The first AI-Native threat feed wired directly into your SIEM and SOAR. VPNs, Tor, residential proxies, and C2 enriched where your team already works.
Why it matters
Average time to manually research a single suspicious IP
Of breaches involve a network indicator that was already visible
Number of attempted targeted network based attacks last year
One API call. Every field your SOC needs: verdict, threat score, geolocation, ISP, proxy and Tor flags, as well as behavioral detection indicators, all in under 50ms.
This IP belongs to an AWS EC2 instance in Hong Kong (ap-east-1) and has been identified as Botnet infrastructure.
{ "verdict" : "This IP belongs to an AWS EC2 instance in Hong Kong (ap-east-1) and has been identified as Botnet infrastructure." , "intel" : { "risk" : "very high", "score" : 75, "attribution" : "ValleyRAT", "tor_node" : false, "vpn_proxy" : false, "is_blacklisted" : false, "is_datacenter" : true, "cloud_provider" : { "provider" : "AWS", "region" : "ap-east-1", "service" : "EC2" }, "activity" : "Botnet", "first_seen" : "2026-05-07 07:36:30" }, "identity" : { "ip" : "43.199.58.243", "connection_type" : "", "isp" : "Amazon.com, Inc.", "org" : "Amazon Technologies Inc", "asn" : 16509 }, "location" : { "city" : "Hong Kong", "country" : "Hong Kong", "country_code" : "HK", "coordinates" : { "lat" : 22.3193, "lon" : 114.169 } } }
API, managed integration, or on-prem database. Speculus is built for you.
Direct, programmatic access to the NIO enrichment engine. A single REST call turns any IP address into a full intelligence object: threat score, geolocation, ASN, proxy flags, and a plain-English verdict. Built for developers who want to embed network intelligence directly into their stack.
Everything in the API, plus a fully managed deployment into your existing security stack. We connect NIO enrichment directly into Splunk, Elastic, Microsoft Sentinel, Palo Alto, or any SIEM/SOAR your team already operates. Includes custom dashboards, alert workflows, and ongoing support.
The full Speculus threat intelligence dataset in MaxMind Database format, delivered directly to your infrastructure for offline, zero-latency lookups. No API calls, no round-trips, no external dependencies. Ideal for high-throughput environments where every millisecond counts.
Let's talk about how Speculus can help you scale your network threat intelligence capabilities.