Skip to content
skopnix

Free threat intelligence · no signup

Paste an IP, a hash or your stack.

skopnix checks it against 788,222 indicators and every actively exploited CVE, and shows you the report behind each hit.

against 788,222 known indicators
Claimed attack20:51 UTCQilin says it hit https://belcorp.biz/site is up
788,222indicators you can check399claimed attacks tracked · 30 days581detection rules873threat actor dossiers

01 · Claims vs realityAll claims

They post it. We check it.

Hacktivist groups claim 399 attacks a month. When a claim names a site, skopnix tests it from several locations around the world. Claims against Azerbaijan are re-checked every 5 minutes while they are fresh.

  1. 20:51Qilinhttps://belcorp.biz/up
  2. 20:50CyberTrollhttps://cnctr.fr/unreachable
  3. 19:55BD Anonymoushttps://kohelet.org.il/up
  4. 19:54Cloakhttps://rta.ch/up
  5. 16:26cloakhttps://rta.ch/up
  6. 16:26cloakhttps://er.de/unreachable
Where the worldwide claims pointClaims in the last 30 days by the country they name: United States 58, Thailand 12, Brazil 10, France 9, Serbia 9, Russia 9, Ukraine 9, Germany 8, Iran 8, Italy 8, and 37 more.United States 58Thailand 12Brazil 10France 9

Named in claims · 30 days

  1. United States58
  2. Thailand12
  3. Brazil10
  4. France9
  5. Serbia9
  6. Russia9
  7. Ukraine9
  8. Germany8
  9. Iran8
  10. Italy8

235 country mentions across 47 countries. Dot area is the count; a ring means a claim in the last 24 h. The country is the one the claim names (its flag, its words or the target’s domain), not where anything was confirmed.

02 · For your SIEMAll rules

Rules you can paste today.

581 rules written from what skopnix tracks, each for Sigma, IBM QRadar and Cortex XDR and mapped to ATT&CK. Sigma 244, QRadar 102, Cortex 235.

SELECT DATEFORMAT(starttime, 'yyyy-MM-dd HH:mm:ss') AS event_time, LOGSOURCENAME(logsourceid) AS log_source, sourceip, username, "Process Name", "Process CommandLine"FROM eventsWHERE ("Process CommandLine" ILIKE '%comsvcs%' AND ("Process CommandLine" ILIKE '%minidump%' OR "Process CommandLine" ILIKE '%#24%'))AND LOGSOURCETYPENAME(devicetype) IN ('Microsoft Windows Security Event Log', 'Microsoft Windows Sysmon')LAST 7 DAYS
LSASS memory dump via comsvcs.dll MiniDump (T1003.001)Open rule

03 · The wireArchive

Newest from the sources we read.