IP FDS from Splunkbase and mon
December 15th 2022
IP INTELLIGENCE: HOW TO HANDLE IP ADDRESSES THAT ATTEMPT TO CIRCUMVENT ANTI-SPAM
SYSTEM
In order to stop spam mails, it is common for companies to have several
anti-spam systems and spam filters implemented in their mail servers.
Nevertheless, there are many cases where anti-spam system are often bypassed. In
order to bypass the anti-spam system, attackers use official mail services fr
October 11th 2022
ATTACK SURFACE MANAGEMENT: MONITORING UNKNOWN ASSETS AND VULNERABILITIES
It is well-known that most companies utilize various network equipment,
databases, applications, and domains and that these IT properties often operate
under a myriad of IP addresses and ports. Hackers with malicious intent, with
this knowledge, begin their methods of infiltration by searching for o
August 16th 2022
OPEN PORT VULNERABILITY DETECTION: THE MORE OPEN PORTS YOU HAVE, THE MORE CYBER
THREATS EXIST
Global IP address data collected by Criminal IP (https://www.criminalip.io)
includes synthetic CTI intelligence which is including connected domains and
Whois information, location information, vulnerabilities and port
information. Port is primarily used in software as a unit to distinguish between
August 4th 2022
WHAT'S NEW ON CRIMINAL IP
January 10th 2023[#Criminal_IP v1.10.1 Release Notes] For better individual
support, new features have been updated: File Attachment Functions, Thread
system for additional inquiries, and Ticket status for reponses. Check out the
full details of our release notes. https://t.co/mw3VDr2GKIDecember 9th
2022[#Criminal_IP v1.5.1 Release Notes] More Domain Search and APIs are
available for Criminal IP Beta members! Credits for Domain Searche are granted
separately, increasing from 10 per day to 1,000 per month.
https://t.co/3erQj6IaiX #cybersecurity #Sandbox #domain #jarmNovember 22nd
2022[#Criminal_IP v1.3.1 Release Notes] New Domain Search’s Top 10 Ranking and
Report Download features added. New features and data are available now on
Criminal IP. https://t.co/fBBJLzZUbP #Domain #HTTP #malware
#CobaltStrikeNovember 2nd 2022[#Criminal_IP v1.2.15 Release Note] Check out the
release notes for more details on new Open APIs that can check malicious
information of IP, webcam / IoT product service information of IP and the
realibility of DNS server IP. https://t.co/wKibzM1ERQ #API #OpenAPI #IP #IoT
#DNS
Subscribe
CYBERSECURITY NEWS
January 9th 2023Hackers Can Abuse Visual Studio Marketplace to Target Developers
with Malicious Extensions
A new attack vector targeting the Visual Studio Code extensions marketplace
could be leveraged to upload rogue extensions masquerading as their legitimate
counterparts with the goal of mounting supply chain attacks.
January 8th 2023Hackers push fake Pokemon NFT game to take over Windows devices
Threat actors are using a well-crafted Pokemon NFT card game website to
distribute the NetSupport remote access tool and take control over victims'
devices.
January 6th 2023What Twitter’s 200 Million-User Email Leak Actually Means
The exposure of hundreds of millions of email addresses puts pseudonymous users
of the social network at risk.
API INTEGRATION
We provide straightforward, easy-to-use APIs that are designed to block
risk-scored IPs or malicious domain links. Use Criminal IP code samples to
seamlessly integrate all other functions and the database in your organization's
infrastructure.
Get StartedCode Samples
* Identification of VPN/hosting/Tor of the accessed IP
* Detection of malicious domain links
* Management of attack surface vulnerabilities within an organizational
infrastructure
→ root@criminalip ~ % |
{
"ip": "5.5.5.5",
"score": { "inbound": 0, "outbound": 0 },
"country": "de",
"country_code": "de",
"isp": "O2 Deutschland",
"status": 200
}
→ root@criminalip ~ % |
HOW API WORKS
Criminal IP’s API integration will detect and block potential malicious users
accessing login services in real time.
FAQMOST FREQUENTLY ASKED QUESTIONS ABOUT CRIMINAL IP
Criminal IP Overview
What is Criminal IP?
Criminal IP is a specialized Cyber Threat Intelligence (CTI) search engine that
allows users to search for various security-related information such as
malicious IP addresses, domains, banners, etc. It can be widely integrated with
other security systems through consumer-grade web UI and API interface to search
for malicious IP addresses, specific IP address history with risk-based scoring
based on AI Spera's proprietary algorithm. Fast display of search results and
optimized system communications satisfy the needs of end users accessing the
Live Service and Integration.
What are some features of Criminal IP?
Search for all your digital assets and vulnerabilities connected to the
internet, such as IPs, domains, IoTs, and ICS.
What can the Criminal IP search engine be used for?
Criminal IP search engine provides comprehensive information on IT asset
exposure, risk, vulnerabilities, and history of malicious IPs from the outside,
all of which enable you to make better data-informed decisions against
cyberthreats. For more details, please see the Developer > Best Practices page.
How frequently does Criminal IP update data?
Criminal IP constantly collects and updates data in real time.
Which internet browsers can be used for Criminal IP?
All web browsers accessible via computers, mobile devices, and tablets are
available, but it has been especially optimized for Chrome browser.
Do I need a separate installation?
Criminal IP does not require the installation of separate programs. Since it is
provided as a simple cloud SaaS service, you can use it through the web,
tablets, or mobile devices, practically any place where the internet is
available.
Do you have any sample code for Criminal IP?
Criminal IP provides API and sample code for each Search and Intelligence
feature. For more detailed information, see Developer > Sample Code.
How do I create a Criminal IP account?
Click "Register" at the top right to create a new account using your email or a
Google or Twitter account.
I want to change my account email.
Click the My page icon in the upper right corner and jump to the My Information
page where you can edit through the E-mail Edit button.
I'd like to get the latest news on Criminal IP.
Follow Criminal IP's official Twitter and AI Spera's LinkedIn to receive the
latest updates on Criminal IP. You can also receive Criminal IP newsletter via
the email you entered during sign-up.
Criminal IP Searching Quick Reference
What is "Asset Search?"
This is a search feature that provides 5-level risk scores combined with a
comprehensive set of information including domains, open ports, vulnerabilities,
Whois, and screenshots. Please see the Asset Search page for more details.
What is "Domain Search?"
This is a search feature that provides comprehensive data on IP, subdomains and
network logs that are associated with domain risks. Please see the Domain Search
page for more details.
What is "Image Search?"
This is a search feature that provides images of externally exposed devices,
website information, and enterprise and personal information. Please see the
Image Search page for more details.
What is "Exploit Search?"
This is a search feature that provides a full list of exploitable
vulnerabilities mapped in real time through searches for CVE ID, vulnerability
type, and platforms. Please see the Exploit Search page for more details.
What is "Banner Explorer?"
This is an intelligence feature that provides threat-related information
categorized by products and services such as cryptocurrency, database, and IoT.
For more details, please see the Banner Explorer page.
What is "Vulnerability?"
This is an intelligence feature that provides information on attack surface
exposure and vulnerability of assets via classification by CVE ID and product
name, which helps proactively monitor vulnerabilities of the applications in
use. Please see the Vulnerability page for more details.
What is "Statistics?"
This is an intelligence feature that identifies malicious IP and domain
information as well as VPN. It also provides a 10-day statistical graph in the
form of a dashboard. Please see the Statistics page for more details.
What is "Element Analysis?"
This is an intelligence feature that generates filter-specific results based on
an analysis of assets and vulnerabilities. Please see the Element Analysis page
for more details.
What is "Maps?"
This is an intelligence feature that visually represents IP geolocation
information and provides statistics on AS name, product, and country. Please see
the Maps page for more details.
Which filters are available for "Asset Search?"
Asset Search provides filters that boost search accuracy and simplicity. Please
see the Developer > Filters page.
Which filters are available for "Image Search?"
Image Search provides filters that boost search accuracy and simplicity. Please
see the Developer > Filters page.
Which filters are available for "Exploit Search?"
Exploit Search provides filters that boost search accuracy and simplicity.
Please see the Developer > Filters page.
Which tags can I use for "Asset Search?"
Asset Search provides tags that boost search accuracy and simplicity. Please see
the Developer > Filters page.
Which tags can I use for "Image Search?"
Image Search provides tags that boost search accuracy and simplicity. Please see
the Developer > Filters page.
Which categories are searchable through "Banner Explorer?"
Banner Explorer provides category-specific searches for cryptocurrencies,
databases, industrial control systems, IoT, network infrastructure, and video
games. For more details, please see the Banner Explorer page.
Which products are searchable through "Vulnerability?"
Vulnerability provides various major product categories such as MySQL, Linux,
WebLogic Server, and HTTP server that help you easily search for vulnerabilities
within a specific product. Please see our Vulnerability page for more product
categories.
What can I search for on the "Element Analysis" page?
Search for all the assets and vulnerabilities collected through Criminal IP and
sorted by country, service, ASN, product, and port number. Please see the
Element Analysis page for more details.
API Integration
Where can I get an API key?
Copy the API key by clicking the My page icon in the upper right corner and jump
to the My Information page.
Where can I get the API code?
Feature-specific API codes are available on the Developer > API page.
Do I need to use separate software for the API?
No separate software is required.
How do I make API calls?
After copying the API key, call the API using the API code listed on the
Developer > API page, and then check the results presented in JSON response
value.
Is there a limit on the number of API calls?
The number of API calls varies by license, and the Enterprise license supports
unlimited API calls. Please see the Beta Service page for more details.
What is the API call speed?
The speed of API calls varies by each license, and Enterprise license supports
an API call speed of less than 1 second. Please see the Beta Service page for
more details.
Which data can be provided by the API?
Integrate Criminal IP API with the user dataset log and identify VPN IP, Hosting
IP, Blacklist IP, Tor IP, Proxy IP, Foreign IP with a risk score.
How can the Criminal IP API be utilized?
Criminal IP API can be simply integrated with your existing database and
security systems. Identify malicious IP, domains, and vulnerabilities in real
time, enabling you to preempt attempts of account takeover, credential stuffing,
and malicious access and protect customers as well as assets. For more details,
please see the Developer > Best Practice page.
About Membership
Is the beta service free?
Criminal IP beta service will be provided free of charge, and the Enterprise
License for customized service is available for a fee. For more information,
please see the Beta Service page.
Do I need to sign up for a paid service to use the same features after the beta
service period is over?
After the beta service period ends, the same features will be available for a
fee. Those who have submitted feedback about the beta service can use the free
service for an additional month.
Do you have any other plans?
At the current stage, there are only three plans available for the beta version.
Various plans will soon be added, right after the official launch. For more
information, please see the Beta Service page.
What if the existing plans don't meet my needs?
We highly recommend choosing our unlimited custom Enterprise subscription plan.
It's the most flexible plan that is currently available, and we are always open
to address your data needs. For more information, please see the Beta Service
page.
Is it possible to get unlimited access to the database?
Yes, Enterprise licenses allow unlimited use of services and functions. For more
information, please see the Beta Service page.
How can I check my payment information?
Click the My page icon in the upper right corner and jump to the My Information
page to check your current membership and payment history.
What if I want to change my license?
Click the My page icon in the upper right corner and contact us through the
Support Ticket page.
Which payment methods are accepted?
We support all major credit/debit cards and Stripe payment systems. Please note
that the current Beta version is provided free of charge, with the exception of
the Enterprise plan, which is only available through consultation. For more
information, please see the Beta Service page.
I want to cancel my license.
Click the My page icon in the upper right corner and contact us through the
Support Ticket page.
I have a question about Enterprise License.
Please contact us through the About > Contact Us page.
Support Request
If you already have a Criminal IP account, click the My page icon in the upper
right corner and contact us through the Support Ticket page. If you do not have
an account or if you have any inquiries regarding Enterprise membership, please
contact us through the About > Contact Us page.
SHARE YOUR FEEDBACK WITH US AND GET A ONE-MONTH LICENSE FOR FREE
We are thrilled to have you on board for our first beta trial. Your genuine
feedback will be greatly appreciated since it drives us to build a top-notch
customer experience. Please take a moment to fill out the survey. Upon
completion, all participants will be entitled to a one-month complimentary
“early bird package” subscription.
Tell us what you think
go to top
PRIVACY
We use cookies to provide you with the best experience on our websites. Click
‘Accept All’ to accept all cookies. If you want to choose which others we use,
you can do so through 'Cookie settings'.
Please see our Cookie Policy for more information.
Cookie SettingsAccept All
* Search
* Asset Search
* Domain Search
* Image Search
* Exploit Search
* Intelligence
* Banner Explorer
* Vulnerability
* Statistics
* Element Analysis
* Maps
* Attack Surface Management
* What is ASM?
* Developer
* Best Practice
* Filters, Tags
* API
* Code Samples
* Resource
* Blog
* About
* AI Spera
* Contact Us
* Terms of Use
* Privacy Policy
* Cookie Policy
Contact Ussupport@aispera.com
© 2022, All Rights Reserved - AI Spera Inc.v1.11.2 - 2023.01.12