The threat feed that tracks attackers, not IPs.
Behavioral attacker fingerprints built from JA3 hashes, request timing, header ordering, and ASN patterns. An attacker who rotates IPs every 5 minutes still carries the same behavioral signature.
Quickstart
# The threat feed is public — no key needed to read it. curl https://feed-api.qntyx.io/feed/latest # Returns the latest immutable threat-actor identity tokens as JSON.
Why Behavioral Fingerprinting
IP Rotation Is Dead
Attackers rotate IPs every request. IP blocklists are always stale. Our behavioral signatures persist across all IP changes.
Confidence Score
Each signature is scored 0.0-1.0 from weighted behavioral signals. Higher scores = more confident threat identification.
STIX/TAXII Native
Export to STIX 2.1 bundles and pull them into your own tooling. Direct SIEM push is not available yet.
Live Feed Sample (TLP:WHITE)
CRITICALe7d705a3286e...QUANTUM-ACTOR-E7D705A3CREDENTIAL_HARVESTER14:32:01
HIGHa3f8b2c1e9d0...QUANTUM-ACTOR-A3F8B2C1SCANNER14:28:45
MEDIUM5c4d3e2f1a0b...QUANTUM-ACTOR-5C4D3E2FAUTOMATED14:25:12
CRITICALb1c2d3e4f5a6...QUANTUM-ACTOR-B1C2D3E4APT_LIKE14:22:38
LOWf6e5d4c3b2a1...QUANTUM-ACTOR-F6E5D4C3PROXY_ROTATOR14:18:55
HIGH9a8b7c6d5e4f...QUANTUM-ACTOR-9A8B7C6DCREDENTIAL_HARVESTER14:15:20
CRITICALe7d705a3286e...QUANTUM-ACTOR-E7D705A3CREDENTIAL_HARVESTER14:32:01
HIGHa3f8b2c1e9d0...QUANTUM-ACTOR-A3F8B2C1SCANNER14:28:45
MEDIUM5c4d3e2f1a0b...QUANTUM-ACTOR-5C4D3E2FAUTOMATED14:25:12
CRITICALb1c2d3e4f5a6...QUANTUM-ACTOR-B1C2D3E4APT_LIKE14:22:38