Sign in to Qriton Shield

You're on the list!

We've added {{ loginEmail }} to our early access waitlist.

We'll review your request and send an invitation when your access is approved.

Early Access Only

Qriton Shield is currently in limited beta. Join our waitlist to request access.

Email Address

Your Name

Organization

{{ authError }}

Email Address Use your business or organizational email

Your Name

I accept the Terms of Use and Privacy Policy

{{ authError }}

Check your email!

We've sent a magic link to {{ loginEmail }}

Click the link in the email to sign in. The link expires in 1 hour.

My Shields

Manage your registered Shield instances.

Register New Shield

New Shield Registered!

Important: Save these credentials now. The secret cannot be recovered!

Shield ID

{{ newShieldCredentials.shieldId }}

API Key

{{ newShieldCredentials.apiKey }}

Secret

{{ newShieldCredentials.secret }}

Configuration

Add this to your Shield's settings.json:

{
  "dasData": {
    "enabled": true,
    "serverUrl": "{{ origin }}",
    "shieldId": "{{ newShieldCredentials.shieldId }}",
    "apiKey": "{{ newShieldCredentials.apiKey }}",
    "secret": "{{ newShieldCredentials.secret }}",
    "region": "{{ newShieldForm.region }}"
  }
}

Your Shields

{{ shield.reportCount || 0 }} Reports

{{ shield.lastSeen ? formatDate(shield.lastSeen) : 'Never' }} Last Seen

You haven't registered any shields yet.

Authentication Required

Please sign in to access AI Insights.

AI Insights

Neural network anomaly detection

No Shields Registered

Threat Level {{ hopfieldState.currentTierName || 'Unknown' }}

0306080100

{{ ((hopfieldState.threshold || 0.3) * 100).toFixed(0) }}% Threshold

{{ hopfieldState.status || '-' }} Status

{{ (hopfieldState.dataPoints || 0).toLocaleString() }} Samples

{{ hopfieldState.storedPatterns || 0 }} Patterns

Feature Analysis

20 features

{{ (hopfieldState.topContributors?.[name] || 0).toFixed(1) }}%

No data

Decision History

{{ decision.tierName }} {{ typeof decision.score === 'number' ? decision.score.toFixed(1) : decision.score }} {{ formatAITime(decision.timestamp) }}

Affected IPs (click to lookup):

No decisions yet

Affected IPs

{{ getAffectedIPs().length }} unique

{{ ip.address }} {{ ip.count }}x {{ getTierName(ip.maxTier) }}

No IPs flagged

IPs appear here when decisions are triggered

Hopfield Neural Network 20-dimensional analysis Gradient attribution {{ hopfieldState.rateLimitedCount }} rate limited

Loading AI data...

No AI Data Available

This Shield hasn't reported any Hopfield data yet. Make sure the Shield is running and connected to DasData.

How Shield AI Works

Understand the neural network behind autonomous threat detection

🧠

Neural Network Threat Detection

Qriton Shield uses a Modern Continuous Hopfield Network - the same architecture behind modern AI transformers - to detect threats in real-time without predefined rules.

📊

Pattern Learning

Shield learns what "normal" traffic looks like for your application, then detects anomalies that deviate from learned patterns.

🎯

4-Tier Response

Based on anomaly score, Shield takes graduated actions: Allow → Rate Limit → Challenge → Block. No false positive storms.

🔍

Explainable Decisions

Every decision shows WHY it was made. Gradient attribution reveals which features contributed most to the detection.

⚡

Autonomous Adaptation

Shield auto-escalates during attacks and de-escalates when threats subside. Night mode ensures protection during off-hours.

Complete AI Pipeline

📡 Traffic

→

📐 20 Features

→

🧠 Hopfield

→

📊 Score

→

🛡️ Action

What is a Hopfield Network?

A Hopfield Network is a form of recurrent neural network invented by physicist John Hopfield in 1982. It serves as content-addressable memory - it can store patterns and recall them even from partial or noisy input.

Classic Hopfield (1982)

Binary states (+1/-1)
Limited capacity (~0.14N patterns)
Hard categorization
Not differentiable

                                Modern Hopfield (Shield)
                                Continuous states [-1, 1]
Exponential capacity
Soft composition ("60% A, 40% B")
Fully differentiable

                            

Energy Function (LogSumExp)

E(state) = -1/β × log(Σ exp(β × similarity(pattern_i, state))) + ½||state||²

Low energy = Traffic matches learned patterns (NORMAL)
High energy = Traffic doesn't match any pattern (ANOMALY)

💡 Fun Fact: The LogSumExp energy function is the same mechanism used in modern AI transformers (GPT, BERT). Hopfield Networks are considered the mathematical foundation of attention mechanisms.

The 20-Feature Vector

Shield extracts 20 carefully selected features from traffic across 3 layers, normalized to [-1, 1] using Z-score normalization.

Network Layer (L4)

Feature	Description	Anomaly Indicator
connections_total	Total TCP connections	Sudden spike = flood
syn_count	SYN packets sent	High = SYN flood
established_count	Completed handshakes	Low ratio = scanner
unique_ips	Distinct source IPs	Sudden spike = botnet
syn_ratio	SYN / Total ratio	High = incomplete connections
established_ratio	Established / Total	Low = failed connections

Application Layer (L7)

Feature	Description	Anomaly Indicator
requests_per_minute	HTTP request rate	High = HTTP flood
error_404_rate	404 errors / Total	High = reconnaissance
post_rate	POST requests / Total	High = POST flood
endpoint_entropy	Request distribution	Low = endpoint abuse
user_agent_variance	UA string diversity	Low = bot fingerprint

Behavioral Features

Feature	Description	Anomaly Indicator
geo_entropy	Geographic distribution	Low = geo-targeted attack
interval_variance	Time between requests	Low = automated requests
payload_size_avg	Average data size	Extreme = exfiltration

Explainable AI (XAI)

Shield doesn't just make decisions - it explains WHY using gradient-based attribution.

Example Decision

AI_STATUS Tier:3(BLOCK) Score:85.2 Threshold:0.32 | Features: SYN_Ratio=0.9(HIGH,25%) UniqueIPs=892(HIGH,20%) POSTs=450(HIGH,18%)

Interpretation:

SYN_Ratio contributed 25% to the anomaly detection
UniqueIPs contributed 20%
POST rate contributed 18%
Together these explain 63% of why this traffic was flagged

🔍 Gradient Attribution

Computes ∂E/∂feature to determine each feature's contribution to the anomaly score.

📜 Decision History

Full audit trail of every decision with timestamp, score, tier, and attribution.

🔗 IP Traceability

Track which IPs were affected by each decision and their full event timeline.

4-Tier Response System

0-30 ALLOW Normal traffic

30-60 RATE LIMIT Throttle 30/min

60-80 CHALLENGE Verify human

80-100 BLOCK Drop packets

Autonomous Adaptation

Shield operates in four adaptive modes, automatically switching based on attack intensity.

Mode	SYN Timeout	Anomaly Threshold	HTTP/min	Use Case
Relaxed	30s	0.85	1500	Low traffic periods
Balanced	20s	0.75	800	Normal operation
Aggressive	10s	0.60	400	Active attack
Lockdown	5s	0.45	200	Emergency

⬆️ Auto-Escalation

When blocks/minute > 50, Shield escalates to the next mode (relaxed → balanced → aggressive).

⬇️ Auto-De-escalation

When blocks/minute < 10 for 15 minutes, Shield de-escalates to a calmer mode.

🌙 Night Mode

Between 22:00-06:00, Shield enforces minimum "balanced" mode to protect during off-hours.

⚡ Velocity Detection

If 3+ IPs from the same /24 are blocked within 60 seconds, subnet threshold drops from 25 to 10.

Morris Counters: HLM-Inspired Infinite Scaling

Inspired by the Hopfield network's LogSumExp energy function, Shield uses Morris Counters for botnet detection that scales to infinity.

The Problem

During a massive botnet attack with 8,359+ IPs matching the same request pattern:

Linear counting: 33KB memory, 5.8 days to clean up
System would freeze or crash under load

The Solution: Logarithmic Counting

Instead of storing the actual count, store log₂(count):

Attack Size	Linear Counter	Morris Counter
8,359 IPs	33,436 bytes	13 bytes
1 Million IPs	4 MB	20 bytes
1 Billion IPs	Would crash	30 bytes
2²⁵⁵ IPs	Impossible	255 bytes

Morris Counting Algorithm

Counter value 'c' represents approximately 2^c actual events Increment rule: With probability 1/2^c, increment c by 1

c=0: Always increment (P=100%)
c=5: Increment with P=3.125%
c=13: Increment with P=0.01%

💡 Connection to Hopfield: Just as LogSumExp compresses exponential data to log scale in the energy function, Morris counters compress event counts to log scale - enabling infinite scaling with constant memory.

Authentication Required

Please sign in to access OpenClaw Intel.

OpenClaw Intel

v2 Threat Intelligence — Supply chain, semantic, exploit, behavioral, and credential threat feeds

Package Threats

Semantic Signatures

Exploit Fingerprints

Behavioral Anomalies

Credential Indicators

Tag Distribution

{{ tag }} {{ count }}

No v2 threat intelligence data yet. Shields with v2 enabled will start contributing data automatically.

Package	Registry	Malware Family	Indicators	Confidence	Reports
`{{ pkg.name }}{{ pkg.version ? '@' + pkg.version : '' }}`	{{ pkg.registry }}	{{ pkg.malwareFamily }}	{{ ind }}	{{ (pkg.confidence * 100).toFixed(0) }}%	{{ pkg.reportCount }} ({{ pkg.uniqueShields }} shields)

No package threats reported yet.

Threat Class	Description	Targeted Tool	Confidence	Reports
{{ sig.threatClass }}	{{ sig.patternDescription \|\| '—' }}	{{ sig.targetedTool \|\| '—' }}	{{ (sig.confidence * 100).toFixed(0) }}%	{{ sig.reportCount }} ({{ sig.uniqueShields }} shields)

No semantic signatures reported yet.

CVE	Target Service	Phase	Description	Confidence	Reports
`{{ exp.cve \|\| '—' }}`	{{ exp.targetService \|\| '—' }}	{{ exp.exploitPhase \|\| 'unknown' }}	{{ exp.description \|\| '—' }}	{{ (exp.confidence * 100).toFixed(0) }}%	{{ exp.reportCount }} ({{ exp.uniqueShields }} shields)

No exploit fingerprints reported yet.

Entity Type	Deviation Type	Severity	Confidence	Reports
{{ anom.entityType }}	{{ anom.deviationType }}	{{ anom.severity }}	{{ (anom.confidence * 100).toFixed(0) }}%	{{ anom.reportCount }} ({{ anom.uniqueShields }} shields)

No behavioral anomalies reported yet.

Account Settings

Manage your account information.

Account Information

Email {{ user?.email }}

Name {{ user?.name || 'Not set' }}

Member since {{ user?.created ? formatDate(user.created) : 'N/A' }}

Account details cannot be changed after registration for security and audit purposes.

Danger Zone

Permanently delete your account and all associated data.

This action cannot be undone.

Your account will be scheduled for deletion. Per GDPR requirements, your data will be retained for 30 days for legal compliance, then permanently and irreversibly deleted.

All your Shields will be immediately revoked and will stop working.

Type DELETE MY ACCOUNT to confirm:

Network Status

Live Threat Activity

{{ stats.totalThreats?.toLocaleString() || 0 }} Threat IPs

{{ stats.totalShields || 0 }} Active Shields

{{ stats.totalReports?.toLocaleString() || 0 }} Total Reports

{{ stats.avgThreatScore || 0 }} Avg Threat Score

Recent Threats

{{ (threat.threatScore * 100).toFixed(0) }}% {{ cls }}

No threats reported yet

Top Threats

{{ (threat.threatScore * 100).toFixed(0) }}% {{ threat.reportCount }} reports

No threats reported yet

Attack Classifications

IP Threat Lookup

{{ lookupResult.ip }} HIGH RISK MEDIUM RISK LOW RISK

{{ (lookupResult.threatScore * 100).toFixed(0) }}%

Threat Score

Classifications

Location

{{ lookupResult.geo.city || 'Unknown' }}, {{ lookupResult.geo.country }}

Network

ASN: {{ lookupResult.network.asn }}

Activity

First seen: {{ formatDate(lookupResult.firstSeen) }}

Last seen: {{ formatDate(lookupResult.lastSeen) }}

Reports: {{ lookupResult.reportCount }} from {{ lookupResult.reporterCount }} shield(s)

Attack Patterns

{{ formatType(pattern) }} {{ data.count }} events

AI Detection

Hopfield Neural Network detected this IP in {{ lookupResult.hopfield.decisionCount }} decision(s). Latest action: {{ lookupResult.hopfield.latestTierName }}

{{ lookupResult.ip }} NOT FOUND AI DETECTED

This IP has no threat reports in our database.

This IP was detected by the Hopfield Neural Network in {{ lookupResult.hopfield.decisionCount }} decision(s). Latest action: {{ lookupResult.hopfield.latestTierName }}

Register Your Shield

How It Works

Sign In

Create an account with your email address to get started.

Register Shield

Configure

Add the credentials to your Shield's settings.json file.

Protect

Your Shield will automatically report blocked threats to the global database.

Authentication Required

Please sign in to access Threat Feeds.

Threat Feeds

Download threat intelligence feeds to integrate with your security infrastructure.

IP Blocklist (JSON)

Complete threat IP list with scores and classifications

Download JSON

IP Blocklist (TXT)

Plain text list for firewall import

Download TXT

Subnet Blocklist

Aggregated /24 subnets with multiple threats

Download

Recent Threats

Latest reported threat IPs

Download

Authentication Required

Please sign in to access API Documentation.

API Documentation

Integrate Qriton Shield threat intelligence into your applications.

Public Endpoints

No authentication required. Rate limited to 60 requests/minute.

GET /api/lookup/{ip}

Look up threat data for a specific IP address.

curl {{ origin }}/api/lookup/1.2.3.4

POST /api/lookup/bulk

Look up multiple IPs at once (max 100).

curl -X POST {{ origin }}/api/lookup/bulk \
  -H "Content-Type: application/json" \
  -d '{"ips": ["1.2.3.4", "5.6.7.8"]}'

GET /api/feed/blocklist

Download the threat blocklist. Parameters: format (json/txt), minConfidence, minReports.

curl {{ origin }}/api/feed/blocklist?format=txt&minConfidence=0.8

GET /api/stats

Get global threat statistics.

curl {{ origin }}/api/stats

Shield Reporting

For registered Qriton Shield instances only. Requires HMAC authentication.

POST /api/report

Submit a threat report. Requires Shield authentication headers.

Headers:
  X-Shield-Id: shield_abc123
  X-Shield-Key: your-api-key
  X-Shield-Timestamp: 1705756800
  X-Shield-Signature: hmac-sha256-signature

Body:
{
  "ip": "1.2.3.4",
  "classifications": ["syn_flood", "scanner"],
  "attackPatterns": {
    "syn_flood": { "count": 150 }
  },
  "geo": { "country": "CN" }
}

Integration Examples

iptables (Linux)

#!/bin/bash
# Download and apply Qriton blocklist
curl -s {{ origin }}/api/feed/blocklist?format=txt | while read ip; do
  iptables -A INPUT -s $ip -j DROP
done

Windows Firewall (PowerShell)

$blocklist = (Invoke-RestMethod {{ origin }}/api/feed/blocklist).blocklist
foreach ($threat in $blocklist) {
  New-NetFirewallRule -DisplayName "Qriton Block $($threat.ip)" `
    -Direction Inbound -RemoteAddress $threat.ip -Action Block
}

Troll Mode Activity

Monitor attacker entertainment and deception activities across the Shield network.

{{ trollStats.total || 0 }} Total Troll Events

{{ trollStats.byType?.honeypot_capture || 0 }} Credentials Captured

{{ trollStats.byType?.tarpit || 0 }} Tarpit Traps

{{ trollStats.byType?.rickroll || 0 }} Rickrolls

Event Types

No troll events recorded yet

Recent Events

No recent troll events

Honeypot Captures

Credentials captured from attackers trying fake login pages

Username: {{ capture.credentials?.username || 'N/A' }} Password: {{ capture.credentials?.password || 'N/A' }}

No honeypot captures yet

Shield Network

{{ shield.blocksToday || 0 }} Blocks Today

{{ shield.trollEventsToday || 0 }} Trolls Today

No active shields

What is Troll Mode?

Troll Mode is a collection of attacker entertainment and deception features that waste attackers' time and resources while gathering intelligence:

🎵

Rickroll

Redirect attackers to Rick Astley's famous video

🐢

Tarpit

Slow-drip responses that waste attacker connections

🍯

Honeypot

Fake login pages that capture attacker credentials

🔄

Redirect Loops

Infinite redirect chains to confuse scanners

🎭

Fake Vulnerabilities

Simulated exploits that lead attackers nowhere

🧩

Impossible CAPTCHA

CAPTCHAs that can never be solved

💣

Zip Bomb

Compression bombs for aggressive scanners

Privacy Policy

Last updated: January 2026

1. Data Controller

Qriton Technologies ("we", "us", "our") is the data controller for the personal data processed through the Qriton Shield platform. We are established in Romania and operate under the jurisdiction of Romanian law and the European Union's General Data Protection Regulation (GDPR).

2. Data We Collect

2.1 Account Information

Email address (required for authentication)
Name (optional)
Account creation date

2.2 Threat Intelligence Data

IP addresses reported as threats by Shield instances
Attack classifications and patterns
Geolocation data derived from IP addresses
Network information (ASN, organization)

2.3 Technical Data

Shield instance identifiers
API usage logs
Session information

3. Legal Basis for Processing

We process your data based on:

Contract: To provide the Shield services you've registered for
Legitimate interest: To maintain network security and prevent cyber threats
Consent: For optional communications and marketing

4. Data Retention

We retain:

Account data: Until account deletion
Threat data: Up to 90 days after last report
Session data: 30 days
Magic link tokens: 1 hour or until used

5. Your Rights (GDPR)

Under GDPR, you have the right to:

Access: Request a copy of your personal data
Rectification: Correct inaccurate data
Erasure: Request deletion of your data ("right to be forgotten")
Portability: Receive your data in a machine-readable format
Object: Object to processing based on legitimate interest
Restrict: Limit how we use your data

To exercise these rights, contact us at privacy@qriton.com

6. Data Transfers

Your data is processed within the European Economic Area (EEA). If we transfer data outside the EEA, we ensure appropriate safeguards are in place in compliance with GDPR.

7. Security

We implement appropriate technical and organizational measures to protect your data, including:

Encryption in transit (TLS)
Secure authentication (magic links, no passwords stored)
Access controls and audit logging

8. Cookies

We use essential cookies for session management. These are strictly necessary for the service to function and do not require consent.

9. Contact & Complaints

For privacy inquiries: privacy@qriton.com

You have the right to lodge a complaint with the Romanian Data Protection Authority (ANSPDCP) or your local supervisory authority.

10. Changes to This Policy

We may update this policy periodically. Significant changes will be notified via email.

Terms of Use

Last updated: January 2026

1. Agreement

By accessing or using Qriton Shield ("the Service"), you agree to be bound by these Terms of Use. If you do not agree, do not use the Service.

2. Description of Service

Qriton Shield is a threat intelligence platform that:

Collects and aggregates threat reports from registered Shield instances
Provides threat intelligence feeds and IP lookup services
Enables collaborative defense against cyber threats

3. User Obligations

You agree to:

Provide accurate information during registration
Keep your API credentials secure and confidential
Only report genuine threat activity
Not abuse the API or attempt to circumvent rate limits
Not use the Service for any illegal purpose
Not submit false or malicious threat reports

4. Acceptable Use

The threat intelligence data provided is for legitimate security purposes only. You may NOT:

Use the data to target individuals or organizations maliciously
Redistribute the data commercially without permission
Attempt to identify individuals from IP addresses for harassment
Use automated systems to overwhelm the Service

5. Data Accuracy

Threat intelligence is provided "as is". We do not guarantee:

Complete accuracy of threat classifications
That all malicious IPs are in our database
That all IPs in our database are currently malicious

Users should implement their own verification before taking action on threat data.

6. Intellectual Property

The Qriton Shield platform, including its code, design, and documentation, is protected by intellectual property laws. You may not copy, modify, or distribute the platform without permission.

7. Account Termination

We reserve the right to suspend or terminate accounts that:

Violate these Terms
Submit false threat reports
Abuse the API or infrastructure
Are inactive for extended periods

8. Limitation of Liability

To the maximum extent permitted by law, Qriton Technologies shall not be liable for any indirect, incidental, special, consequential, or punitive damages arising from your use of the Service.

9. Indemnification

You agree to indemnify and hold harmless Qriton Technologies from any claims arising from your use of the Service or violation of these Terms.

10. Governing Law

These Terms are governed by the laws of Romania. Any disputes shall be resolved in the courts of Romania, subject to EU consumer protection regulations where applicable.

11. Changes to Terms

We may modify these Terms at any time. Continued use after changes constitutes acceptance of the new Terms.

12. Contact

For questions about these Terms: legal@qriton.com

Request IP Whitelist Review

If you believe an IP address has been incorrectly flagged as a threat, you can request a review. We take false positives seriously and will investigate all legitimate requests.

Submit a Review Request

IP Address * The IP address you believe was incorrectly flagged

Your Email * We'll contact you about the review outcome

Organization Name Optional - helps us verify legitimate services

IP Purpose *

Reason for Whitelist Request * The more detail you provide, the faster we can review your request

Supporting Evidence

I confirm that I am authorized to make this request for the specified IP address and that the information provided is accurate.

Request Submitted

Thank you for your submission. We'll review your request and contact you at {{ whitelistForm.email }} within 5 business days.

Request ID: {{ whitelistRequestId }}

Review Process

Submit Request

Provide details about the IP and why it should be reviewed

Verification

We verify ownership and review the threat reports

Analysis

Our team analyzes the traffic patterns that triggered the flag

Decision

We'll notify you of the outcome and any actions taken

Common False Positive Causes

Security Scanners: Authorized vulnerability assessments can trigger detection
Monitoring Services: Health check probes from legitimate services
VPN Exit Nodes: Shared IPs where one user's behavior affects others
CDN/Proxy: Traffic aggregation can amplify patterns
Misconfigured Services: Unintentional high-frequency requests

Before Submitting

First, check the IP's current status using our IP Lookup tool to see what triggered the flag.

Your firewall wasn't builtfor malware that thinks.

Your machine. Your model.

Every node warns every node.

5 minutes. Then forget about it.

See it in action

Protected in four steps

Deploy

Learn

Protect

Multiply

2,244 attacks per day hit the average unprotected server.

You're not alone anymore

Your data never leaves

Minutes, not days

What you're losing with a traditional WAF

Frequently asked questions

{{ cat.label }}

This isn't hypothetical.

Your legacy firewall was built for yesterday's threats.

Sign in to Qriton Shield

You're on the list!

Check your email!

My Shields

Register New Shield

New Shield Registered!

Configuration

Your Shields

Authentication Required

AI Insights

No Shields Registered

Feature Analysis

Decision History

Affected IPs

No AI Data Available

How Shield AI Works

Neural Network Threat Detection

Pattern Learning

4-Tier Response

Explainable Decisions

Autonomous Adaptation

Complete AI Pipeline

What is a Hopfield Network?

Classic Hopfield (1982)

Modern Hopfield (Shield)

Energy Function (LogSumExp)

The 20-Feature Vector

Network Layer (L4)

Application Layer (L7)

Behavioral Features

Explainable AI (XAI)

Example Decision

🔍 Gradient Attribution

📜 Decision History

🔗 IP Traceability

4-Tier Response System

Autonomous Adaptation

⬆️ Auto-Escalation

⬇️ Auto-De-escalation

🌙 Night Mode

⚡ Velocity Detection

Morris Counters: HLM-Inspired Infinite Scaling

The Problem

The Solution: Logarithmic Counting

Morris Counting Algorithm

Authentication Required

OpenClaw Intel

Tag Distribution

Account Settings

Account Information

Danger Zone

Network Status

Live Threat Activity

Recent Threats

Top Threats

Attack Classifications

IP Threat Lookup

Classifications

Location

Network

Activity

Your firewall wasn't built
for malware that thinks.