The threat feed that tracks attackers, not IPs.
Behavioral attacker fingerprints built from JA3 hashes, request timing, header ordering, and ASN patterns. An attacker who rotates IPs every 5 minutes still carries the same behavioral signature.
Quickstart
# The threat feed is public — no key needed to read it. curl https://feed-api.qntyx.io/feed/latest # Returns the latest immutable threat-actor identity tokens as JSON.
Why Behavioral Fingerprinting
IP Rotation Is Dead
Attackers rotate IPs every request. IP blocklists are always stale. Our behavioral signatures persist across all IP changes.
Confidence Score
Each signature is scored 0.0-1.0 from weighted behavioral signals. Higher scores = more confident threat identification.
STIX/TAXII Native
Export to STIX 2.1 bundles. Push directly to Splunk, Datadog, or Elastic. One-click SIEM integration.
Live Feed Sample (TLP:WHITE)
CRITICALe7d705a3286e...QUANTUM-ACTOR-E7D705A3CREDENTIAL_HARVESTER14:32:01
HIGHa3f8b2c1e9d0...QUANTUM-ACTOR-A3F8B2C1SCANNER14:28:45
MEDIUM5c4d3e2f1a0b...QUANTUM-ACTOR-5C4D3E2FAUTOMATED14:25:12
CRITICALb1c2d3e4f5a6...QUANTUM-ACTOR-B1C2D3E4APT_LIKE14:22:38
LOWf6e5d4c3b2a1...QUANTUM-ACTOR-F6E5D4C3PROXY_ROTATOR14:18:55
HIGH9a8b7c6d5e4f...QUANTUM-ACTOR-9A8B7C6DCREDENTIAL_HARVESTER14:15:20
CRITICALe7d705a3286e...QUANTUM-ACTOR-E7D705A3CREDENTIAL_HARVESTER14:32:01
HIGHa3f8b2c1e9d0...QUANTUM-ACTOR-A3F8B2C1SCANNER14:28:45
MEDIUM5c4d3e2f1a0b...QUANTUM-ACTOR-5C4D3E2FAUTOMATED14:25:12
CRITICALb1c2d3e4f5a6...QUANTUM-ACTOR-B1C2D3E4APT_LIKE14:22:38
Pricing
Professional
$49/mo
- REST API (TLP:GREEN)
- 10,000 calls/day
- 2 SIEM — Splunk, Datadog, Elastic
- STIX/TAXII export
Enterprise
$149/mo
- Full TLP access (RED)
- Unlimited API
- Unlimited SIEM
- Dedicated feed + priority support