tweetfeed.live valid
TweetFeed
TweetFeed is a free, real-time IOC (Indicators of Compromise) aggregator that scrapes the infosec community on Twitter/X, updated every 15 minutes. CC0 1.0 Universal license on every data output (feeds, REST API, MCP server); founded by Daniel López, coverage starts 2021-08-09.
- Authority
- 45 reach 0 · trust 5 · quality 25 · freshness 15
- Tier
- listed
- llms.txt
- https://tweetfeed.live/llms.txt
- llms-full.txt
- https://tweetfeed.live/llms-full.txt
- Sections
- 8
- Links
- 40
- Size
- 6652 bytes
- For agents
- Documentation: developer or product docs worth reading, nothing to call
- First seen
- 2026-10-23T00:02:03.522Z
- Last checked
- 2026-10-23T00:02:04.830Z
- Badge
Their llms.txt
The beginning of the file, from our validated copy saved 2026-10-23T00:02:03.525Z. Cached copy · Source on tweetfeed.live
# TweetFeed
> TweetFeed is a free, real-time IOC (Indicators of Compromise) aggregator that scrapes the infosec community on Twitter/X, updated every 15 minutes. CC0 1.0 Universal license on every data output (feeds, REST API, MCP server); founded by Daniel López, coverage starts 2021-08-09.
## Feeds
- [Today's IOCs (CSV)](https://tweetfeed.live/feeds/today.csv): current UTC calendar day, all IOC types.
- [Past 7 days (CSV)](https://tweetfeed.live/feeds/week.csv): rolling 7-day window.
- [Past 30 days (CSV)](https://tweetfeed.live/feeds/month.csv): rolling 30-day window.
- [Not-yet-corroborated (CSV)](https://tweetfeed.live/feeds/exclusive.csv): last 30 days, not yet seen on 5 tracked cross-check feeds.
- [Past 365 days (CSV)](https://tweetfeed.live/feeds/year.csv): rolling year window, redirects to raw GitHub.
- [RSS feed](https://tweetfeed.live/rss.xml): full firehose, syndication-friendly.
- [Per-type RSS](https://tweetfeed.live/rss/type/{url|domain|ip|sha256|md5}.xml): one feed per IOC type.
- [Per-user RSS](https://tweetfeed.live/rss/user/{handle}.xml): one feed per active reporter, lowercase handle.
- [MISP manifest](https://tweetfeed.live/misp/manifest.json): native MISP feed, one event/day, 365 days of history; in MISP's default feed list since 2.5.47.
- [Blocklists (TXT)](https://api.tweetfeed.live/v1/blocklist/{domains,hosts,adguard,ips,rpz,dnsmasq,urls,zeek-intel,wazuh-domains,wazuh-ips,domains-corroborated,ips-corroborated,urls-corroborated,sha256,md5,nrd-domains}.txt): 16 plain-text formats for Pi-hole, AdGuard, DNS/firewall/IDS/EDR import.
- [Browseable feed page](https://tweetfeed.live/feeds/): HTML index with stats and download buttons.
## API
- [API documentation](https://tweetfeed.live/api/): endpoints, examples, query syntax.
- [Integration recipes](https://tweetfeed.live/hunt/): copy-paste recipes for the terminal, Splunk, Microsoft Sentinel and Defender, Elastic, IBM QRadar, MISP and TAXII, OpenCTI, IntelOwl, Sigma detection content and AI agents.
- [OpenAPI 3.1 spec](https://tweetfeed.live/openapi.yaml): machine-readable schema, every route.
- [Status](https://api.tweetfeed.live/v1/status): per-artifact freshness verdict, computed fresh every request.
- [Manifest](https://api.tweetfeed.live/v1/manifest): every published artifact - size, row count, SHA-256, URLs.
- [Counts](https://api.tweetfeed.live/v1/counts): live volume totals by window and IOC type.
- [IOC lookup](https://api.tweetfeed.live/v1/ioc?value=example.com): exact match, 365-day window plus pre-365-day archive.
- [Delta sync](https://api.tweetfeed.live/v1/since/2026-01-01T00:00:00Z): incremental pulls since a timestamp, 30-day window.
- [TAXII 2.1 server](https://api.tweetfeed.live/taxii2/): read-only discovery for OpenCTI, ThreatQ, taxii2-client.
- [Blocklists page](https://tweetfeed.live/blocklists/): human index of the 16 plain-text blocklist formats.
- REST time windows: `/v1/{today,week,month,year}` plus type/tag/@researcher filters. No auth, CORS open
…Machine-readable: GET /v1/resolve?q=tweetfeed.live · GET /v1/domain/tweetfeed.live · this page as Accept: application/json or text/markdown · MCP lookup_domain
Automatically discovered from public files. Inclusion does not imply endorsement or publisher participation.
Own or manage this website?
If you own or manage tweetfeed.live, you can update its listing and review file health, discovery activity and score history.
Manage this listing — optional
What verification unlocks
See how your site is discovered—and control what agents see.
- Control what agents see
Edit your listing description, tags, public contact details and additional llms.txt paths. Publish your terms for automated access, attribution and pricing.
- Make your profile eligible for search
A valid, listed, unblocked, verified profile can appear in our publisher sitemap and become eligible for search-engine visibility. Search engines decide what to index and rank.
- Appear in our llms-full.txt
Eligible verified publishers are listed by name, with their file links and summaries, in the service overview agents can read.
Free. No account registration, backlink or payment required. Public discovery remains available without verification.
Let your coding agent verify it
If your coding agent is authorized to manage this website, paste these instructions into it.
Claim my listing on Agent Web Map for tweetfeed.live:
1. POST https://agentwebmap.com/v1/sites/tweetfeed.live/claims and keep claim_id and claim_secret private.
2. Publish the proof: add the line "AgentWebMap ownership: <token>" (token from step 1) to https://tweetfeed.live/llms.txt, or use the DNS, meta-tag or well-known method the response describes.
3. POST https://agentwebmap.com/v1/sites/tweetfeed.live/verify with {"claim_id": "...", "claim_secret": "..."}.
4. Save the api_key from the answer; it manages the listing (PATCH https://agentwebmap.com/v1/sites/tweetfeed.live).
MCP equivalent: tools begin_ownership_claim, then verify_domain, at https://agentwebmap.com/mcp. Docs: https://agentwebmap.com/docs#verifyCorrections or removal requests: contact the directory.