A live feed from real captures, not rumours
Attacker IPs, infrastructure, tooling and techniques, straight from what lands on the huntback network. First-party intelligence you can pivot on, not a recycled blocklist.
From your own sensors
Every attacker interaction is enriched: network classification, hosting and bulletproof attribution, session linkage across IP rotation, and the tooling they staged. Export it, pivot on it, or feed it into your SIEM.
Because the data is first-party, every indicator comes with the evidence behind it: the request that hit the decoy, the time, the session and what the source host was serving when huntback scanned it back. You can cite it, not just block it.
- First-party attacker captures
- Hosting and BPH attribution
- Session and infrastructure pivots
- SIEM and CEF export
AS60729 · session c:9f (2 IPs)
export → SIEM / CEF
How we deliver it
Live captures
Real attacks, not aggregated reputation.
Rich enrichment
Network type, provider, session, tooling.
Export ready
Machine-readable pull for your SOC and SIEM.
Questions about threat intelligence
What is first-party threat intelligence?
Intelligence collected from attacks against your own sensors, with the raw evidence, instead of a reputation score aggregated from someone else's data.
What does each indicator include?
The captured request, timestamps, network classification and hosting attribution, session linkage across IP rotation, and what the source host was serving when huntback scanned it back.
Can I export it?
Yes. Indicators can be exported or pulled into a SIEM, and every public research post on the huntback blog ships its indicators too.
Pivot on real attacker intelligence
Deploy a decoy and see it for yourself.