Skip to content

Stop attacks in seconds. Explain every block.

Adaptive defense for your servers. Qriton Shield watches the network and the application, responds in proportion and records the reason for every action.

  1. BLOCK

    Known attack pattern: secret-file probes, listed 43 s after the first request

  2. CHALLENGE

    Claims to be a search crawler; the address does not confirm it

  3. ALLOW

    Verified crawler

Every public server is probed, all day.

On one of our own servers, 1.25 million requests in 255 days matched a known attack pattern, most of them looking for secret files or WordPress. Allow-or-block rules see single requests; Shield sees behaviour across sessions and networks.

And when it acts, it keeps the reason, so “the system blocked it” is never the whole answer.

More than allow or block.

Every level

Connections, reputation and web requests in one decision, including traffic that never reaches the application.

In proportion

Allow, rate-limit, challenge or block, escalating automatically during active attacks.

Explained

A recorded reason for every action. Blocks expire, and decisions stay reviewable.

From first signal to recorded reason.

  1. Watch

    Network and application signals, read together.

  2. Decide

    The lightest response that works, tightened when an attack is under way.

  3. Record

    The reason behind each action, kept for your team and your auditors.

Measured in production.

8 months

In production on a live web server

43 s

Median time from first probe to block

0 of 510

Blocked addresses back within a day

Questions.

Bring us the decision that has to be right.

BriefingPilot on your dataProduction

My Shields

Manage your registered Shield instances.

Register New Shield

{{ registerError }}

New Shield Registered!

Important: Save these credentials now. The secret cannot be recovered!
{{ newShieldCredentials.shieldId }}
{{ newShieldCredentials.apiKey }}
{{ newShieldCredentials.secret }}

Configuration

Add this to your Shield's settings.json:

{
  "dasData": {
    "enabled": true,
    "serverUrl": "{{ origin }}",
    "shieldId": "{{ newShieldCredentials.shieldId }}",
    "apiKey": "{{ newShieldCredentials.apiKey }}",
    "secret": "{{ newShieldCredentials.secret }}",
    "region": "{{ newShieldForm.region }}"
  }
}

Your Shields

{{ shield.name }}
{{ shield.shieldId }} {{ shield.region }} {{ shield.status }}
{{ shield.reportCount || 0 }} Reports
{{ shield.lastSeen ? formatDate(shield.lastSeen) : 'Never' }} Last Seen

You haven't registered any shields yet.

Sign in to continue.

Sign in to open AI Insights.

AI Insights

Neural network anomaly detection

No Shields Registered

Register a Shield to start monitoring with AI

{{ (hopfieldState.currentScore || 0).toFixed(0) }}
Threat Level {{ hopfieldState.currentTierName || 'Unknown' }}
0306080100
{{ ((hopfieldState.threshold || 0.3) * 100).toFixed(0) }}% Threshold
{{ hopfieldState.status || '-' }} Status
{{ (hopfieldState.dataPoints || 0).toLocaleString() }} Samples
{{ hopfieldState.storedPatterns || 0 }} Patterns

Feature Analysis

20 features
{{ formatFeatureName(name) }} {{ formatFeatureValue(name, value) }}
{{ (hopfieldState.topContributors?.[name] || 0).toFixed(1) }}%
No data

Decision History

{{ hopfieldHistory.length }}
{{ decision.tierName }} {{ typeof decision.score === 'number' ? decision.score.toFixed(1) : decision.score }} {{ formatAITime(decision.timestamp) }}
Affected IPs (click to lookup):
{{ ip }}
No decisions yet

Affected IPs

{{ getAffectedIPs().length }} unique
{{ ip.address }} {{ ip.count }}x {{ getTierName(ip.maxTier) }}

No IPs flagged

IPs appear here when decisions are triggered
Hopfield Neural Network 20-dimensional analysis Gradient attribution {{ hopfieldState.rateLimitedCount }} rate limited

Loading AI data...

No AI Data Available

This Shield hasn't reported any Hopfield data yet. Make sure the Shield is running and connected to the Shield network.

How Shield AI Works

Understand the neural network behind autonomous threat detection

🧠

Neural Network Threat Detection

Qriton Shield uses a Modern Continuous Hopfield Network - the same architecture behind modern AI transformers - to detect threats in real-time without predefined rules.

πŸ“Š

Pattern Learning

Shield learns what "normal" traffic looks like for your application, then detects anomalies that deviate from learned patterns.

🎯

4-Tier Response

Based on anomaly score, Shield takes graduated actions: Allow β†’ Rate Limit β†’ Challenge β†’ Block. No false positive storms.

πŸ”

Explainable Decisions

Every decision shows WHY it was made. Gradient attribution reveals which features contributed most to the detection.

⚑

Autonomous Adaptation

Shield auto-escalates during attacks and de-escalates when threats subside. Night mode ensures protection during off-hours.

Complete AI Pipeline

πŸ“‘ Traffic
β†’
πŸ“ 20 Features
β†’
🧠 Hopfield
β†’
πŸ“Š Score
β†’
πŸ›‘οΈ Action

What is a Hopfield Network?

A Hopfield Network is a form of recurrent neural network invented by physicist John Hopfield in 1982. It serves as content-addressable memory - it can store patterns and recall them even from partial or noisy input.

Classic Hopfield (1982)

  • Binary states (+1/-1)
  • Limited capacity (~0.14N patterns)
  • Hard categorization
  • Not differentiable

Modern Hopfield (Shield)

  • Continuous states [-1, 1]
  • Exponential capacity
  • Soft composition ("60% A, 40% B")
  • Fully differentiable

Energy Function (LogSumExp)

E(state) = -1/Ξ² Γ— log(Ξ£ exp(Ξ² Γ— similarity(pattern_i, state))) + Β½||state||Β²

Low energy = Traffic matches learned patterns (NORMAL)
High energy = Traffic doesn't match any pattern (ANOMALY)

πŸ’‘ Fun Fact: The LogSumExp energy function is the same mechanism used in modern AI transformers (GPT, BERT). Hopfield Networks are considered the mathematical foundation of attention mechanisms.

The 20-Feature Vector

Shield extracts 20 carefully selected features from traffic across 3 layers, normalized to [-1, 1] using Z-score normalization.

Network Layer (L4)

FeatureDescriptionAnomaly Indicator
connections_totalTotal TCP connectionsSudden spike = flood
syn_countSYN packets sentHigh = SYN flood
established_countCompleted handshakesLow ratio = scanner
unique_ipsDistinct source IPsSudden spike = botnet
syn_ratioSYN / Total ratioHigh = incomplete connections
established_ratioEstablished / TotalLow = failed connections

Application Layer (L7)

FeatureDescriptionAnomaly Indicator
requests_per_minuteHTTP request rateHigh = HTTP flood
error_404_rate404 errors / TotalHigh = reconnaissance
post_ratePOST requests / TotalHigh = POST flood
endpoint_entropyRequest distributionLow = endpoint abuse
user_agent_varianceUA string diversityLow = bot fingerprint

Behavioral Features

FeatureDescriptionAnomaly Indicator
geo_entropyGeographic distributionLow = geo-targeted attack
interval_varianceTime between requestsLow = automated requests
payload_size_avgAverage data sizeExtreme = exfiltration

Explainable AI (XAI)

Shield doesn't just make decisions - it explains WHY using gradient-based attribution.

Example Decision

AI_STATUS Tier:3(BLOCK) Score:85.2 Threshold:0.32 | Features: SYN_Ratio=0.9(HIGH,25%) UniqueIPs=892(HIGH,20%) POSTs=450(HIGH,18%)

Interpretation:

  • SYN_Ratio contributed 25% to the anomaly detection
  • UniqueIPs contributed 20%
  • POST rate contributed 18%
  • Together these explain 63% of why this traffic was flagged

πŸ” Gradient Attribution

Computes βˆ‚E/βˆ‚feature to determine each feature's contribution to the anomaly score.

πŸ“œ Decision History

Full audit trail of every decision with timestamp, score, tier, and attribution.

πŸ”— IP Traceability

Track which IPs were affected by each decision and their full event timeline.

4-Tier Response System

0-30 ALLOW Normal traffic
30-60 RATE LIMIT Throttle 30/min
60-80 CHALLENGE Verify human
80-100 BLOCK Drop packets

Autonomous Adaptation

Shield operates in four adaptive modes, automatically switching based on attack intensity.

Mode SYN Timeout Anomaly Threshold HTTP/min Use Case
Relaxed 30s 0.85 1500 Low traffic periods
Balanced 20s 0.75 800 Normal operation
Aggressive 10s 0.60 400 Active attack
Lockdown 5s 0.45 200 Emergency

⬆️ Auto-Escalation

When blocks/minute > 50, Shield escalates to the next mode (relaxed β†’ balanced β†’ aggressive).

⬇️ Auto-De-escalation

When blocks/minute < 10 for 15 minutes, Shield de-escalates to a calmer mode.

πŸŒ™ Night Mode

Between 22:00-06:00, Shield enforces minimum "balanced" mode to protect during off-hours.

⚑ Velocity Detection

If 3+ IPs from the same /24 are blocked within 60 seconds, subnet threshold drops from 25 to 10.

Morris Counters: HLM-Inspired Infinite Scaling

Inspired by the Hopfield network's LogSumExp energy function, Shield uses Morris Counters for botnet detection that scales to infinity.

The Problem

During a massive botnet attack with 8,359+ IPs matching the same request pattern:

  • Linear counting: 33KB memory, 5.8 days to clean up
  • System would freeze or crash under load

The Solution: Logarithmic Counting

Instead of storing the actual count, store logβ‚‚(count):

Attack Size Linear Counter Morris Counter
8,359 IPs 33,436 bytes 13 bytes
1 Million IPs 4 MB 20 bytes
1 Billion IPs Would crash 30 bytes
2²⁡⁡ IPs Impossible 255 bytes

Morris Counting Algorithm

Counter value 'c' represents approximately 2^c actual events Increment rule: With probability 1/2^c, increment c by 1

c=0: Always increment (P=100%)
c=5: Increment with P=3.125%
c=13: Increment with P=0.01%

πŸ’‘ Connection to Hopfield: Just as LogSumExp compresses exponential data to log scale in the energy function, Morris counters compress event counts to log scale - enabling infinite scaling with constant memory.

Sign in to continue.

Sign in to open this page.

OpenClaw Intel

v2 Threat Intelligence β€” Supply chain, semantic, exploit, behavioral, and credential threat feeds

{{ v2Stats.packageThreats || 0 }}
Package Threats
{{ v2Stats.semanticSignatures || 0 }}
Semantic Signatures
{{ v2Stats.exploitFingerprints || 0 }}
Exploit Fingerprints
{{ v2Stats.behavioralAnomalies || 0 }}
Behavioral Anomalies
{{ v2Stats.credentialIndicators || 0 }}
Credential Indicators

Tag Distribution

{{ tag }} {{ count }}

No v2 threat intelligence data yet. Shields with v2 enabled will start contributing data automatically.

Package Registry Malware Family Indicators Confidence Reports
{{ pkg.name }}{{ pkg.version ? '@' + pkg.version : '' }} {{ pkg.registry }} {{ pkg.malwareFamily }} {{ ind }} {{ (pkg.confidence * 100).toFixed(0) }}% {{ pkg.reportCount }} ({{ pkg.uniqueShields }} shields)

No package threats reported yet.

Threat Class Description Targeted Tool Confidence Reports
{{ sig.threatClass }} {{ sig.patternDescription || 'β€”' }} {{ sig.targetedTool || 'β€”' }} {{ (sig.confidence * 100).toFixed(0) }}% {{ sig.reportCount }} ({{ sig.uniqueShields }} shields)

No semantic signatures reported yet.

CVE Target Service Phase Description Confidence Reports
{{ exp.cve || 'β€”' }} {{ exp.targetService || 'β€”' }} {{ exp.exploitPhase || 'unknown' }} {{ exp.description || 'β€”' }} {{ (exp.confidence * 100).toFixed(0) }}% {{ exp.reportCount }} ({{ exp.uniqueShields }} shields)

No exploit fingerprints reported yet.

Entity Type Deviation Type Severity Confidence Reports
{{ anom.entityType }} {{ anom.deviationType }} {{ anom.severity }} {{ (anom.confidence * 100).toFixed(0) }}% {{ anom.reportCount }} ({{ anom.uniqueShields }} shields)

No behavioral anomalies reported yet.

Account Settings

Manage your account information.

Danger Zone

Permanently delete your account and all associated data.

This action cannot be undone.

Your account will be scheduled for deletion. Per GDPR requirements, your data will be retained for 30 days for legal compliance, then permanently and irreversibly deleted.

All your Shields will be immediately revoked and will stop working.

{{ deleteError }}

Network Status

Live Threat Activity

{{ stats.totalThreats?.toLocaleString() || 0 }} Threat IPs
{{ stats.totalShields || 0 }} Active Shields
{{ stats.totalReports?.toLocaleString() || 0 }} Total Reports
{{ stats.avgThreatScore || 0 }} Avg Threat Score

Attack Distribution

Threat Origins

{{ c.country }}
{{ c.count.toLocaleString() }}

Recent Threats

{{ threat.ip }} {{ threat.geo.country }}
{{ (threat.threatScore * 100).toFixed(0) }}% {{ cls }}
No threats reported yet

Top Threats

{{ threat.ip }} {{ threat.geo.country }}
{{ (threat.threatScore * 100).toFixed(0) }}% {{ threat.reportCount }} reports
No threats reported yet

Attack Classifications

{{ formatType(type) }} {{ count.toLocaleString() }}

IP lookup

Look up an IP address.

See whether an address has been reported to Qriton Shield, how risky it is and which decisions were recorded.

{{ lookupResult.ip }}

High risk Medium risk Low risk

{{ (lookupResult.threatScore * 100).toFixed(0) }}%

Threat score

Decisions

{{ lookupResult.hopfield.decisionCount }} recorded by Qriton Shield. Latest: {{ getTierName(lookupResult.hopfield.latestTier) }}

Classifications
{{ cls }}
Location
{{ lookupResult.geo.city || 'Unknown' }}, {{ lookupResult.geo.country }}
Network
{{ lookupResult.network.org }}ASN {{ lookupResult.network.asn }}
First seen
{{ formatDate(lookupResult.firstSeen) }}
Last seen
{{ formatDate(lookupResult.lastSeen) }}
Reports
{{ lookupResult.reportCount }}
Reporting Shields
{{ lookupResult.reporterCount }}
Events by pattern
  • {{ pattern }}{{ data.count }}

{{ lookupResult.ip }}

Not listed Not listed

No threat reports for this address.

No threat reports for this address.

Decisions

{{ lookupResult.hopfield.decisionCount }} recorded by Qriton Shield. Latest: {{ getTierName(lookupResult.hopfield.latestTier) }}

Register a Shield

Connect your server to Qriton Shield.

Register your Shield to report the threats it blocks to the shared threat database. Sign in or create an account to start.

How it works.

  1. Sign in

    Use your work email. We send you a sign-in link.

  2. Register the Shield

    Name the server and receive its API credentials.

  3. Configure

    Add the credentials to the Shield’s settings.json file.

  4. Protect

    The Shield reports the threats it blocks to the shared threat database.

Sign in to continue.

Sign in to download the threat feeds.

Threat Feeds

Download threat intelligence feeds to integrate with your security infrastructure.

IP Blocklist (JSON)

Complete threat IP list with scores and classifications

Download JSON

IP Blocklist (TXT)

Plain text list for firewall import

Download TXT

Subnet Blocklist

Aggregated /24 subnets with multiple threats

Download

Recent Threats

Latest reported threat IPs

Download

Sign in to continue.

Sign in to read the API documentation.

API Documentation

Integrate Qriton Shield threat intelligence into your applications.

Public Endpoints

No authentication required. Rate limited to 60 requests/minute.

GET /api/lookup/{ip}

Look up threat data for a specific IP address.

curl {{ origin }}/api/lookup/1.2.3.4
POST /api/lookup/bulk

Look up multiple IPs at once (max 100).

curl -X POST {{ origin }}/api/lookup/bulk \
  -H "Content-Type: application/json" \
  -d '{"ips": ["1.2.3.4", "5.6.7.8"]}'
GET /api/feed/blocklist

Download the threat blocklist. Parameters: format (json/txt), minConfidence, minReports.

curl {{ origin }}/api/feed/blocklist?format=txt&minConfidence=0.8
GET /api/stats

Get global threat statistics.

curl {{ origin }}/api/stats

Shield Reporting

For registered Qriton Shield instances only. Requires HMAC authentication.

POST /api/report

Submit a threat report. Requires Shield authentication headers.

Headers:
  X-Shield-Id: shield_abc123
  X-Shield-Key: your-api-key
  X-Shield-Timestamp: 1705756800
  X-Shield-Signature: hmac-sha256-signature

Body:
{
  "ip": "1.2.3.4",
  "classifications": ["syn_flood", "scanner"],
  "attackPatterns": {
    "syn_flood": { "count": 150 }
  },
  "geo": { "country": "CN" }
}

Integration Examples

iptables (Linux)

#!/bin/bash
# Download and apply Qriton blocklist
curl -s {{ origin }}/api/feed/blocklist?format=txt | while read ip; do
  iptables -A INPUT -s $ip -j DROP
done

Windows Firewall (PowerShell)

$blocklist = (Invoke-RestMethod {{ origin }}/api/feed/blocklist).blocklist
foreach ($threat in $blocklist) {
  New-NetFirewallRule -DisplayName "Qriton Block $($threat.ip)" `
    -Direction Inbound -RemoteAddress $threat.ip -Action Block
}

Troll Mode Activity

Monitor attacker entertainment and deception activities across the Shield network.

{{ trollStats.total || 0 }} Total Troll Events
{{ trollStats.byType?.honeypot_capture || 0 }} Credentials Captured
{{ trollStats.byType?.tarpit || 0 }} Tarpit Traps
{{ trollStats.byType?.rickroll || 0 }} Rickrolls

Event Types

{{ getTrollIcon(type) }} {{ getTrollTypeName(type) }} {{ count.toLocaleString() }}
No troll events recorded yet

Recent Events

{{ getTrollIcon(event.eventType) }}
{{ event.ip }} {{ getTrollTypeName(event.eventType) }}
{{ formatDate(event.timestamp) }}
No recent troll events

Honeypot Captures

Credentials captured from attackers trying fake login pages

{{ capture.ip }} {{ capture.endpoint || '/login' }}
Username: {{ capture.credentials?.username || 'N/A' }} Password: {{ capture.credentials?.password || 'N/A' }}
{{ formatDate(capture.timestamp) }}
No honeypot captures yet

Shield Network

{{ shield.name || shield.shieldId.substring(0, 12) }} {{ shield.threatMode || 'balanced' }}
{{ shield.blocksToday || 0 }} Blocks Today
{{ shield.trollEventsToday || 0 }} Trolls Today
{{ shield.lastSeen ? formatDate(shield.lastSeen) : 'Never' }}
No active shields

What is Troll Mode?

Troll Mode is a collection of attacker entertainment and deception features that waste attackers' time and resources while gathering intelligence:

🎡
Rickroll

Redirect attackers to Rick Astley's famous video

🐒
Tarpit

Slow-drip responses that waste attacker connections

🍯
Honeypot

Fake login pages that capture attacker credentials

πŸ”„
Redirect Loops

Infinite redirect chains to confuse scanners

🎭
Fake Vulnerabilities

Simulated exploits that lead attackers nowhere

🧩
Impossible CAPTCHA

CAPTCHAs that can never be solved

πŸ’£
Zip Bomb

Compression bombs for aggressive scanners

False positives

Report a false positive.

If you believe an address was flagged by mistake, tell us. Our team reviews each request and replies within five business days.

Check the address in IP lookup first to see what was reported.

We reply to this address.
Helps us verify the service.
The more detail you give, the faster the review.

Request received

Thank you.

We will review your request and reply to {{ whitelistForm.email }} within five business days.

Request ID {{ whitelistRequestId }}

How we review.

  1. Request

    You send the address and why it should be reviewed.

  2. Verification

    We confirm who is asking and read the reports on the address.

  3. Analysis

    A member of our team examines the traffic that led to the flag.

  4. Decision

    We tell you the outcome and any action taken.

Common causes.

Security scanners

Authorised vulnerability scans can look like an attack.

Monitoring services

Health checks from legitimate services.

VPN exit nodes

Shared addresses, where one user’s behaviour affects everyone else on them.

CDNs and proxies

Aggregated traffic can amplify patterns.

Misconfigured services

Unintended high-frequency requests.

We use essential cookies for authentication. Learn more