Skip to content
skopnix
Reference · Machine feeds
Developers

API

The wire as data. No key, no account, no rate-limit negotiation — 60 requests a minute per IP, JSON, CORS open.

Endpoints

  1. /feed.jsonJSON Feed 1.1 of the newest dispatchescached, hourly · none
  2. /rss.xmlRSS 2.0, English by defaultcached, hourly · kev, region, cat, lang, q
  3. /api/v1/itemsdispatches as data, newest first, filterable over the whole archive60/min · kev, cve, category, since, before, limit
  4. /api/v1/exploitsevery public exploit we know of for one CVE, once each, grouped by source, GitHub repos with a trust verdict60/min · cve (required)
  5. /api/v1/exploits/trendingthe week's CVEs by new exploit activity, one row per CVE, with KEV, EPSS, cited attackers and the timeline60/min · none
  6. /api/v1/azthe Azerbaijan threat board: this week's claimed campaigns with our reachability check, cited adversaries, breach-listing metadata and exploited CVEs relevant here60/min · none
  7. /api/v1/actorsthe adversary roster, one lean row per dossier60/min · q, type, origin, limit
  8. /api/v1/actors/{id}one dossier as data120/min · none
  9. /api/v1/cves/{id}/actorsactors a source is cited as tying to a CVE, each with its quote and source url60/min · none
  10. /actors/{id}/stix.jsonthe dossier as a STIX 2.1 bundle60/min · none
  11. /actors/{id}/navigator.jsonthe dossier as an ATT&CK Navigator layer60/min · none
  12. /api/v1/stix/actors/{id}an actor's cited intelligence as a STIX 2.1 bundle: every CVE, technique and indicator link quoted and sourced60/min · page
  13. /api/v1/stix/cves/{cve}every actor a published report ties to one CVE, as a STIX 2.1 bundle60/min · page
  14. /taxii2/TAXII 2.1 discovery: the read-only API root and its collections, cited-intel and az-claims60/min · none
  15. /api/v1/taxii2/collections/{id}/objects/one page of a TAXII collection as an envelope of STIX 2.1 objects60/min · added_after, limit, next
  16. /api/v1/misp/manifest.jsona MISP feed: one event per actor with its cited indicators and CVEs60/min · none
  17. /llms.txta map of the site for AI agentscached · none

Alias ids on the dossier routes 308 to the canonical actor. Every JSON route carries an ETag and answers 304 to a matching If-None-Match.

Try it

  1. Everything actively exploited

    curl "https://skopnix.com/api/v1/items?kev=1"

    Only items on CISA's Known Exploited Vulnerabilities catalogue — confirmed exploited, not predicted.

  2. One CVE

    curl "https://skopnix.com/api/v1/items?cve=CVE-2026-81578"

    Every dispatch that names that CVE.

  3. Since a date, ransomware only

    curl "https://skopnix.com/api/v1/items?category=ransomware&since=2026-09-01&limit=100"

    since takes an ISO 8601 date. A malformed one is a 400, not a silent empty list.

  4. Page backwards through the archive

    curl "https://skopnix.com/api/v1/items?before=2026-08-15T00:00:00Z&limit=100"

    Everything strictly older than `before`. Each response carries next_before — feed it back to keep walking.

  5. Every public exploit for one CVE

    curl "https://skopnix.com/api/v1/exploits?cve=CVE-2024-3400"

    GitHub PoCs, Metasploit modules, Exploit-DB entries and Nuclei templates, each listed once. status is found, none-known (we checked, none known to us) or not-checked: an empty list alone never means safe. Links only; nothing is hosted or mirrored.

  6. What is trending in exploits this week

    curl "https://skopnix.com/api/v1/exploits/trending"

    One row per CVE from the newest daily snapshot: kev, epss, who_can_exploit in plain words, exploit counts per source, cited_actors (each with its citation_url) and the timeline from disclosure to the first cited attacker with days_from_previous.

  7. The adversary roster

    curl "https://skopnix.com/api/v1/actors?q=blizzard&type=nation-state"

    Every dossier as a lean row: id, aliases, origin, and how often our own wire named it in 90 days.

  8. One dossier, as data

    curl "https://skopnix.com/api/v1/actors/turla"

    Techniques, tools, targets, the dispatches that named it, and — once the engine has computed them — the CVEs it uses and recent reports. Alias ids 308 to the canonical actor.

  9. A dossier as an ATT&CK Navigator layer

    curl "https://skopnix.com/actors/apt28/navigator.json"

    Layer format 4.5, Enterprise — open it at mitre-attack.github.io/attack-navigator and diff it against your own coverage. 404 when we hold no techniques for the group: an empty layer loads cleanly and reads as a group that does nothing.

  10. A dossier as a STIX 2.1 bundle

    curl "https://skopnix.com/actors/apt28/stix.json"

    intrusion-set, one attack-pattern per technique, malware, tools, and the uses relationships between them — the shape a TIP ingests without anyone writing a parser for us. Alias ids 308 to the canonical actor.

  11. An actor's cited intelligence, as STIX 2.1

    curl "https://skopnix.com/api/v1/stix/actors/apt28"

    The CVEs it exploits, the techniques it uses and the indicators that indicate it, each a relationship carrying the source URL and the sentence it rests on. Same intrusion-set and attack-pattern ids as stix.json above, so the two merge in your TIP.

  12. Who exploits this CVE

    curl "https://skopnix.com/api/v1/stix/cves/CVE-2023-23397"

    One vulnerability, every actor we hold a dossier for that a published report ties to it, and one exploits relationship per report.

  13. TAXII 2.1, from the top

    curl -L -H "Accept: application/taxii+json;version=2.1" "https://skopnix.com/taxii2/"

    Discovery names the API root; the root lists the collections. Point OpenCTI's TAXII2 connector, or any TAXII 2.1 client, at this URL.

  14. Poll a collection for what is new

    curl -L -H "Accept: application/taxii+json;version=2.1" "https://skopnix.com/api/v1/taxii2/collections/cited-intel/objects/?added_after=2026-10-01T00:00:00Z&limit=500"

    An envelope: objects, more, and next while more is true. X-TAXII-Date-Added-Last is the added_after for your next poll.

  15. MISP feed

    https://skopnix.com/api/v1/misp

    In MISP: Sync Actions → Feeds → Add Feed, source format MISP Feed, this URL. MISP reads manifest.json and fetches each actor's event as it changes; every attribute's comment is the quoted sentence and its source.

Parameters

/api/v1/items

kev=1
Only items on CISA's Known Exploited Vulnerabilities catalogue.
cve=CVE-YYYY-NNNN
Every dispatch that names that CVE.
category=…
One of exploit, vuln, apt, malware, ransomware, breach, supply-chain, research, policy. Anything else is a 400.
since=…
ISO 8601 date or datetime. A malformed one is a 400, not a silent empty list.
before=…
Everything strictly older than this instant. Each response carries next_before; feed it back to keep walking.
limit=…
1 to 200, default 50.

/api/v1/exploits

cve=CVE-YYYY-NNNN
Required. Case and separators are forgiven (cve-2024-3400, 2024-3400); anything else is a 400.

/api/v1/actors

q=…
Case-insensitive substring over name and aliases.
type=…
nation-state, crime or unknown. Anything else is a 400.
origin=…
ISO-2 country code, as the source states it.
limit=…
1 to 500, default 100.

/api/v1/stix/actors/{id} · /api/v1/stix/cves/{cve}

page=…
1 and up, default 1. A page holds up to 400 citations, so never more than 803 objects. X-Total-Pages gives the count and a Link: rel="next" header names the next page. Past the last page is a 404.

/api/v1/taxii2/collections/{id}/objects/

{id}
The collection's UUID from /api/v1/taxii2/collections/, or its title: cited-intel or az-claims.
added_after=…
RFC 3339 UTC timestamp. Only objects added strictly after it. Anything else is a 400.
limit=…
Objects per page, 3 to 1000, default 1000. A citation's objects are never split across pages, so a page can hold fewer.
next=…
The opaque value the previous page returned while more was true. Use it rather than added_after to walk a collection: many rows can share one second, and next never skips them.

/rss.xml

kev=1
Only actively-exploited (KEV) stories.
region=1
Only regional stories.
cat=…
One category.
lang=az
Azerbaijani titles and summaries; English is the default.
q=a,b
Up to ten comma-separated terms matched against titles, category and CVE ids: a feed for your own stack.

Item fields

idstring
Stable pipeline id. Prefixed cve: / url: / digest: / spike:.
urlstring
Permalink on skopnix.com.
source_urlstring
The original report. We aggregate and verify; we do not author it.
title_en / title_azstring
English and Azerbaijani headline.
summary_en / summary_azstring
Body text, trimmed to whole sentences.
truncatedboolean
true when the source feed published a cut description and we ended it at the last complete sentence. Fetch source_url for the whole thing.
categorystring
One of: exploit, vuln, apt, malware, ransomware, breach, supply-chain, research, policy. Assigned by the relevance model; treat as a hint, not a taxonomy.
severitystring | null
critical / high / medium / low. null means no CVE severity data — not 'low'.
cvssnumber | null
As stated by the cited source. null when none was published.
epssnumber | null
0-1 probability of exploitation in the next 30 days. A FORECAST.
kevboolean
On CISA KEV. An OBSERVATION of exploitation, and it outranks epss whenever the two disagree.
cve_idsstring[]
CVEs named in the source. Empty is common — most reporting carries none.
cves{id, kev}[]
The same CVEs with a per-CVE KEV flag from the catalogue we hold. Use this, not the item-level kev, to decide which CVE is exploited.
kev_cvesstring[]
Exactly which of cve_ids are on KEV. A roundup of 400 CVEs is kev:true because of the one or two listed here.
roundupboolean
true when the item names 20+ CVEs (Patch Tuesday lists). Treat its signals as a digest, not a verdict on any single CVE.
region_relevantboolean
Flagged as Caspian/regional relevance.
published_atstring
ISO 8601, UTC. When the SOURCE published it, falling back to dispatched_at when the source carried no date. Sorting, since and before all use this field.
dispatched_atstring
ISO 8601, UTC. When skopnix put it on the wire. Always at or after published_at; the gap is our detection latency.
exposureobject | null
{product, worldwide, measured_at} — a Shodan scan count, not an inventory, dated to the day it was measured.
also_reported_bystring[]
Other outlets that ran the same story.
cluster_idstring | null
Stories about the same event within 72h share one id. null when the item stands alone.
is_duplicateboolean
true on the later members of a cluster; the first-seen member is false. Filter on false to see one item per event.

Honesty notes

  • null means unknown, never zero. A missing severity or CVSS is a gap in the public record, not a low score.

  • kev beats epss. EPSS predicts the next 30 days; KEV records exploitation already seen. When they disagree, KEV is the one to act on.

  • exposure is a scan count. It measures hosts reachable on the internet on the date given — not hosts that are vulnerable, and not an inventory.

  • The dossier exports carry no scoring of ours. Every technique in a Navigator layer scores the same, because we hold no per-technique confidence or frequency and a graded heatmap would be invented. STIX object ids are deterministic (UUIDv5), so re-fetching a dossier diffs against the last one instead of looking like a fresh set of objects, and re-pulling a TAXII collection or a MISP event deduplicates instead of piling up copies.

  • Cited means quoted. Every relationship in the STIX, TAXII and MISP exports is one sentence in one report we can link to, and carries both. A row with no source URL is never published, and a citation naming an actor we hold no dossier for is left out rather than turned into a new group named after free text. confidence is 85 when the quoted sentence names the actor itself, 50 when the actor comes from the rest of the report, and absent when we do not know.

  • exploits is our word, not STIX's. STIX 2.1 suggests targets between an intrusion-set and a vulnerability; we say exploits, because that is what the quoted sentences say. Custom relationship types are valid STIX; a tool that only accepts the suggested ones may drop these links.

  • az-claims are claims. Each is a report labelled unverified-claim at confidence 15: a hacktivist channel or leak site saying it hit an Azerbaijani target, not a confirmed incident. Dark-web sources are never in it.

  • TAXII URLs end in a slash and answer with a 308. The spec writes them with a trailing slash; this site serves them without one, so a client must follow the redirect. taxii2-client and OpenCTI do; with curl, pass -L. The server is read-only: there is no write endpoint and no key.

  • trust is a heuristic, not a verdict on a person. Fake proof-of-concept repositories have been used to deliver malware, so every GitHub exploit carries the engine's trust level (ok, caution or suspicious) and the flags behind it. Read the code before you run any of it.

  • We are not the source. Every item links to the original report. Cite that, not us.

  • A failure is a 503, never an empty list. If the feed is unavailable you get an error. A 200 with no items means nothing matched, and you can rely on that difference.

  • Filters cover the whole archive. kev, cve, category, since and before run against every published story, and total_matching is the exact count. One response reads at most window.size matching stories; when window.complete is false, page on with next_before.

Follow the wire.

Every exploited CVE and adversary move as it lands: Telegram for the push, RSS for your reader, a keyless JSON API and per-actor STIX for your tooling.

Follow on TelegramKEV RSSAPI

Check your stack

Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.

Stack checkNo key. No signup.