Uncover threats before they strike your region.
reconn is the authorized Criminal IP distributor for the Middle East and Africa. We license, deploy and support Criminal IP TI and Criminal IP ASM for MSSPs, channel partners, SOC teams, threat analysts and government security operations across the GCC, the Levant, North Africa and Sub-Saharan Africa.
Two products, one intelligence layer: Criminal IP TI for IP intelligence, domain intelligence and threat actor tracking, Criminal IP ASM for attack surface management across everything you own and did not know you owned. Regional licensing, procurement and support handled by reconn as distributor.
reconn is the authorized Criminal IP distributor for the Middle East and Africa. Criminal IP is a cyber threat intelligence search engine and attack surface management platform built by AI SPERA. reconn holds regional distribution, which means licensing, procurement, deployment, integration, partner enablement and support all happen in-region, in your time zone, under contracts your finance team can actually process.
The region needs that combination. Organizations here run hybrid cloud estates across multiple jurisdictions, under regulators that do not share a rulebook, while state-aligned and criminal actors work through the same critical infrastructure, financial and government networks year after year. Global tooling rarely reflects that picture, and global vendors rarely answer the phone at the right hour.
Criminal IP scans the entire public IPv4 space continuously, runs its own honeypot network, and folds in more than a hundred OSINT sources plus dark web collection. The output is not a pile of raw indicators. It is a decision-ready record for an IP, a domain or a threat actor, with the context an analyst needs to triage, hunt, attribute and contain without leaving the tool.
This page covers both halves of the platform: Criminal IP TI for IP intelligence, domain intelligence and threat actor tracking, and Criminal IP ASM for attack surface management across everything your organization exposes to the internet. It also covers how we work with MSSPs and channel partners across the region.
Authorized Criminal IP distributor for the Middle East and Africa.
MSSPs, resellers, system integrators and consultancies, with deal registration.
GCC, Levant, North Africa and Sub-Saharan Africa.
Regional pre-sales, deployment, integration and escalation.
01Regional Demand
Threat intelligence and attack surface management spend is not spread evenly across the region. It concentrates in the cities where regulation, cloud migration and targeted attacks arrive at the same time: nine of them across the GCC, then Amman and Beirut, the financial and telecom capitals of North Africa, and the fast-scaling SOC markets of Sub-Saharan Africa. Twenty-two cities, four sub-regions, one intelligence layer. If you run a security team, an MSSP or a channel business in any of them, the pattern below will be familiar.
The densest concentration of regulated SOC work in the region. Every GCC state now runs its own control catalogue, and every one of them names asset inventory, continuous monitoring and threat intelligence as things you have to evidence rather than assert. This is also where attack surface management usually enters the conversation first, because most teams here discover they cannot list what they own before they discover who is looking at it.
The regional headquarters city. Financial services, aviation, logistics, hospitality and the largest concentration of MSSPs, integrators and security distributors in the Middle East. Dubai government entities work to the Dubai Electronic Security Center's Information Security Regulation, DIFC firms sit under their own data protection regime, and federal entities under the UAE Information Assurance Regulation.
The practical effect is that a Dubai security team is usually answering to more than one framework at once, across an estate spread over free zones, multiple clouds and a long tail of third parties. That is an attack surface problem before it is a threat intelligence problem, and most teams discover it in that order.
Critical national infrastructure and sovereign capital. Energy, utilities, aviation, healthcare and government sit here, alongside ADGM as a financial free zone and ADHICS as a sector-specific standard for healthcare. The exposure profile skews heavily toward operational technology, industrial systems and long-lived infrastructure that was never designed to be internet-reachable.
Two consequences follow. Exposed OT and IoT assets need to be found continuously rather than audited annually, and deployment often has to be on-premise or air-gapped because the data cannot leave the environment. Both are buying requirements before they are feature preferences.
The fastest-growing security market in the region, and the most prescriptive. The National Cybersecurity Authority's Essential Cybersecurity Controls apply to government and critical national infrastructure, with separate cloud and critical systems controls layered on. SAMA's framework governs financial services, the Personal Data Protection Law is administered by SDAIA, and CITC covers telecom and ICT.
On top of that sits Vision 2030. Giga-projects and rapid cloud migration are creating new external attack surface faster than any manual inventory can track it, and much of it is greenfield infrastructure standing up in months rather than years. Local presence and data residency expectations also make in-region distribution and on-premise deployment close to mandatory.
The Kingdom's port and trade capital. Shipping lines, freight operators, Red Sea industrial projects and a growing bank and fintech presence, all under NCA Essential Cybersecurity Controls and, on the financial side, SAMA. The external surface here is unusually third-party heavy: customs integrations, freight portals and partner APIs that no single team has a complete list of.
The Eastern Province runs the Kingdom's oil, gas and petrochemical estate, which puts operational technology squarely in scope. The NCA's Operational Technology Cybersecurity Controls turn continuous asset discovery into an audit item rather than an engineering preference, and air-gapped or on-premise deployment is the norm rather than the exception.
Qatar's National Cyber Security Agency sets the national framework and Qatar Central Bank governs the financial sector. LNG, aviation, government and the infrastructure built for global events give Doha a large, permanent and highly visible attack surface — visible enough to draw hacktivist attention around every regional event.
CITRA's cybersecurity framework applies across regulated entities, with the Central Bank of Kuwait covering financial services. Oil sector operational technology, a heavily government-centric IT estate and a still-consolidating vendor market make external asset discovery the first capability most programs actually need.
Bahrain's financial sector sits under the Central Bank of Bahrain's cybersecurity requirements, and a cloud-first government policy moved much of the national estate onto public cloud early. Regulated finance plus cloud-native infrastructure produces exactly the kind of surface that changes faster than an annual audit can describe it.
MTCIT and OCERT set national direction, and the Personal Data Protection Law added a compliance floor in 2023. Ports and logistics at Sohar and Duqm, plus energy and utilities, mean the exposure profile leans industrial and is spread across sites rather than concentrated in one data center.
Smaller budgets, higher exposure. Banking and telecom carry most of the security spend, analyst headcount is thin, and most programs run through an in-country partner rather than a direct vendor relationship. That combination is precisely why decision-ready intelligence beats a raw indicator feed here: there is rarely anyone free to enrich an indicator by hand.
Jordan's National Cyber Security Center and the 2019 cybersecurity law set the framework, with the Central Bank of Jordan governing financial services. Amman is also the region's shared-services and outsourcing hub, which means a single security team is frequently defending infrastructure that serves clients in five other countries.
Attack surface management earns its place fast in that model, because the inventory question is not "what do we own" but "what do we operate on behalf of someone else, and who audits it".
Banking carries most of Lebanon's security spend, under Banque du Liban circulars rather than a single national control catalogue. Infrastructure instability and a thin analyst market make context-rich intelligence far more valuable than volume: one enriched record that settles an escalation is worth more than a feed nobody has time to triage.
Most engagements here run through a regional partner with an existing enterprise relationship, which is the model reconn's channel program is built around.
Financial services and telecom are digitizing faster than their security inventories are being updated, under data protection laws that all landed inside the last six years. Procurement favors local presence and on-premise deployment, and the customer-facing surface — apps, APIs, payment gateways and the partners plugged into them — is where most new exposure appears.
Egypt's Supreme Cybersecurity Council, the Personal Data Protection Law 151/2020 and the Central Bank of Egypt's cybersecurity framework cover the largest banking and telecom estate in North Africa. Digital payment adoption has been fast enough that the external surface now changes weekly rather than quarterly.
The practical demand here is attack surface discovery first, threat intelligence second: institutions are onboarding fintech partners faster than they are documenting the integrations those partners bring with them.
Morocco's DGSSI administers national cybersecurity law, with CNDP on data protection and Bank Al-Maghrib over the banks. Casablanca Finance City concentrates regional financial operations in one place, and with them a cross-border attack surface that reaches into francophone West Africa.
Groups headquartered here routinely secure subsidiaries in five or six countries, which makes automatic asset discovery from a single domain the only realistic way to keep an inventory current.
Hydrocarbons and state telecom dominate, which puts operational technology and national infrastructure at the center of the exposure picture. Data protection law adds a compliance layer, and procurement strongly favors local presence with on-premise deployment rather than a cloud-hosted service.
ANSI runs national cybersecurity, with INPDP on data protection. A large offshoring and IT services sector means much of the infrastructure in Tunis is operated on behalf of European clients — and inherits their audit requirements, their reporting deadlines and their expectations about evidence along with the work.
Mobile money made the financial sector internet-facing before the security programs caught up, and national cybersecurity laws have arrived quickly since 2019. The result is the fastest-growing MSSP market on the continent, buying an intelligence layer it can license, automate against and resell inside a managed service rather than build from scratch.
Nigeria's commercial capital and the densest banking and fintech market in Africa. The Nigeria Data Protection Act 2023, the Central Bank of Nigeria's risk-based cybersecurity framework and NITDA guidance all apply, and fraud pressure is constant enough that detection is a commercial requirement before it is a compliance one.
Most fintechs here stood up their external surface in months rather than years, and very few hold a complete inventory of it. Automatic asset discovery, phishing and fraud domain detection and credential leak monitoring are the three things that get asked for first.
East Africa's SOC and MSSP base, and the home of mobile money at scale. The Data Protection Act 2019, the Computer Misuse and Cybercrimes Act and Central Bank of Kenya guidance apply across a financial sector that is effectively internet-facing by design.
Nairobi also exports managed security into the wider region, so an intelligence layer licensed here typically gets resold across several markets. That makes API access, multi-tenant automation and white-label reporting the deciding features rather than nice-to-haves.
POPIA, the Cybercrimes Act and South African Reserve Bank directives cover the continent's largest concentration of listed enterprises, mining groups and financial institutions. Ransomware and extortion activity against South African targets has been sustained rather than episodic.
Estates here are old, layered and acquisition-heavy, which is the exact profile where attack surface management finds the most that nobody knew about — forgotten subsidiaries, expired certificates and services still answering on infrastructure that was decommissioned on paper years ago.
Ghana's Cyber Security Authority licenses cybersecurity service providers under the Cybersecurity Act 2020 — a regime that directly shapes how MSSPs operate — with Bank of Ghana directives covering financial services.
POPIA applies, but the profile differs from Johannesburg: technology, BPO and cloud-native scaleups whose infrastructure is entirely external-facing and rebuilt on a weekly release cycle.
INSA sets national security policy, and the African Union headquarters concentrates diplomatic and regional infrastructure. Telecom liberalization has added new operators, new networks and a great deal of new external surface in a short window.
TCRA regulates communications, with the Personal Data Protection Act 2022 and the Cybercrimes Act setting the legal floor. Banking and port logistics carry the security spend, increasingly delivered by regional MSSPs rather than in-house teams.
What Is Driving It
Continuous monitoring, threat intelligence and asset inventory are no longer implied by regional control catalogues. They are line items an auditor asks you to evidence.
Cloud migration, giga-projects, acquisitions and shadow IT add external assets faster than a spreadsheet-based inventory can absorb them. Nobody knows the real number.
State-aligned espionage against energy, government and finance, plus hacktivism that spikes with regional events. Generic global feeds under-represent both.
Hiring cannot keep pace with alert volume anywhere in the region. Decision-ready intelligence beats a raw indicator feed when there is nobody free to enrich it.
Data residency expectations in Saudi Arabia and the UAE make on-premise and air-gapped options a requirement, and make an in-region distributor the practical route to buy.
Regional SOCs are being built at pace. Every one of them needs an intelligence layer it can license, automate against and resell inside its own managed service.
For MSSPs and channel partners in Dubai, Abu Dhabi, Riyadh, Cairo, Lagos and Nairobi: this demand is landing in your pipeline as questions you already get asked. What is exposed on our perimeter, who is targeting us, is this indicator worth escalating, and can you prove it. Criminal IP answers all four with evidence, and it attaches to services you already sell rather than requiring a new one. reconn handles the licensing, enablement and pre-sales so your team can lead with the outcome. See the partner program.
02Criminal IP TI
Criminal IP TI brings IP intelligence, domain intelligence and emerging threat data into a single platform. Rather than aggregating raw indicators, it surfaces the context analysts across the Middle East and Africa actually need to triage alerts, hunt threats, investigate incidents and decide, without switching tools or sources.
Scanned and indexed through proprietary global infrastructure, a distributed honeypot network and 100+ OSINT sources.
Real-time domain and URL scanning returns structured domain intelligence across every key risk dimension.
Deep insight into advanced persistent threats and the infrastructure they operate against this region.
Coverage
Access Methods
Interactive threat hunting with advanced filters for vulnerability, location, product, service and behavioral signals. Pivot across related infrastructure and pull historical data for trend analysis.
Structured JSON responses for direct integration into SIEM, SOAR, XDR and custom security workflows. Documented, versioned and built for automation at volume.
Self-hosted threat intelligence for instant, scalable investigation with no external calls. Built for air-gapped, classified and high-performance requirements common across regional government and defense.
Threat intelligence feeds. Continuously updated feeds on malicious IPs, domains and infrastructure, formatted for direct ingestion into firewalls, proxies and orchestration tooling. Customizable to the indicator types and confidence thresholds your team actually acts on. Ask about feed formats.
03Criminal IP ASM
Traditional attack surface management tools hand you an asset list. Criminal IP ASM enriches every discovered asset with live threat intelligence, so the output is not an inventory to work through but a ranked set of things that actually matter. Deployed and supported across the region by reconn.
One domain or IP is enough to start. Everything connected to it is found, classified and kept current.
The same intelligence layer behind Criminal IP TI assesses every asset ASM finds.
Beyond CVE discovery. Risk is prioritized from context, not from a severity score alone.
Hidden and exposed assets, surfaced from three layers of the web rather than one.
SSL/TLS lifecycle tracked automatically, so an expiry never becomes an incident.
Most of what compromises an organization is not sitting in a vulnerability database.
Daily continuous monitoring, with alerts that arrive already carrying their context.
Automated High, Medium and Low tiering driven by threat intelligence, not by CVSS in isolation.
Findings move into the workflow your team already runs, with a record of what was decided.
Three Layers of Exposure
Google Hacking results, public databases, exposed documents, leaked API keys and configuration files that any search engine can already reach.
Hidden assets and sensitive data behind authentication, forms and unindexed paths, routinely missed by conventional ASM tooling.
Continuous monitoring of dark web sources for leaked accounts and credentials tied to your organization, so exposure is caught before it is used.
Manual or automatic. Manual Asset Registration ASM scans the IP ranges and domains you register. Automatic Asset Detection ASM takes a single domain or IP and discovers every related IP and subdomain within two to three days, then keeps finding new ones. Most organizations start automatic and add manual entries after an acquisition or for a subsidiary audit. Ask which fits your estate.
04Distribution & Channel
Criminal IP is built by AI SPERA. reconn holds authorized distribution for the Middle East and Africa, which means every commercial and technical step happens in-region: licensing, procurement, deployment, integration, enablement and escalation.
Partner Program
Register an opportunity and it is protected. Margin is predictable, and you are not competing against the vendor or against another partner on the same account.
Not-for-resale access so your team can learn the platform properly, plus demo reports on a prospect's real attack surface to open the conversation with evidence.
We join your calls. Scoping, architecture, proof of concept and technical objection handling, so a smaller channel team can still sell a technical product.
Training for your analysts and engineers on Criminal IP TI and ASM, delivered on-site or online, so delivery does not depend on one person who read the docs.
Joint campaigns, regional events, webinars and content built around your accounts rather than a generic vendor template.
For MSSPs building a productized offering, help shaping what the service includes, how it is priced per client, and how the API automation is structured.
Regional Coverage
United Arab Emirates, Saudi Arabia, Qatar, Kuwait, Bahrain and Oman. Our home market and the densest concentration of regulated SOC and critical infrastructure work.
Jordan, Lebanon, Iraq and neighboring markets, typically through in-country partners with existing enterprise and government relationships.
Egypt, Morocco, Algeria, Tunisia and Libya, where financial services and telecom security programs are moving quickly.
Nigeria, Kenya, Ghana, South Africa, Ethiopia, Tanzania and beyond, largely through MSSPs and integrators building regional SOC capability.
Already selling security in the region? Threat intelligence and attack surface management attach cleanly to almost every security service, from managed detection to compliance assessments, because the output is evidence rather than another dashboard your client has to learn. Open a partner conversation and we will map it to what you already sell.
05What Changes
These hold for TI and ASM alike, because both run on the same intelligence layer. The difference is only whether you are pointing it at someone else's infrastructure or your own.
Comprehensive visibility powered by real-time IP intelligence, domain scanning, and OSINT plus dark web monitoring. You see what single-source tooling structurally cannot.
Intelligent risk scoring surfaces the threats that need attention now, so analyst hours go to the queue that matters instead of the one that is longest.
Mean time to respond drops when complete threat context and remediation guidance are already attached to the indicator rather than assembled during the incident.
Continuous discovery identifies and classifies new assets as the estate expands, so the inventory does not quietly go stale between audits.
Real-time domain and IP intelligence exposes weaknesses while they are still weaknesses. Decisions get made against what is live on your perimeter today, not against a quarterly report describing what was live when it was written.
06Security Operations
Criminal IP is not a new process to adopt. It slots into the six things a SOC does every day and removes the part where an analyst opens six browser tabs to build context by hand.
Analysts use threat scoring, abuse history and behavioral signals to enrich alerts from existing tooling, prioritize high-risk indicators and cut investigation noise.
Pivot from a single IP or domain to related infrastructure: connected IPs, subdomains, shared services and shared hosting that reveal the wider campaign.
During an incident, infrastructure intelligence and historical context explain attacker behavior, support containment decisions and track attacker-controlled assets.
Analyze domains and URLs for phishing behavior, suspicious redirect chains and exposed content, so a report can be validated or dismissed quickly.
Correlate IPs, domains and hosting data to identify patterns, link infrastructure to threat actors and track campaign activity over time.
Use scan data and vulnerability insight to find exposed services, misconfigurations and viable attack vectors across your own infrastructure.
07Built For
Criminal IP TI and ASM give your SOC decision-ready intelligence to detect threats faster, reduce alert fatigue and hand clients richer incident context. The differentiator is scale: global threat actor tracking, real-time OSINT and dark web monitoring across every account you manage.
Integration with your existing SIEM and SOAR brings threat intelligence into the workflows analysts already live in. Detect compromised assets, investigate events with full infrastructure context and make containment calls faster.
Search-powered threat hunting, dark web monitoring and threat actor tracking put detailed context in one place, so an investigation stops being an exercise in context switching.
Automated asset discovery and risk prioritization reduce blind spots and make sure the vulnerabilities that matter get the attention, with reporting that survives a board conversation.
Track threat actors targeting the region, follow infrastructure linked to regional campaigns and stay ahead of emerging threats, with a deployment model that works inside classified environments.
08Feature Matrix
| Capability | What you get |
|---|---|
| IP Intelligence | Global scanning, honeypot network and 100+ OSINT sources. AI-based 5-tier risk scoring, open ports and service banners, CVE/CWE mapping, VPN/Proxy/Tor/C2 detection, abuse records, SSL certificates and domain history. |
| Domain Intelligence | Real-time scanning across every risk dimension: phishing detection, SSL/TLS configuration scanning, CVE mapping, sub-domain enumeration, risk scoring, redirection analysis, exposed config detection, JARM hashing and network packet analysis. |
| Threat Actor Monitoring | IOCs, IOAs, TTPs and CVEs. Kill chain indicators, MITRE ATT&CK mapping, geographic targeting and compromised asset discovery. |
| Search Engine | Interactive threat hunting with advanced filters, pivoting across related infrastructure, historical data access and flexible analysis. |
| API Access | RESTful API with structured JSON responses, custom integration and air-gapped environment support. |
| On-Premise Database | Self-hosted intelligence, scalable investigations, no external calls and classified environment support. |
| Threat Feeds | Continuously updated IOC feeds, malicious IP and domain lists, infrastructure data and straightforward integration. |
| Data Freshness | Real-time continuous updates. 4.29 billion IPs scanned in approximately 3 days, with continuous feed delivery. |
| Capability | What you get |
|---|---|
| Continuous Discovery | A single domain or IP entry triggers auto-discovery. Related IPs and subdomains identified automatically, new assets found continuously, complete inventory maintained. |
| Intelligence Integration | Advanced domain scanning and IP analysis, instant visibility into malicious activity and threat detection across the whole attack surface. |
| Vulnerability Validation | AI-driven automation, dangerous and critical port identification, connected application analysis, exploit correlation and real-time vulnerability analysis. |
| OSINT & Dark Web | Surface web exposure detection, deep web asset discovery, dark web credential monitoring, configuration file detection and public source aggregation. |
| Certificate Monitoring | SSL/TLS certificate discovery, expiration tracking, self-signed certificate detection and configuration scanning. |
| Risk Beyond CVEs | C2 detection, anonymization service detection, policy violations, abuse record tracking, real IP detection and phishing or fraud detection. |
| Real-Time Alerts | Daily continuous monitoring, contextual alerts, change notifications and an always-current asset status. |
| Risk Prioritization | AI-driven categorization into High, Medium and Low tiers, intelligent scoring and critical threat ranking. |
| Collaboration Tools | Built-in comments, team coordination, clear documentation and remediation tracking. |
| Integrations | API-first design with SIEM, SOAR and XDR integration, REST API and custom automation. |
Criminal IP TI and Criminal IP ASM share one intelligence layer. Organizations that run TI and ASM together get the same enrichment on an external indicator and on their own exposed asset, which is what makes attribution work in both directions.
09Why Criminal IP
Continuously scanned data rather than a historical database. The context competitors report is often already stale.
Context-rich records built for analysts, not IOC dumps that need manual enrichment before anyone can use them.
Monitor actors targeting the Middle East and Africa, with MITRE ATT&CK mapping and infrastructure correlation.
Attack surface management powered by threat intelligence, not asset discovery with a vulnerability scan bolted on.
API-first design that fits the SIEM, SOAR, XDR and vulnerability management stack you already operate.
Detection across surface, deep and dark web in one platform, instead of three subscriptions and a spreadsheet.
On-premise for air-gapped environments, API for automation, search engine for the humans doing the hunting.
Procurement, deployment, integration and support handled in-region by reconn, in your time zone.
Trust Indicators
Global public IP addresses scanned approximately every 3 days, 24/7, by proprietary infrastructure.
OSINT sources correlated alongside a proprietary honeypot network and global scanners.
Risk scoring with no reported data reliability issues when blocking on Dangerous or Critical ratings.
Real IP detection unmasks sources behind Cloudflare, VPNs and mobile proxies. Threat actor tracking is aligned to MITRE ATT&CK. Breach history is collected through C-TAS, CTI feeds and Criminal IP's own honeypot operations.
10Questions
A threat intelligence platform providing real-time, decision-ready intelligence on IP addresses, domains, threat actors and emerging threats. It combines global IP scanning, honeypot networks, 100+ OSINT sources and dark web monitoring in a single platform, covering alert triage, threat hunting, incident response and infrastructure attribution.
Criminal IP updates its intelligence by continuously scanning global IPs, monitoring ports and operating honeypot servers to detect active threats and C2 infrastructure. Rather than serving history-based data, it scans 4.29 billion IP addresses in approximately 3 days on a continuous cycle, so the record you read reflects what is live now.
AI-based 5-tier risk scoring for inbound and outbound traffic, open ports with service banners and application fingerprinting, CVE and CWE mapping with exploit references, VPN/Proxy/Tor/Anonymous VPN/Hosting/CDN/Mobile classification, C2 server identification, scanner IP detection, abuse records with threat actor attribution, SSL certificate data and domain history mapped to the IP.
Phishing detection, SSL/TLS configuration analysis, CVE and CWE mapping, sub-domain enumeration, domain risk scoring, connected IP reputation, redirection chain analysis, exposed configuration file detection, JARM hashing with tech stack vulnerability mapping, and network packet log analysis on URL access.
Collection runs continuously in real time. All 4.29 billion global public IP addresses are scanned approximately every 3 days, with continuous updates pushed to the platform between full sweeps.
Yes. Criminal IP TI integrates with leading SIEM, SOAR and XDR platforms through a full-featured RESTful API with structured JSON responses, dedicated integrations with platforms including Splunk and Cisco, customizable threat intelligence feeds, and custom integration support where a specific requirement is not covered. Ask us to scope the integration.
Criminal IP's 5-level risk scoring has no reported errors or data reliability issues when organizations block IPs rated Dangerous or Critical. The continuous scanning methodology is what supports that validity, and it is why customers are comfortable wiring the scores directly into firewall systems.
Yes. Criminal IP can track and identify the real source IP of malicious users hidden behind Cloudflare and similar services, and it detects IP addresses masked by VPNs, mobile proxies and other anonymization services.
Accumulated malicious activity information for an asset, including activity detected by IDS, malware, phishing and ransomware. It is collected through C-TAS (Criminal IP's Threat Advisory System), cyber threat intelligence feeds, and Criminal IP's own honeypot operations.
Universally applicable features are developed on the product roadmap. For customer-specific requirements, custom development is available, with additional cost for the customization and implementation work. Enterprise B2B contract customers also get access to Criminal IP TI training, delivered on-site or online.
Four: the interactive search engine for threat hunting, the RESTful API for integration and automation, an on-premise database for self-hosted and air-gapped environments, and customizable threat intelligence feeds for ingestion into existing tools.
Through reconn. We handle regional licensing, procurement paperwork, deployment and ongoing support, so you are not managing a vendor relationship across time zones. Open a comms channel and we will size it against your environment.
A threat intelligence-powered attack surface management platform combining continuous automated asset discovery with threat analysis and AI-driven risk prioritization. Where traditional ASM tools list assets, Criminal IP ASM enriches every discovered asset with real-time threat intelligence.
Domains and subdomains, IP addresses and ranges, SSL/TLS certificates, cloud infrastructure across AWS, Azure and GCP, IoT devices, connected applications such as MySQL instances, printers and web servers, and web services and APIs. Everything is categorized by geographic data, cloud provider, ASN and application information.
Criminal IP continuously scans ports on IP addresses worldwide in real time to extract and analyze running applications. When dangerous ports are open on a registered IP, or a vulnerability is found in a connected application, it is classified as an attack surface risk and shown on the dashboard with its threat context attached.
Manual Asset Registration ASM: you register IP ranges and domains, and you see scan data for exactly those. It will not discover new or unregistered assets. Automatic Asset Detection ASM: a single domain or IP entry triggers discovery of all related IPs and subdomains within 2 to 3 days, and new assets keep surfacing automatically, which is what eliminates unknown assets.
All of your IT assets by default. Pricing is scaled to asset volume, so talk to us with a rough estate size and we will come back with a figure.
Yes. Manual Asset Registration ASM is manual-only. Automatic Asset Detection customers have most assets discovered for them but can still add entries by hand, which matters for new IP ranges after an acquisition or when auditing a subsidiary.
No. Criminal IP ASM is fully web-based. On Manual ASM you log in and register your IP addresses and domains. On Automatic ASM you log in, enter a single domain or IP, and owned assets are discovered and registered within 2 to 3 days.
Not as a standard self-serve trial. What is available instead is a demo report on your own IT assets' attack surface, or a consultation on your current security posture. In practice the demo report is more useful, because it is your estate rather than a sandbox. Request one.
Traditional ASM provides asset visibility and stops there. Criminal IP ASM integrates real-time threat intelligence into every asset assessment, automatically correlating vulnerabilities with emerging exploits, threat actor infrastructure and observed malicious activity. The output is context-driven risk prioritization rather than an asset list you still have to triage.
Open-Source Intelligence is publicly available information that can itself constitute a security risk. Criminal IP ASM scans for exposed assets across the internet using Google Hacking techniques, public databases and forums, then presents what it finds on your dashboard in a form you can act on rather than a raw result list.
Yes, across all three layers. Surface web via OSINT, Google Hacking, public databases and exposed files. Deep web for hidden assets and sensitive data beyond the surface. Dark web for continuous monitoring of leaked accounts, credentials and exposed data related to your organization, so you can act before the credentials are used.
Daily continuous monitoring of every discovered asset. Scans update in real time as new exposures, certificate expirations and asset changes are detected.
New assets discovered, vulnerabilities identified on existing assets, SSL certificates expiring or expired, credential leaks detected, and threat context changes such as an asset becoming linked to malicious activity. Every alert carries its threat context, so prioritization does not require a second lookup.
Asset inventory and status dashboards, risk prioritization reports across High, Medium and Low tiers, vulnerability and exposure summaries, certificate monitoring reports, credential leak notifications, and custom reports for compliance and stakeholder communication. The automated discovery, vulnerability mapping and risk prioritization together give you the evidence base most attack surface compliance questions ask for.
Continuous discovery picks up new assets as they appear, whether from an acquisition, a new cloud deployment or an infrastructure change, and adds them to your dashboard within 2 to 3 days on Automatic Detection ASM.
API-first, with integration into SIEM platforms, SOAR platforms, XDR solutions, vulnerability management tools and custom security workflows. All integrations use the REST API with structured JSON responses.
reconn is the authorized Criminal IP distributor for the Middle East and Africa. Criminal IP is built by AI SPERA; reconn holds regional distribution and handles licensing, procurement, deployment, integration, partner enablement and support across the GCC, the Levant, North Africa and Sub-Saharan Africa.
The GCC (United Arab Emirates, Saudi Arabia, Qatar, Kuwait, Bahrain, Oman), the Levant and wider Middle East (Jordan, Lebanon, Iraq and neighboring markets), North Africa (Egypt, Morocco, Algeria, Tunisia, Libya) and Sub-Saharan Africa (Nigeria, Kenya, Ghana, South Africa, Ethiopia, Tanzania and beyond). Coverage outside the GCC is usually delivered together with an in-country partner.
Six things at once: regional control catalogues now name continuous monitoring and threat intelligence as auditable line items, attack surface is outgrowing the inventory, the region is specifically targeted, analyst hiring cannot keep pace, data residency pushes deployment on-premise, and the MSSP market is scaling fast. The full breakdown by city is here.
Yes, and those three cities are where most of our work sits. Dubai for the MSSP and integrator concentration, Abu Dhabi for critical national infrastructure and air-gapped deployment, Riyadh for NCA and SAMA-driven programs and Vision 2030 giga-projects. We also cover Doha, Kuwait City, Manama, Muscat, Cairo and Sub-Saharan Africa, usually alongside an in-country partner.
Yes, and it is a large part of what we do. We work with MSSPs and MDR providers, resellers and VARs, system integrators, consultancies, government and defense integrators, and telcos building their own security services. The partner program covers deal registration, NFR and demo access, pre-sales engineering, technical enablement, co-marketing and service design support.
Register the opportunity with us before you engage. Once registered it is protected, so your margin is predictable and you are not competing against us or against another partner on the same account. Tell us about the opportunity.
Yes. MSSPs commonly wrap Criminal IP TI enrichment and ASM monitoring into a productized managed service rather than reselling licenses directly. We help shape what the service includes, how it is priced per client, and how the API automation is structured so one analyst can cover many tenants.
Yes. The on-premise database is self-hosted with no external calls, which is what makes it viable for classified environments, defense integrators and organizations with data residency obligations. We scope and deploy these in-region. Ask us to scope one.
Criminal IP TI is priced by access method and query volume. Criminal IP ASM is priced by asset scale, and you can monitor all of your IT assets by default. Partner pricing and multi-tenant models differ from end-user pricing. Tell us your rough estate size and we will come back with a figure rather than a range.
Yes, and it is the fastest route. We produce a demo report on your own IT assets' attack surface, so the conversation is about what was actually found rather than about a feature list. Partners can request the same report for a prospect. The search engine is also free to try with no commitment.
Yes. Enterprise B2B contract customers get access to Criminal IP TI training, on-site or online. Channel partners get technical enablement for their own analysts and engineers, so delivery capability does not sit with a single person.
Send an enquiry through the contact form, email hello@reconn.io, or message us on WhatsApp. Tell us whether you are evaluating for your own organization or looking at the partner route, and we will route it accordingly.
Open a comms channel
Two routes in. If you are securing your own organization, we will size Criminal IP against your environment and show you what it finds before you commit to anything. If you sell security in Dubai, Abu Dhabi, Riyadh or anywhere across the region, we will map the partner program to what you already sell. Either way you are talking to the authorized distributor, not a reseller of a reseller.
Direct Lines
Criminal IP is built by AI SPERA. reconn is the authorized distributor for the Middle East and Africa, handling licensing, procurement, deployment, integration, partner enablement and support in-region. A demo report on your own attack surface is the fastest way to see whether this is worth your time.
