Question 1

What is TweetFeed?

Accepted Answer

TweetFeed is a free, community-driven service that aggregates indicators of compromise (IOCs) - malicious URLs, domains, IPs and file hashes - shared publicly by infosec researchers on Twitter/X. The pipeline republishes fresh IOCs every 15 minutes as CSV, JSON, TXT, RSS and a REST API.

Question 2

What kinds of IOCs does TweetFeed collect?

Accepted Answer

URLs, domains, IPs, SHA-256 and MD5 file hashes associated with phishing, malware, ransomware, C2 infrastructure and other threats. The original tweet hashtags (for example #phishing, #CobaltStrike, #LockBit) are preserved for each IOC so you can filter by tag.

Question 3

How do I download TweetFeed IOCs?

Accepted Answer

CSV, JSON, TXT and RSS downloads are on the Feeds page. For programmatic access use the free REST API at api.tweetfeed.live. See the Threat Hunting page for MISP, OpenCTI, Splunk, Microsoft Sentinel KQL and QRadar integration examples.

Question 4

Is TweetFeed free to use?

Accepted Answer

Yes. TweetFeed is completely free. There is no registration, API key or rate limit for normal use.

Question 5

Who contributes to TweetFeed?

Accepted Answer

TweetFeed scrapes around 95 public RSS feeds of infosec researchers on Twitter/X. The Researchers page lists the current contributors. Attribution is preserved: every IOC record includes the original tweet URL.

Question 6

What are the types of IOCs in TweetFeed?

Accepted Answer

TweetFeed aggregates four primary IOC types: URLs (malicious links), domains (phishing/C2 servers), IP addresses (botnet/C2 infrastructure), and file hashes (malware signatures in MD5, SHA1, SHA256 format). Each IOC is tagged by type and threat category (malware, phishing, ransomware) and sourced from the researcher who posted it on Twitter/X.

Question 7

How do I use IOC feeds in my security tools?

Accepted Answer

TweetFeed feeds are compatible with SIEM tools (Splunk, ELK, Sumo Logic), Threat Intelligence platforms (MISP, OpenCTI), firewalls, and proxies. Download as CSV for quick import, JSON for REST API integration, or RSS for continuous ingestion. See the API documentation for real-time programmatic access.