Malicious URLs

Free malicious URL list: full links with path and query, from Twitter/X researchers


Malicious URLs

Phishing, scam and malware-delivery URLs from Twitter/X

Related Threat Intelligence feeds: Domains · IPs · SHA-256 · MD5 · All IOC types

URLs by window

Today

-

malicious URLs

Week

-

malicious URLs

Month

-

malicious URLs

Year

-

malicious URLs

Currently tracking 3,206 malicious URLs reported in the last 30 days. Data generated 2026-11-11 07:45 UTC.

What this list contains

  • Source: ~95 Twitter/X researchers, every 15 min.
  • Phishing kits, scam pages, malware and C2 links.
  • Includes .onion URLs and ransomware leak sites.
  • Excludes allowlisted sites (Google, Microsoft, shorteners).

Recent samples

Latest URLs from the past 7 days. Live from api.tweetfeed.live/v1/week/url.

Loading samples

Top tags for malicious URLs

Filter the URL feed by malware family or category. Each tag has its own landing page with recent samples and context.

See all tags on the Dashboard or browse the full IOC feed.

Formats and how to use

The malicious URLs are available in four formats:

FormatWhereBest for
JSON APIapi.tweetfeed.live/v1/<window>/urlSOAR / SIEM enrichment, scripts
CSVtoday / week / month / year .csvbulk import, spreadsheets, blocklists
RSSrss.xmlwatch new IOCs in a reader
MCPmcp.tweetfeed.livelive lookups from AI agents / Claude
  • Load into your web gateway or mail filter as a blocklist.
  • Check VirusTotal or a sandbox first: OSINT has false positives.

Frequently asked questions

What is a malicious URL feed?

A live list of links to phishing, scam, malware and C2 pages. Ours comes from ~95 researchers on Twitter/X.

How do malicious URLs differ from malicious domains?

A URL is the full link with its path. Block URLs on shared or hacked hosts, block the domain when the whole host is bad.

Where can I download a malicious URL list?

On the Feeds page: CSV, JSON and RSS. No key or sign-up.

Can I integrate this feed with my SIEM, MISP or firewall?

Yes. Use the CSV, the JSON API or the MISP manifest. Copy-paste snippets are on the Hunt page.

Are these URLs verified malicious?

No. It is OSINT, so false positives happen. Check VirusTotal or urlscan.io before blocking.

Is the malicious URLs list free?

Yes. CC0 1.0, no key or sign-up, commercial use allowed.

License

IOC data: CC0 1.0 Public Domain. No attribution required, no warranty.