IOC Feeds

Free IOC Feeds (CSV, JSON, TXT, RSS) - phishing, malware, scam


IOC Feeds

Full feeds from today, last week, last month and last year

-
IOCs today
since 00:00 UTC
-
last 30 days
rolling window
-
last 365 days
full archive
15 min
refresh
CC0, no API key

Download

Static files you fetch on your own schedule. Public domain (CC0), no key, no sign-up.

CSV feeds

One row per IOC: date, reporter, type, value, tags and the tweet it came from. Windows roll forward and are rebuilt every 15 minutes.

Today

  • URLs-
  • Domains-
  • IPs-
  • SHA-256-
  • MD5-
Today (.csv)
Week

  • URLs-
  • Domains-
  • IPs-
  • SHA-256-
  • MD5-
Week (.csv)
Month

  • URLs-
  • Domains-
  • IPs-
  • SHA-256-
  • MD5-
Month (.csv)
Year

  • URLs-
  • Domains-
  • IPs-
  • SHA-256-
  • MD5-
Year (.csv)

Blocklists

Plain-text exports, one indicator per line, 30-day window, rebuilt every 15 minutes.

  • Drop-in for Pi-hole, AdGuard Home, hosts files, firewalls, proxies and IDS.
  • urls.txt carries the full URL instead of just the host, so it also covers indicators sitting on shared or otherwise legitimate infrastructure that DNS-level blocking cannot safely reach.
  • A 1:1 mirror of the feed, with no extra quality gate beyond the standard pipeline.

DNS and host-level blocking

Domains
domains.txt
Hosts
hosts.txt
AdGuard
adguard.txt
dnsmasq
dnsmasq.txt

Resolver, firewall and proxy

RPZ
rpz.txt
IPs
ips.txt
URLs
urls.txt

Subscribe

Poll-on-a-timer feeds for a reader or a bot. Every item links back to the tweet it came from.

RSS firehose

Every IOC as it lands, newest first, across all types, reporters and tags.

RSS feed
rss.xml

Per-tag RSS

One feed per active tag, where active means at least one hit in the last 7 days. Browse them all from the Tag index; each tag landing page also exposes its feed through <link rel="alternate">.

https://tweetfeed.live/rss/tag/<slug>.xml

Per-type RSS

One feed per IOC type. Always available, no activity threshold.

https://tweetfeed.live/rss/type/<url|domain|ip|sha256|md5>.xml

Per-user RSS

One feed per reporter active in the last 7 days. Handles are lowercase. Quiet or unknown handles return an error.

https://tweetfeed.live/rss/user/<handle>.xml

Integrate

Formats that plug straight into a Threat Intelligence platform.

MISP feed

Native MISP format: one Event per day, 365 days of history, rebuilt every 15 minutes.

Paste this into MISP under Sync Actions, Feeds, Add. It is a feed base URL, not a page: MISP appends /manifest.json itself, so opening it in a browser just brings you back here.

https://tweetfeed.live/misp
  • Point MISP at the directory, not at manifest.json. Giving it the manifest file makes it fetch /misp/manifest.json/manifest.json, which does not exist.
  • Only the current day's Event changes between pulls, so after the first sync your instance re-fetches one file.
  • Tags applied to every Event: TweetFeed · type:OSINT · tlp:clear.
Manifest
manifest.json
Feed cache
hashes.csv

STIX 2.1 bundles

Indicator bundles for SIEM and Threat Intelligence platforms. TLP:CLEAR, with deterministic UUIDs so a re-pull dedupes cleanly. Need a live pull instead of static bundles? See TAXII 2.1 in the API docs.

Manifest
manifest.json
Today
today.json
Week
week.json
Month
month.json
  • No year bundle on purpose: STIX runs about 2.6x more verbose per IOC than MISP, which puts year.json over 80 MB and too close to GitHub's 100 MB push limit. For year-scale STIX, use the diff endpoint below.
  • today.json is served directly. week.json and month.json answer with a 302 to raw.githubusercontent.com because of their size, so they arrive as Content-Type: text/plain instead of application/stix+json;version=2.1. Follow redirects and do not gate on the content type.

Diff endpoint (incremental sync)

Fetch only the IOCs added after a given timestamp. Replace the placeholder with your last sync time, in the Z form for unambiguous UTC. Same /<filter1>/<filter2> syntax as the firehose API. Returns 410 Gone if the timestamp is more than 365 days old.

GET https://api.tweetfeed.live/v1/since/<ISO8601>

Browse by IOC type

Need only one indicator type? Each type has its own feed page with stats, recent samples, formats and a FAQ.

urlMalicious URLs Full HTTP/HTTPS URLs flagged by Twitter/X researchers. Highest-volume IOC type. domainMalicious domains Bare domain names for DNS-level blocklists and CT-log correlation. ipMalicious IPs IPv4/IPv6 tied to attacker infrastructure (C2, scanners, phishing hosts). sha256SHA-256 hashes Modern 256-bit file hashes; preferred for IR artefacts and chain of custody. md5MD5 hashes Legacy 128-bit file hashes; pivot through VirusTotal or Malpedia.

Frequently asked questions

What is an IOC feed?

An indicator of compromise (IOC) feed is a continuously updated list of malicious URLs, domains, IPs and file hashes used by security teams to detect threats. TweetFeed collects IOCs shared publicly by researchers on Twitter/X and republishes them every 15 minutes in CSV, JSON, TXT and RSS. New to IOCs? Read the IOC Threat Intelligence guide.

Is TweetFeed free?

Yes. All TweetFeed IOC feeds and the REST API are free. No registration or API key required.

How often are the IOC feeds updated?

Every 15 minutes. The pipeline scrapes around 95 Twitter/X RSS feeds, extracts new IOCs, deduplicates, and publishes refreshed CSV, JSON, TXT and RSS files to tweetfeed.live.

Which feed format should I choose?

CSV for spreadsheets and SIEM import, JSON for programmatic use, TXT for plain lists (one IOC per line), and RSS for subscribing in a feed reader. The data is identical across all four formats.

How do I import TweetFeed into MISP, OpenCTI or Splunk?

For MISP, under Sync Actions, Feeds, Add, set the feed URL to https://tweetfeed.live/misp - the directory, not the manifest file, because MISP appends /manifest.json itself. It imports one native MISP event per day (365 days) automatically. For OpenCTI and Splunk, point at the CSV URL and schedule periodic refresh. The Threat Hunting page lists ready-to-copy configuration snippets for MISP, OpenCTI, Splunk, KQL and IntelOwl.