# TweetFeed > TweetFeed is a free, real-time IOC (Indicators of Compromise) aggregator that scrapes the infosec community on Twitter/X. Founded by Daniel López. CC0 1.0 Universal license on every data output (TXT/JSON/CSV/RSS feeds, public REST API, MCP server). Updated every 15 minutes; coverage starts 2021-01-01. ## Feeds Every static file below supports conditional requests (`wget --timestamping` / `curl -z`) - a `304` with no body comes back when the file hasn't changed since your last download. - [Today's IOCs (CSV)](https://tweetfeed.live/feeds/today.csv): current UTC calendar day (from 00:00 UTC, not a rolling 24h), all IOC types. - [Past 7 days (CSV)](https://tweetfeed.live/feeds/week.csv): rolling 7d window. - [Past 30 days (CSV)](https://tweetfeed.live/feeds/month.csv): rolling 30d window. - [Past 365 days (CSV)](https://tweetfeed.live/feeds/year.csv): rolling year window (302 redirect to raw GitHub). - [RSS feed](https://tweetfeed.live/rss.xml): syndication-friendly. - [Per-type RSS](https://tweetfeed.live/rss/type/{url|domain|ip|sha256|md5}.xml): one feed per IOC type; always exists, subscribe to a single indicator type without polling the firehose. - [Per-user RSS](https://tweetfeed.live/rss/user/{handle}.xml): one feed per reporter active in the last 7 days; handle lowercase; unavailable (error response) for quiet/unknown users. - [MISP manifest](https://tweetfeed.live/misp/manifest.json): MISP feed integration; one event per day, 365 days of history. To subscribe, set the feed URL to `https://tweetfeed.live/misp` (the directory) - MISP appends `/manifest.json` itself. - [Blocklists (TXT)](https://api.tweetfeed.live/v1/blocklist/{file}): plain-text exports for Pi-hole, AdGuard Home, hosts files, DNS resolvers, firewalls, proxies and IDS - `domains.txt`, `hosts.txt`, `adguard.txt`, `ips.txt`, `rpz.txt` (DNS Response Policy Zone for BIND/Unbound/PowerDNS Recursor), `dnsmasq.txt` (dnsmasq address=/domain/0.0.0.0 format), `urls.txt` (full URL per line, not just the host, so it also covers `url`-type IOCs on shared/legitimate infrastructure DNS-level blocking can't safely reach). Rolling 30-day window, rebuilt every 15 minutes, 1:1 mirror of the feed with no additional quality gate. - [Browseable feed page](https://tweetfeed.live/feeds.html): HTML index with stats and download buttons. ## API - [API documentation](https://tweetfeed.live/api/): endpoints, examples, query syntax. - Conditional requests: every `200` response carries an `ETag` and a `Last-Modified` header; send `If-None-Match` or `If-Modified-Since` on the next request to get a `304` with an empty body instead of re-fetching. `If-None-Match` is the recommended validator (RFC 7232 section 6 precedence when both are sent). Works on every route and on the static feed files. - [OpenAPI 3.1 spec](https://tweetfeed.live/openapi.yaml): machine-readable schema covering every route, including `/v1/since/{ISO8601}` for delta sync. - [TAXII 2.1 server](https://api.tweetfeed.live/taxii2/): read-only discovery endpoint for OpenCTI, ThreatQ, taxii2-client and other TIPs. One collection, `b7dc78af-1d12-5059-898c-3f0e77636204` ("TweetFeed IOCs (rolling 31 days)"), no auth, CC0. Poll incrementally with `added_after` on `/objects/`; that returns indicators only, so fetch the referenced `identity` and `marking-definition` objects once by id from `/objects/{id}/`. - Base URL: `https://api.tweetfeed.live/` - Path pattern: `/v1/{time_window}` or `/v1/{time}/{filter1}` or `/v1/{time}/{filter1}/{filter2}` - Time windows: `today`, `week`, `month`, `year` - Filters: IOC type (`url`, `domain`, `ip`, `sha256`, `md5`), tag (e.g. `phishing`, `cobaltstrike`, `lockbit`), researcher handle (`@malwrhunterteam`) - No authentication. CORS open. JSON only. - Client compatibility: Cloudflare's Browser Integrity Check returns `403` to requests sent with a bare `Python-urllib` or `libwww-perl` User-Agent, on both `tweetfeed.live` and `api.tweetfeed.live`. `requests`, `curl`, `wget`, `feedparser`, `taxii2-client` and browsers all work fine - avoid a bare `urllib.request` call. - `date` is the timestamp of the tweet that reported the IOC, not the quoted tweet's timestamp when the source tweet is a quote-tweet. - Result cap: 10,000 rows per response, truncated from the oldest end. Only the unfiltered `/v1/month` (~15,000 rows) exceeds it, losing roughly the first ten days of its window. Every `200` carries `X-Result-Count`, `X-Result-Window-Start` and `X-Result-Window-End`, plus `X-Result-Truncated: true` when the cap was hit. For the complete 30-day window use `https://tweetfeed.live/feeds/month.csv`, which is served uncapped. - `/v1/since/{ISO8601}` has the same cap but truncates the newest rows instead, so the block you get always starts at your `since`. To page, re-request with `since` set to the returned `X-Result-Window-End` until `X-Result-Truncated` stops appearing. - `/v1/since` reaches back 30 days, not 365: it is served from the 30-day window file, since scanning the full year exceeds the Worker's CPU budget. An older `since` still returns `200` with those 30 days and declares the shortfall via `X-Result-Window-Incomplete: true` and `X-Result-Window-Start`. For a deeper backfill pull `https://tweetfeed.live/feeds/year.csv` once, then switch to this endpoint for incremental updates. Beyond 365 days it is `410`. - Examples: - `https://api.tweetfeed.live/v1/today` - all IOCs from the current UTC calendar day (since 00:00 UTC). - `https://api.tweetfeed.live/v1/week/phishing/url` - phishing URLs from the last 7 days. - `https://api.tweetfeed.live/v1/month/cobaltstrike` - Cobalt Strike IOCs from the last 30 days. - `https://api.tweetfeed.live/v1/today/@malwrhunterteam/sha256` - SHA256 hashes from a specific researcher. ## Campaigns - [AI-clustered campaigns](https://tweetfeed.live/campaigns/): human page showing daily campaign groupings clustered from the last 7 days of community IOCs. - [Campaigns API](https://api.tweetfeed.live/v1/campaigns): JSON, CORS open, no auth, CC0. Returns `version`, `generated_at`, `window` (`week`), `stale`/`stale_since`, `campaign_count`, and a `campaigns` array. Each campaign has `id` (`tfc-<12hex>`), `name`, `context`, `confidence` (`high`/`medium`/`low`), `targeted_brand`, `first_seen`/`last_seen`, `ioc_count`, per-type `types` counts, `tags`, `reporters`, up to 25 sample `iocs` (same shape as the main feed), `member_cluster_ids`, and `anchors` (`registered_domains`, `url_path_patterns`, `tags` used for pre-grouping). - Clustering is two-stage: deterministic pre-grouping (shared registered domain, cross-domain URL path patterns, or a shared specific tag), then AI naming and context generation. The AI only names and describes clusters - it never adds or removes IOCs; every `iocs` entry is verbatim from the feed. - Regenerated daily. If a run fails, `stale` is `true` and `stale_since` holds the date of the last successful run; the document falls back to that previous snapshot instead of going empty. - MCP tool: `get_campaigns` (optional `brand`, `min_confidence`, `limit`). ## Trends - [IOC trends](https://tweetfeed.live/trends/): human page charting daily IOC volume, top movers, TLD breakdown and novelty rate. - Raw data: [trends.json](https://raw.githubusercontent.com/0xDanielLopez/TweetFeed/master/trends.json) (CC0, regenerated with the rest of the feed). - `daily`: 31 days of totals plus a per-type breakdown (url/domain/ip/sha256/md5) for a rolling 30-day volume chart. - `movers`/`tlds`/`novelty`: current vs previous 7-day tag counts ranked by change magnitude, the top TLDs among malicious domains from the last 30 days, and the share of this week's distinct IOC values that are new versus recurring. ## AI IOC enrichment - Every 6h, an AI job annotates newly-published IOCs with per-IOC context generated from the source tweet: `summary` (<=200 chars), `family` (malware family or null), `threat_type`, `suggested_tags` (from the feed's tag vocabulary), `confidence` (0-1). The AI only describes - it never adds, removes, or alters IOC values or the canonical CSV feeds. - Exposed as the optional `ai` field in [IOC lookup](https://api.tweetfeed.live/v1/ioc?value=example.com) responses (`/v1/ioc?value=`, exact 365-day lookup) and inside the MCP `enrich_ioc` tool output. - IOC lookup records also carry an optional `related` field: other IOCs posted in the same source tweets as the looked-up value (sample, max 5); absent when there are none. - IOC lookup responses also carry an optional `external` field: cross-feed corroboration from public abuse.ch feeds (URLhaus/ThreatFox); absent when no match or the sidecar is unavailable. - IOC lookup responses also carry an optional `net` field for IP lookups: network metadata (org/ASN, country, city, or a `bogon` flag for reserved ranges) from ipinfo.io, refreshed every 6h; absent for non-IP lookups or when unavailable. - Raw sidecar: [enrichment.json](https://raw.githubusercontent.com/0xDanielLopez/TweetFeed/master/enrichment.json) (rolling 30 days, keyed by normalized IOC value, CC0). ## MCP integration (for AI agents) - [Agent setup prompt](https://tweetfeed.live/agent-setup/prompt.md): fetch this file and follow it directly - it registers the MCP server, verifies the connection, and reports back. The fastest way for an agent to self-configure, no manual reading required. - [mcp.tweetfeed.live](https://mcp.tweetfeed.live/): Model Context Protocol server. JSON-RPC 2.0, protocol version 2025-11-25. Tools: `query_iocs`, `check_url`, `check_ip`, `check_hash` (auto-detects MD5/SHA-256), `list_recent_iocs` (date-bounded), `get_tag_info` (per-tag overview with counts + recent IOCs), `get_trending` (top tags / type distribution per window from counts.json), `enrich_ioc` (auto-detect type, 365-day lookup + AI context when available), `get_campaigns` (cluster search by brand/confidence, trimmed sample IOCs), `get_trends` (community trends: 31-day daily series, top movers, TLD distribution, novelty). - [/agents/](https://tweetfeed.live/agents/): human-readable integration guide with config snippets for Claude Desktop, Cursor, Zed. - [llms-full.txt](https://tweetfeed.live/llms-full.txt): expanded single-file AI reference (definition, at-a-glance stats, MCP tools, methodology, FAQ optimized for passage extraction). - [AGENTS.md](https://tweetfeed.live/AGENTS.md): agents.md-convention guide (MCP-first access order, tool table, discovery links). - [Agent Skills index](https://tweetfeed.live/.well-known/agent-skills/index.json): RFC v0.2.0 manifest, 5 skills (general queries, single-IOC lookup, blocklists, trends, campaigns). - [API catalog](https://tweetfeed.live/.well-known/api-catalog): RFC 9727 linkset. - [MCP server card](https://tweetfeed.live/.well-known/mcp/server-card.json): SEP-1649 metadata. ## IOC types covered - **URL**: full HTTP/HTTPS URLs flagged as malicious. - **Domain**: bare domain names (no scheme/path). - **IP**: IPv4 and IPv6 addresses associated with attacker infrastructure. - **SHA256**: file content hashes. - **MD5**: legacy file content hashes. ## Tag taxonomy 93 malware family / tactic tags including: - Malware families: `cobaltstrike`, `lockbit`, `redline`, `qakbot`, `emotet`, etc. - Tactic categories: `phishing`, `ransomware`, `c2`, `infostealer`, `loader`, `rat`, etc. - Source signal tags: `osint`, `ioc`, `malware`. Full list rendered in `/dashboard.html` filter dropdown. ## Researchers ~95 vetted infosec researchers on Twitter/X feed into the aggregator. Coverage tilts toward English-speaking sources but includes multilingual contributors. See [/researchers.html](https://tweetfeed.live/researchers.html). ## Use policy - **Reading / inference / live citation / training**: all allowed. CC0 1.0 means public-domain dedication; no attribution required. - **Rate limit**: none on read endpoints. Be reasonable. - **Robots.txt Content-Signal**: `ai-train=yes, search=yes, ai-input=yes` (intentional - the data is meant to be consumed). - **Contact**: feedback via [GitHub Issues](https://github.com/0xDanielLopez/TweetFeed/issues/new?template=feedback.yml) or DM @0xDanielLopez on X. ## Landing pages (SEO entry points) - [/malicious-urls.html](https://tweetfeed.live/malicious-urls.html): URLs subset; phishing, scam, malware-delivery, C2. - [/malicious-domains.html](https://tweetfeed.live/malicious-domains.html): domains subset; typo-squats, phishing kits, malware hosts. - [/malicious-ips.html](https://tweetfeed.live/malicious-ips.html): IPs subset; C2 servers, scanners, abuse hosts. High FP risk on shared hosting. - [/malicious-hashes-md5.html](https://tweetfeed.live/malicious-hashes-md5.html): MD5 hashes of malware samples; cross-reference VirusTotal before action. - [/malicious-hashes-sha256.html](https://tweetfeed.live/malicious-hashes-sha256.html): SHA-256 hashes; preferred for forensic chain of custody. - [/threat-intelligence-guide.html](https://tweetfeed.live/threat-intelligence-guide.html): pillar reference covering IOC types, OSINT vs commercial feeds, MITRE ATT&CK basics, glossary. - [/tags/](https://tweetfeed.live/tags/): hub page indexing all 22 tag landing pages, grouped by APT groups / malware families / TTPs. Auto-regenerated daily. - [/ioc-types/](https://tweetfeed.live/ioc-types/): hub page indexing the 5 IOC-type landing pages (URLs / domains / IPs / MD5 / SHA-256). - Per-tag landing pages (22 total, all regenerated daily by GitHub Action): - **APT groups**: [/tag/kimsuky/](https://tweetfeed.live/tag/kimsuky/) (G0094, DPRK), [/tag/lazarus/](https://tweetfeed.live/tag/lazarus/) (G0032, DPRK financial), [/tag/dprk/](https://tweetfeed.live/tag/dprk/) (umbrella), [/tag/apt/](https://tweetfeed.live/tag/apt/) (broad nation-state). - **Malware families / C2 frameworks**: [/tag/cobaltstrike/](https://tweetfeed.live/tag/cobaltstrike/) (S0154), [/tag/sliver/](https://tweetfeed.live/tag/sliver/) (S1056), [/tag/mythic/](https://tweetfeed.live/tag/mythic/) (SpecterOps), [/tag/havoc/](https://tweetfeed.live/tag/havoc/) (C5pider), [/tag/deimos/](https://tweetfeed.live/tag/deimos/), [/tag/remcos/](https://tweetfeed.live/tag/remcos/) (S0332), [/tag/asyncrat/](https://tweetfeed.live/tag/asyncrat/), [/tag/njrat/](https://tweetfeed.live/tag/njrat/) (S0385), [/tag/netsupportrat/](https://tweetfeed.live/tag/netsupportrat/) (S0480), [/tag/lumma/](https://tweetfeed.live/tag/lumma/) (S1138 stealer), [/tag/interactsh/](https://tweetfeed.live/tag/interactsh/) (OAST canary). - **TTPs**: [/tag/phishing/](https://tweetfeed.live/tag/phishing/) (T1566), [/tag/c2/](https://tweetfeed.live/tag/c2/) (TA0011), [/tag/ransomware/](https://tweetfeed.live/tag/ransomware/) (T1486), [/tag/malware/](https://tweetfeed.live/tag/malware/), [/tag/scam/](https://tweetfeed.live/tag/scam/), [/tag/stealer/](https://tweetfeed.live/tag/stealer/) (T1555), [/tag/opendir/](https://tweetfeed.live/tag/opendir/). - Each page has baked counts (today/week/month/year), top-10 recent IOCs from `api.tweetfeed.live/v1/month/`, About bullets with MITRE / Malpedia / CISA references, FAQ accordion + FAQPage schema, and links to related tags. ## Sister project - [phishunt.io](https://phishunt.io/) - same author, complementary phishing-detection feed.