Changelog

The external corroboration sidecar on /search/ lookups now reads abuse.ch's full URLhaus and ThreatFox dumps instead of their "recent" ones, and adds a third source: MalwareBazaar. Hashes benefit the most - URLhaus mostly indexes URLs and ThreatFox rarely carried hashes, so this is the first real corroboration coverage for many of TweetFeed's SHA256/MD5 IOCs. Corroboration stays display-only: it never adds, removes or scores anything in the canonical feed.

Search gets more context on each lookup, plus a new ad-hoc query tool:

• Corroboration signal - IOC lookup records now show whether an indicator came from a single report or multiple accounts, with a tooltip that popularity is not a verdict.
• Also in these tweets - lookup records surface up to 5 other IOCs pulled from the same source tweets (via the new optional related field on /v1/ioc), each with a one-click pivot back into the lookup.
• Feed explorer - a new card on /search/ queries /v1/<window> with type, tag and user filters, a date range, CSV export and shareable deep-links.
• Report a false positive - every lookup record now links straight to the feedback board.
• OpenAPI - the spec now documents /v1/ioc, /v1/trends and the TAXII discovery endpoint.
• Per-type and per-user RSS - subscribe to a single IOC type (/rss/type/) or a single reporter (/rss/user/) without polling the firehose.
• External corroboration - IOC lookups now show when an indicator is also listed in URLhaus or ThreatFox (public abuse.ch feeds), refreshed every 6 hours.
• IP network context - IP lookups now show organisation/ASN and country from ipinfo.io (third-party sidecar, refreshed every 6 hours).

Structural fixes for false positives across every IOC type:

• Quote attribution - IOCs from quoted tweets now point to the original author, not the quoter.
• Hash filter - hex strings inside URL paths or subdomains (cloud bucket IDs, webinar IDs, phishing-kit session IDs) no longer leak as MD5/SHA256.
• Research-host whitelist - links to sample-sharing services no longer emit as URL or domain IOCs.
• CDN IPs - Anycast edges filtered; the domain is the actionable IOC, not the CDN frontend.

~10K historical false-positive rows cleaned.

Three new bulk data formats for SIEM, Threat Intelligence platforms and automation:

• STIX 2.1 bundles (today/week/month) at /stix/manifest.json - spec-compliant, TLP:CLEAR, deterministic UUIDs.
• Diff endpoint at /v1/since/<ISO8601> - incremental sync, returns only IOCs added after a given timestamp.
• Per-tag RSS at /rss/tag/<slug>.xml - subscribe to a single threat type without polling the firehose.

Full docs on the Feeds, API and Agents pages. The MCP server-card also lists the new endpoints under dataEndpoints.

After a few months paused, TweetFeed is back again.

TweetFeed stopped due to technical issues retrieving info from Twitter/X.

TweetFeed alive again.

Improved frontend, made it better for mobile devices (bootstrap ftw).

Created OpenCTI connector. [Tweet]

Thanks to @aaarghhh for building it.

Improved frontend, made it better for mobile devices (bootstrap ftw).

Added new tags and removed old ones with fewer hits.

Thanks to Matt Anderson for the suggestion.

Added #Spring4Shell. [Tweet]

Created the Dashboard section.

Added #log4j and #Log4Shell. [Tweet]

First commit.

Thanks to Germán Fernández and Will for the initial feedback about the project.