🍬CandycornDB

Instantly Score IP Risk. Detect Threats. Stop Fraud.
Real-time IP intelligence for developers, fraud teams, and cybersecurity platforms.

Start Free API Access See Use Cases

Why CandycornDB?

✅ Built for Developers
Minimal, fast JSON API. No SDKs, no friction — get started in minutes.

🧠 Proprietary Intelligence
We don’t resell stale feeds. All IP scoring data is collected, cleaned, and enriched in-house.

⚡ Real-Time Scoring
Score IPs in under 200ms with behavior, network, and subnet context baked in.

🔐 Privacy-First
No cookies, trackers, or analytics — just clean security data. You’re not the product.

Key Capabilities of CandycornDB

Threat Intelligence

Identify high-risk IPs originating from malicious sources, bulletproof hosts, and threat actor infrastructure.

Tor Exit Nodes

Detect and track Tor exit nodes to mitigate risk from anonymized and potentially malicious traffic sources.

Fraud Scoring

Generate real-time fraud scores using network behavior, geolocation mismatch, hosting patterns, and IP history.

Network Analysis

Map IP relationships and subnet behavior to expose botnets, fraud rings, and coordinated network abuse.

Advanced Fraud Scoring System

Our sophisticated fraud scoring system analyzes multiple risk factors to provide accurate threat assessment.

High Risk (70-100)

IPs in this range often indicate malicious infrastructure — such as Tor exit nodes, abuse-prone proxies, and bulletproof hosting used for fraud, scraping, or attacks.

Medium Risk (30-69)

These IPs may belong to VPNs, commercial cloud servers, or anonymization networks — often flagged for inconsistent or suspicious behavior patterns.

Low Risk (0-29)

Typically residential or business connections with strong trust signals, consistent behavior, and no historical evidence of abuse.

Our scoring model evaluates ASN reputation, geolocation stability, subnet behavior, port activity, and historical abuse signals.

Network Relationship Analysis

Identify related IPs and network clusters to uncover coordinated malicious infrastructure.

Network Analysis Features

  • Subnet Correlation: Detect IPs operating within the same subnet or CIDR range to surface coordinated abuse.
  • ASN Clustering: Group IPs by Autonomous System Numbers to reveal ISP-level risk patterns and shared infrastructure.
  • Behavioral Fingerprinting: Identify IPs exhibiting similar activity profiles — including scraping, credential stuffing, or spam behavior.
  • Risk Propagation: Amplify detection by assigning elevated risk to IPs with proximity to confirmed threats in the network graph.

Our system correlates network signals across subnet, ASN, and behavior to reveal hidden relationships between IPs — enhancing early threat detection and fraud prevention.

Our Data Sources

CandycornDB collects IP intelligence from diverse, high-confidence sources to power real-time fraud detection and threat analysis.

Tor Exit Nodes

We continuously monitor and update all active Tor exit nodes to help identify anonymous traffic often used in scraping, credential stuffing, and other high-risk behavior.

High-Risk ASNs

Includes IPs from Autonomous System Numbers (ASNs) linked to malicious infrastructure — including bulletproof hosts, spam networks, and exploit distribution.

Geographic Hotspots

We flag IPs from countries and regions frequently associated with fraud rings, botnets, or coordinated cyber operations.

Proxy & VPN Detection

Detects IPs associated with anonymizing services — including commercial VPNs, residential proxies, and open proxies commonly abused by threat actors.

Powerful API Access

Effortlessly query real-time IP intelligence with a developer-friendly API designed for scale, speed, and reliability.

curl -X GET 'https://candycorndb.com/api/public/data?page=1&limit=10' \
  -H 'X-API-Key: your_api_key_here'

Check Trust Score & Network Context for a Specific IP

curl -X GET 'https://candycorndb.com/api/public/data/network/1.2.3.4' \
  -H 'X-API-Key: your_api_key_here'

Want to integrate CandycornDB into your stack?

→ 🔧 Read the API Docs