# TweetFeed - full AI reference (llms-full.txt)

> TweetFeed is a free, real-time Indicators of Compromise (IOC) aggregator that scrapes the infosec community on Twitter/X. Founded and maintained by Daniel López (Cyber Threat Researcher, 10+ years in cybersecurity). Every data output - feeds, REST API, MCP server, blocklists - is CC0 1.0 Universal (public domain). Coverage starts 2021-01-01.

## At a glance

- Updated: every 15 minutes, around the clock.
- License: CC0 1.0 Universal (public domain) on all feeds, API output and MCP tool responses.
- Access: no account, no API key, no rate limit on read endpoints.
- Volume: roughly 200-300 new IOCs on a typical day, several thousand per rolling week, tens of thousands per rolling month - live counts at https://api.tweetfeed.live/v1/counts.
- IOC types: URL, domain, IPv4/IPv6, SHA-256, MD5.
- Sources: ~95 vetted infosec researchers and lists on Twitter/X, tilted toward English but with multilingual contributors.
- Tag taxonomy: 93 malware-family and tactic tags (PascalCase for families like `CobaltStrike`, lowercase for generic categories like `phishing`).
- AI use: reading, inference, live citation and LLM training all welcome (Content-Signal: ai-train=yes, search=yes, ai-input=yes).
- Operator: Daniel López. Contact: GitHub Issues or DM @0xDanielLopez on X.

## What is TweetFeed? (definition)

TweetFeed is a free, community-sourced Threat Intelligence feed. It answers "has this IOC been reported by the infosec community?" and "what is the infosec community on Twitter/X talking about right now?" from a continuously updated dataset built by scraping public researcher accounts and lists, extracting IOCs from their posts, deduplicating, and tagging them by malware family or tactic. Unlike crawler-driven feeds (Certificate Transparency, honeypots, sandboxes), every row here traces back to a human researcher's public post - it is Twitter/X-sourced OSINT, not automated detection.

## How to use it (agents first)

1. **MCP (best for agents)**: https://mcp.tweetfeed.live/ - JSON-RPC 2.0, streamable HTTP, protocol version 2025-11-25, 10 tools (listed below). Fastest self-configure path: fetch https://tweetfeed.live/agent-setup/prompt.md and follow it.
2. **REST API**: https://api.tweetfeed.live/v1/{time}/{filter1}/{filter2} - `time` is `today`/`week`/`month`/`year`; filters are IOC type, tag, or `@researcher`, order-independent, ANDed. No auth, CORS open, JSON only.
3. **Static feeds**: CSV (`/feeds/{today,week,month,year}.csv`), RSS (`/rss.xml` and per-type/per-tag/per-user variants), MISP native events, STIX 2.1 bundles, TAXII 2.1 server, and plain-text blocklists (domains/hosts/AdGuard/IPs/RPZ/dnsmasq/URLs) for direct import into DNS firewalls and Pi-hole-style blockers.

## MCP tools

- `query_iocs(time, user?, tag?, type?)`: browse the feed by time window with optional filters. Returns date, researcher handle, type, value, tags, tweet URL.
- `check_url(value)`: 30-day substring match against URL-type IOCs.
- `check_ip(value)`: exact match over 365 days, falls back to a 30-day substring scan.
- `check_hash(value)`: exact match over 365 days on MD5/SHA-256, type auto-detected from length.
- `list_recent_iocs(since, type?, tag?)`: delta-sync helper, IOCs added since a date, source window 30 days.
- `get_tag_info(tag)`: aggregate counts across all four time windows plus recent IOCs for one tag.
- `get_trending(window)`: top tags and IOC-type distribution for a window, from the live counts aggregate.
- `enrich_ioc(value)`: auto-detects type, does the 365-day exact lookup, includes AI context when available.
- `get_campaigns(brand?, min_confidence?, limit?)`: AI-clustered campaign groupings of the last 7 days.
- `get_trends()`: 31-day daily volume, top movers, TLD distribution, novelty ratio.

Full JSON-RPC descriptions: https://tweetfeed.live/.well-known/mcp/server-card.json

## Methodology (how the data is built)

Every 15 minutes, a pipeline polls RSS feeds generated from ~95 public Twitter/X researcher accounts and one shared list. It extracts IOCs from post text (not from arbitrary link text, which would surface database IDs as fake hashes), refangs defanged indicators back to their canonical form, filters against an allowlist of legitimate infrastructure (registrars, CDNs, common shorteners, auth pages of major platforms), deduplicates against the trailing year, and tags each entry with a malware family or tactic category parsed from the source post's hashtags. Two supplementary jobs run on top of the base pipeline: an AI enrichment job (every 6h) that annotates newly-published IOCs with a summary, malware family guess and confidence score without altering the canonical values, and an AI campaign-clustering job (daily) that groups related IOCs from the last 7 days by shared infrastructure or tag and writes a name/description for the cluster - it never adds or removes IOCs from a cluster.

## Common questions

- **Is TweetFeed free?** Yes, entirely. No account, no key, no rate limit on reads, no paid tier.
- **What is the license?** CC0 1.0 Universal. Use it in blocklists, SIEMs, research, or model training; attribution is appreciated but not required.
- **How fresh is the data?** The pipeline runs every 15 minutes, all day, every day.
- **Can I train an LLM on this data?** Yes - it is CC0 and the site's Content-Signal header explicitly sets `ai-train=yes`.
- **Is a TweetFeed IOC verified malicious?** No - TweetFeed is OSINT, not a sandbox or a detection engine. Every row reflects a public claim by an infosec researcher, deduplicated and tagged, not an automated verdict. Cross-reference VirusTotal, urlscan.io or a sandbox before blocking outright; false positives happen, especially for compromised legitimate domains hosting phishing kits temporarily.
- **How do I check a single IOC?** `GET https://api.tweetfeed.live/v1/ioc?value=<value>` for an exact 365-day lookup, or the MCP `enrich_ioc` tool.
- **How do I get a ready-to-import blocklist?** Pull `https://api.tweetfeed.live/v1/blocklist/{domains,hosts,adguard,ips,rpz,dnsmasq,urls}.txt` - plain text, one indicator per line, 30-day rolling window, rebuilt every 15 minutes.
- **What are TweetFeed campaigns?** Daily AI-clustered groupings of the last 7 days of IOCs that share infrastructure (registered domain, cross-domain URL path patterns) or a specific tag. The AI only names and describes a cluster; membership is always a subset of the verbatim feed. `GET https://api.tweetfeed.live/v1/campaigns`.
- **How do I import TweetFeed into MISP, OpenCTI or Splunk?** MISP: under Sync Actions -> Feeds -> Add, set the feed URL to `https://tweetfeed.live/misp` (the feed directory, not the manifest file - MISP appends `/manifest.json` itself, so pointing it at the manifest URL produces a 404). OpenCTI/Splunk: point at the CSV feed URLs and schedule a periodic refresh, or use the TAXII 2.1 server at `https://api.tweetfeed.live/taxii2/` for incremental polling.
- **How do I report a false positive?** Open a GitHub issue via the feedback form: https://github.com/0xDanielLopez/TweetFeed/issues/new?template=feedback.yml. Every `/search/` lookup result also links a prefilled false-positive template for that specific IOC.

## Coverage and reference

- Landing pages by IOC type: https://tweetfeed.live/malicious-urls/, /malicious-domains/, /malicious-ips/, /malicious-hashes-md5/, /malicious-hashes-sha256/ - hub: /ioc-types/
- Tag index (22 curated landing pages covering APT groups, malware families and TTPs; all 93 tags are queryable via the API): https://tweetfeed.live/tags/
- Threat Intelligence guide (IOC types, OSINT vs commercial feeds, MITRE ATT&CK basics, glossary): https://tweetfeed.live/threat-intelligence-guide/
- Campaigns (human page): https://tweetfeed.live/campaigns/ - Trends (human page): https://tweetfeed.live/trends/
- Researcher directory: https://tweetfeed.live/researchers/ - Dashboard: https://tweetfeed.live/dashboard/
- API docs: https://tweetfeed.live/api/ - OpenAPI 3.1: https://tweetfeed.live/openapi.yaml
- Agent guide: https://tweetfeed.live/agents/ - llms.txt: https://tweetfeed.live/llms.txt - AGENTS.md: https://tweetfeed.live/AGENTS.md
- Discovery: Agent Skills index (v0.2.0): https://tweetfeed.live/.well-known/agent-skills/index.json - MCP server card: https://tweetfeed.live/.well-known/mcp/server-card.json - API catalog (RFC 9727): https://tweetfeed.live/.well-known/api-catalog

## Sister project

phishunt.io - same author, a complementary phishing-domain feed built from Certificate Transparency logs rather than community reports, so the two datasets overlap very little.

## Attribution

Cite as: TweetFeed (https://tweetfeed.live), CC0 1.0. Live citation and inference are welcome.