TweetFeed aggregates indicators of compromise shared by the infosec community on Twitter/X into CSV, STIX, MISP and blocklist feeds for defenders running authorized detection and blocking pipelines.
| Tool | 0xDanielLopez/TweetFeed — continuously regenerated feeds of IOCs posted by the security community on Twitter/X |
| Category | Threat intelligence feed / OSINT aggregation |
| Primary Use | Pulling community-reported url, domain, ip, sha256 and md5 indicators into MISP, SIEMs, DNS resolvers and detection engineering workflows |
| Safe Use | Purely defensive: enriching authorized SOC monitoring, lab research, and blocklist deployment on infrastructure you administer |
| Telemetry Note | Passive consumption — clients poll api.tweetfeed.live with ETag conditional requests every 15 minutes; leaves no footprint on victim or attacker systems |
TweetFeed sits in a specific niche of the threat intelligence ecosystem: it harvests indicators of compromise that security researchers voluntarily post on Twitter/X and republishes them as machine-consumable feeds. The project, published under a CC0-1.0 license with roughly 682 stars at the time of writing, has evolved well beyond the original CSV-on-GitHub model into a full publishing platform with a REST API at api.tweetfeed.live, a TAXII 2.1 server, STIX 2.1 bundles, an MISP feed, RSS, and even an MCP server for AI agents. For a blue team, the appeal is immediate: free, fresh, community-sourced IOCs in whatever format your stack already speaks.
The data model is deliberately simple. Each record follows the CSV schema date, user, type, value, tags, tweet_url, with no header row — the README explicitly warns not to enable ignoreFirstRecord or skip_header in your ingest tooling, because the first line is already live data. Five IOC types are collected: url, domain, ip, sha256 and md5. Every indicator preserves provenance back to the originating tweet_url and reporter handle, which matters enormously for triage: when an indicator fires, you can trace who reported it, when, and under which community tag such as #phishing, #Kimsuky or #C2.
Volume, as shown in the README's live statistics, is substantial. Over the trailing year the feed captured around 45,851 URLs, 39,646 domains, 7,805 IPs, 2,944 sha256 hashes and 2,099 md5 hashes. The tag taxonomy currently tracks 95 active tags, dominated by #phishing at nearly 35,000 yearly hits, followed by #Kimsuky and #DPRK — a clear signal that the feed skews toward phishing takedowns and North Korean activity reporting, which reflects what the Twitter infosec community actually spends its time on. #ClickFix, #opendir and #ransomware round out the top ten.
Architecturally, the interesting part is the publishing cadence and how the maintainers manage distribution. The pipeline regenerates all artifacts every 15 minutes, and the README is emphatic that consumers should not clone or poll the repository itself. Instead, the API serves everything with conditional requests: send If-None-Match or If-Modified-Since, and unchanged artifacts return 304 with an empty body. This is polite feed design done right. For those who genuinely need a local mirror, the repo history is rewritten daily as a single-commit snapshot, so a naive git pull breaks; the documented pattern is git clone --depth 1 --filter=blob:none followed by git fetch --depth 1 origin master && git reset --hard origin/master, refreshed no more than every 15 minutes.
The programmatic surface is where TweetFeed distinguishes itself from a simple dump. The JSON API at api.tweetfeed.live/v1 requires no authentication, has CORS enabled, and supports composable filters: /v1/today/url/phishing and /v1/today/phishing/url are equivalent queries, filtering by IOC type, tag, or @handle in any order. An incremental sync endpoint at /v1/since/<ISO8601> returns only post-timestamp records — the correct way to stay current without re-downloading year.csv — and returns 410 past the 365-day retention horizon. A single-IOC lookup at /v1/ioc?value=<ioc> does exact matching across the full window and adds enrichment context, related infrastructure and network metadata where available, backing the public search UI at tweetfeed.live/search/.
For detection engineers, the API also exposes analytical endpoints that aggregate rather than enumerate. /v1/campaigns returns cluster groupings from the last 7 days, /v1/trends serves 31-day series covering movers, TLD distribution and novelty, and /v1/counts gives raw per-window counters. These are the endpoints you'd wire into a weekly threat landscape briefing or an automated dashboard, letting you observe shifts like a surge in a specific TLD or an emerging tag before individual IOCs ever hit your perimeter logs.
Integration with existing defensive tooling is where the project clearly invests effort. The MISP feed manifests as one event per day with 365 days of history, ships in MISP's default feed list since version 2.5.47, and includes a dedicated hash cache at misp/hashes.csv containing md5(value),event-uuid pairs for MISP's cache-based correlation over the last 31 days. On the standards side, STIX 2.1 bundles exist for day, week and month windows — deliberately no year bundle, since it would exceed 80 MB and brush against GitHub push limits — and a read-only, unauthenticated TAXII 2.1 server at api.tweetfeed.live/taxii2/ exposes a single rolling 31-day collection that any standard TAXII client can consume.
Perhaps the most immediately practical artifact set is the blocklist collection: 16 ready-to-deploy formats including domains.txt, ips.txt, urls.txt, hosts.txt, adguard.txt, rpz.txt, zeek-intel.txt and Wazuh CDB lists, all built on a rolling 30-day window. This means an authorized defender administering their own resolver, AdGuard instance, Zeek sensor or Wazuh deployment can drop a URL into their existing config and get community-vetted blocking with zero transformation code. The rpz.txt and zeek-intel.txt formats in particular show awareness of how enterprise security teams actually consume intelligence.
The newest surface is agent-oriented: an MCP server at mcp.tweetfeed.live speaking JSON-RPC 2.0 and exposing 13 tools — query_iocs, check_url, check_ip, check_hash, list_recent_iocs, get_tag_info, get_trending, enrich_ioc, get_campaigns, get_campaign_iocs, get_trends, search and fetch. This positions TweetFeed for the emerging pattern of LLM-assisted triage, where an analyst's agent can pivot from a suspicious URL to related infrastructure and campaign context in a single conversational step. An OpenAPI spec and copy-paste MCP configuration are documented at tweetfeed.live/openapi.yaml and tweetfeed.live/agents/.
Operationally, there are caveats worth internalizing before you wire this into production blocking. Community-sourced IOCs are noisy by nature: tags like #phishing and #scam include freshly registered domains that may be dropped and re-registered, and false positives from enthusiastic reporters are an inherent risk of any crowdsourced feed. The provenance columns — user and tweet_url — are your friend here, and prudent deployment treats the blocklists as a high-signal supplement to, not a replacement for, curated commercial or CERT feeds. A monitoring-only rollout in zeek-intel.txt or SIEM watchlists before active rpz.txt enforcement is a sensible staged approach.
From a telemetry standpoint, consuming TweetFeed is entirely passive from the defender's side: your infrastructure polls the API with conditional requests every 15 minutes and nothing touches adversary systems. There is nothing here that fires at attackers; it is purely an ingestion and detection resource. Defenders observing its use would see nothing beyond standard outbound HTTPS to api.tweetfeed.live from the ingestion host, and the value is realized entirely inside your own logging, alerting and resolver stacks.
In sum, 0xDanielLopez/TweetFeed is a mature, defensively-oriented intelligence distribution project that has grown from a daily CSV into a multi-format, standards-compliant publishing pipeline with sensible rate-limit etiquette, rich programmatic access, native MISP/STIX/TAXII integration, deployable blocklists, and a forward-looking MCP surface. For authorized security teams wanting free, fresh, attributable community IOCs with minimal integration friction, it remains one of the cleaner entry points in the open-source threat intelligence landscape.
0xDanielLopez/TweetFeed.Educational analysis for authorized security professionals. Use only in controlled, authorized environments.
Related coverage
0 comentários:
Post a Comment
Note: Only a member of this blog may post a comment.