Choose the package that fits your organisation: start free with Community, or upgrade to Plus or Premium and activate your license instantly in the Threat Intelligence Portal.
Our free package is available via our Threat Intelligence Portal
Free for life
Get Community EditionMost popular
Includes everything in the free package +
From: € 99,00 / year
Upgrade to PlusIncludes everything in the plus and free package +
From: € 249,00 / year
Upgrade to PremiumLicenses are activated instantly in the portal and you can cancel anytime before renewal.
Prefer a guided tour of the platform first? Book a demo
| Feature | Q-Feeds Community | Q-Feeds Plus | Q-Feeds Premium |
|---|---|---|---|
| Feed updates | Every 24 hours | Every 4 hours | Every 20 minutes |
| Open Source (OSINT) data | |||
| Easy integration via native integrations | |||
| Premium IP data | |||
| Premium DNS data | |||
| Malicious URL data | Included, for proxies and web filters | ||
| Dark Web Monitoring | |||
| Threat lookup for extra context on detections | |||
| Vulnerability scanner | 1 scan per week per IP | 1 scan per day per asset, including web applications | |
| External attack surface management tools | |||
| Brand protection | Included, with takedown requests | ||
| Priority support | |||
| Price | Free for life |
From: € 99,00 / year |
From: € 249,00 / year |
| Get started | Get Community Edition | Upgrade to Plus | Upgrade to Premium |
Built for SOC workflows, SIEM enrichment, ticketing, and custom integrations, the API complements Q-Feeds blocklist feeds: feeds tell you that something is bad; IOC Lookup explains why and how it fits in your investigation.
From: € 49,99 / month
Buy nowIn addition to the feeds mentioned above, we also offer feeds via our TAXII 2.1 server, which provide more contextual threat intelligence for platforms that support it (e.g. SIEM solutions). The TAXII server needs an extra license.
More information about the Enterprise TAXII packageIn order to use Q-Feeds we've created a downloads page with all of our manuals for different brands like Sophos, Fortinet, Palo Alto, OPNsense etc.
View the manualsEnriching your firewall with threat intelligence will strengthen your security even more, right on the edge of your network.
“We set clear evaluation criteria up front and Q-Feeds performed well against all of them. The results we saw, made the decision to proceed a confident one.”
EASM is part of the Threat Intelligence Portal and is included with a Plus or Premium licence.
We have an on-demand and scheduled scanner available which scans for open ports and sends you an email if something has changed.
Check your infrastructure for potential web vulnerabilities, also both on-demand and scheduled.
Detect network vulnerabilities on your external IP addresses.
Our scanner checks for similar domains and if they resolve. Similar domains might be used for phishing campaigns.
Check if certain IP addresses are linked to domain names. This supports you to determine the origin of connections.
Monitor the dark web for stolen credentials and take appropriate action.
The difference between OSINT and Paid (Commercial) feeds mainly lies in the source of the data, not in how we handle it.
OSINT feeds are gathered from publicly available sources, such as community projects, research groups, open lists, news articles, and fora.
Paid feeds come from professional cybersecurity vendors who continuously collect and enrich threat data using proprietary systems.
At Q-Feeds, we apply the same rigorous process to both types of feeds. Every dataset goes through quality checks, priority scoring, and false positive validation before it's published. This ensures that regardless of the source, all indicators in our platform meet the same standard of accuracy and reliability.
In short: OSINT and Commercial feeds differ by origin, but Q-Feeds ensures both are equally verified and trustworthy.
Licenses are counted per firewall, and the number of users (FTE) is the number of people who benefit from the protection. An active-passive High Availability cluster needs one license. An active-active cluster needs two.
An active-passive cluster needs one license, because only one device processes traffic. An active-active cluster needs two, one per node, because both devices process traffic.
You can pay by card or PayPal, or choose bank transfer on invoice. With bank transfer your licenses are activated immediately and you pay the invoice within 14 days.
All prices are shown excluding VAT. VAT is calculated at checkout based on your billing country. EU businesses with a valid VAT number can use the reverse charge mechanism.
Yes. Every order comes with an invoice, and during checkout you can add order notes such as a PO number that will be printed on the invoice.
Yes. Subscriptions renew each term until canceled, and you can turn off auto-renewal at any time under My Account. Your license then simply ends at the end of the current period.
Licenses are activated instantly. After payment your license appears in the Threat Intelligence Portal, where you activate it with one click and connect your firewall or SIEM.