Changelog

Structural fixes for false positives across every IOC type:

• Quote attribution — IOCs from quoted tweets now point to the original author, not the quoter.
• Hash filter — hex strings inside URL paths or subdomains (cloud bucket IDs, webinar IDs, phishing-kit session IDs) no longer leak as MD5/SHA256.
• Research-host whitelist — links to sample-sharing services no longer emit as URL or domain IOCs.
• CDN IPs — Anycast edges filtered; the domain is the actionable IOC, not the CDN frontend.

~10K historical false-positive rows cleaned.

Three new bulk data formats for SIEM, Threat Intelligence platforms and automation:

• STIX 2.1 bundles (today/week/month) at /stix/manifest.json - spec-compliant, TLP:CLEAR, deterministic UUIDs.
• Diff endpoint at /v1/since/<ISO8601> - incremental sync, returns only IOCs added after a given timestamp.
• Per-tag RSS at /rss/tag/<slug>.xml - subscribe to a single threat type without polling the firehose.

Full docs on the Feeds, API and Agents pages. The MCP server-card also lists the new endpoints under dataEndpoints.

After a few months paused, TweetFeed is back again.

TweetFeed stopped due to technical issues retrieving info from Twitter/X.

TweetFeed alive again.

Improved frontend, made it better for mobile devices (bootstrap ftw).

Created OpenCTI connector. [Tweet]

Thanks to @aaarghhh for building it.

Improved frontend, made it better for mobile devices (bootstrap ftw).

Added new tags and removed old ones with fewer hits.

Thanks to Matt Anderson for the suggestion.

Added #Spring4Shell. [Tweet]

Created the Dashboard section.

Added #log4j and #Log4Shell. [Tweet]

First commit.

Thanks to Germán Fernández and Will for the initial feedback about the project.