Skip to content
skopnix
About this paper

A wire you can check.

skopnix is a cyber threat intelligence (CTI) service. It watches international security reporting and exploitation data around the clock, checks every item against its original source, and publishes it as a free, continuously updated global threat wire.

sources watched
89Counted in the pipeline's source registry.
grounded to the original source
Every dispatch.Each one links the report that broke it.
published to Telegram and this site
@skopnixPlus the RSS and JSON feeds and the API.

How this is written

Independent, and built by practitioners.

Detection engineering, in the Caucasus and Central Asia.

skopnix exists because the reporting a defender needs was scattered across sixty sites, and almost none of it said whether the thing was actually being exploited. Everything here links back to the original report, because you should check the work rather than take it on trust.

The pipeline is automated and no human reviews each item before it publishes — that is the point, it is how the wire stays minutes behind the source instead of days. What is not automated is the standard: an actor is only tied to a CVE when a named vendor or CERT report says so, and the source is printed next to the claim so you can check it yourself.

Common questions

What is skopnix?
skopnix is a cyber threat intelligence (CTI) service. It watches international security reporting and exploitation data around the clock, checks every item against its original source, and publishes it as a free, continuously updated global threat wire.
Where does skopnix get its data?
From 89 watched sources — including NVD, CISA's Known Exploited Vulnerabilities catalogue, ransomware.live, MITRE ATT&CK, and vendor and independent security research. Every story links to the original report; skopnix aggregates and verifies, it does not author the reporting.
Is skopnix free?
Yes. The threat wire, the archive and the adversary dossiers are free to read, and the RSS and JSON feeds need no API key. Neither do the JSON API (/api/v1/items and /api/v1/actors) and the per-actor STIX 2.1 bundles. An MCP server is in development.
What does skopnix mean?
It is a coined name, from skopein — Greek for 'to look at, examine' — and nix, to get rid of something. See it, nix it. It is not a variant of any other product name.

Follow the wire.

Every exploited CVE and adversary move as it lands: Telegram for the push, RSS for your reader, a keyless JSON API and per-actor STIX for your tooling.

Check your stack

Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.

Stack checkNo key. No signup.