Malicious Domains

A malicious domain feed is a continuously updated list of fully-qualified domain names that point to phishing pages, scams, malware payloads or command-and-control endpoints. Security teams ingest these into DNS firewalls, secure web gateways and EDRs to block traffic before resolution. TweetFeed publishes the domains spotted by ~95 infosec researchers on Twitter/X, refreshed every 15 minutes.

Right here. This page is a live bad domains list: every entry was reported as phishing, scam, malware or C2 infrastructure by the infosec community on Twitter/X. Grab the CSV for your blocklist, query the JSON API from scripts, or subscribe to the RSS feed. It refreshes every 15 minutes and is CC0, so no key or sign-up is needed.

A bad domain list (also called a malicious domain blocklist) aggregates hostnames reported as phishing, scam or malware infrastructure by the Threat Intelligence community. TweetFeed publishes its own bad domains list for free, updated every 15 minutes in CSV, JSON and API formats. The data is released under CC0, so there is no key, sign-up or rate limit to use it.

Every 15 minutes. The pipeline scrapes RSS feeds from public Twitter/X researcher accounts and lists, extracts domains from tweets, deduplicates against the past year, tags them with malware family and category, and republishes the result in CSV, JSON and RSS.

Block the domain when the whole host is attacker-owned infrastructure: it catches every path, including the ones nobody has reported yet. Block the URL when the kit sits on a compromised or shared host, where a domain block would take legitimate content down too. Most SOCs do both. The URL-level list is the malicious URLs feed.

TweetFeed is OSINT, not a sandbox. Domains are sourced from public posts by infosec researchers, then deduplicated and tagged. False positives can occur, especially for compromised legitimate domains hosting phishing kits temporarily. Cross-reference VirusTotal, urlscan.io or your sandbox before blocking outright.

Yes. Every TweetFeed feed is free and released into the public domain under CC0 1.0, with no API key, sign-up or rate card. You can use it in commercial or personal projects; a link back is appreciated but not required.

Import the domain list into your DNS firewall, secure web gateway or Pi-hole as a blocklist, or query the JSON API from your SOAR/SIEM to enrich alerts. Validate against VirusTotal or your own sandbox before blocking outright, since OSINT feeds can carry false positives.