For security teams, by security engineers
Unmask the intent behind every connection. Identify VPNs, Tor nodes, and Residential Proxies to stop hackers before they reach your endpoints.
Why it matters
Average time to manually research a single suspicious IP
Of breaches involve a network indicator that was already visible
How long Speculus takes to return a full enriched threat verdict
One API call. Every field your SOC needs: verdict, threat score, geolocation, ISP, proxy and Tor flags, and enriched identity. Returned as a structured JSON object in under 50ms.
This IP is an active Tor Exit Node routing traffic through datacenter infrastructure in Amsterdam.
{ "nio_verdict" : "This IP is an active Tor Exit Node routing traffic through datacenter infrastructure in Amsterdam." , "intel" : { "risk" : "medium", "score" : 35, "type" : "VPN", "tor_node" : true, "vpn_proxy" : true, "is_blacklisted" : true, "is_datacenter" : true }, "identity" : { "ip" : "192.42.116.92", "connection_type" : "Cellular", "isp" : "Church of Cyberology", "org" : "Tor Exit and More", "asn" : 215125 }, "location" : { "city" : "Amsterdam", "state" : "North Holland", "country" : "Netherlands", "country_code" : "NL", "coordinates" : { "lat" : 52.374, "lon" : 4.8897 } } }
API, managed integration, or on-prem database. Speculus is built for you.
Direct, programmatic access to the NIO enrichment engine. A single REST call turns any IP address into a full intelligence object: threat score, geolocation, ASN, proxy flags, and a plain-English verdict. Built for developers who want to embed network intelligence directly into their stack.
Everything in the API, plus a fully managed deployment into your existing security stack. We connect NIO enrichment directly into Splunk, Elastic, Microsoft Sentinel, Palo Alto, or any SIEM/SOAR your team already operates. Includes custom dashboards, alert workflows, and ongoing support.
The full Speculus threat intelligence dataset in MaxMind Database format, delivered directly to your infrastructure for offline, zero-latency lookups. No API calls, no round-trips, no external dependencies. Ideal for high-throughput environments where every millisecond counts.
Industry context changes everything. We bring proven enrichment strategies that move faster with less risk.
Risk-aware IP intelligence and governed enrichment pipelines for regulated environments. Detect fraud vectors and sanctions evasion in real time.
See how leading security teams deploy NIO intelligence in production.
Speculus partnered with a Tier-1 financial institution to embed real-time IP enrichment into their fraud detection pipeline, cutting false positives by 34% in 90 days.
Our new v3 architecture processes 100,000+ enrichment requests per second with no cold-start latency. Here's how we rebuilt the data pipeline.
A regional health system replaced 3 hours of daily manual threat research with automated NIO enrichment in Splunk. Zero additional headcount.
Let's talk about how Speculus.ai can help you scale network intelligence and achieve measurable security outcomes.
No credit card required · SOC 2 Type II · Enterprise SLAs available