TweetFeed
A feed of indicators of compromise, such as malicious URLs, domains, IPs, and file hashes, gathered from posts shared by the infosec community on Twitter/X, published as CSV, JSON, RSS, MISP, and STIX feeds.
TweetFeed collects indicators of compromise shared by the infosec community on Twitter and X, covering malicious URLs, domains, IP addresses, and SHA256 or MD5 hashes tied to malware and phishing activity. Data is republished every fifteen minutes as CSV windows for the current day, week, month, and year, as ready-made blocklists in several formats including AdGuard, RPZ, Zeek Intel, and Wazuh CDB lists, and as TAXII 2.1, STIX 2.1, MISP, and RSS feeds.
Consumers are asked to use the API or the published files with conditional requests rather than cloning or polling the repository, since its history is rewritten daily as a single-commit snapshot. Status and manifest endpoints report the freshness of each published artifact.
It is dedicated to the public domain under CC0-1.0.