# TweetFeed > TweetFeed is a free, real-time IOC (Indicators of Compromise) aggregator that scrapes the infosec community on Twitter/X, updated every 15 minutes. CC0 1.0 Universal license on every data output (feeds, REST API, MCP server); founded by Daniel López, coverage starts 2021-08-09. ## Feeds - [Today's IOCs (CSV)](https://tweetfeed.live/feeds/today.csv): current UTC calendar day, all IOC types. - [Past 7 days (CSV)](https://tweetfeed.live/feeds/week.csv): rolling 7-day window. - [Past 30 days (CSV)](https://tweetfeed.live/feeds/month.csv): rolling 30-day window. - [Not-yet-corroborated (CSV)](https://tweetfeed.live/feeds/exclusive.csv): last 30 days, not yet seen on 5 tracked cross-check feeds. - [Past 365 days (CSV)](https://tweetfeed.live/feeds/year.csv): rolling year window, redirects to raw GitHub. - [RSS feed](https://tweetfeed.live/rss.xml): full firehose, syndication-friendly. - [Per-type RSS](https://tweetfeed.live/rss/type/{url|domain|ip|sha256|md5}.xml): one feed per IOC type. - [Per-user RSS](https://tweetfeed.live/rss/user/{handle}.xml): one feed per active reporter, lowercase handle. - [MISP manifest](https://tweetfeed.live/misp/manifest.json): native MISP feed, one event/day, 365 days of history; in MISP's default feed list since 2.5.47. - [Blocklists (TXT)](https://api.tweetfeed.live/v1/blocklist/{domains,hosts,adguard,ips,rpz,dnsmasq,urls,zeek-intel,wazuh-domains,wazuh-ips,domains-corroborated,ips-corroborated,urls-corroborated,sha256,md5,nrd-domains}.txt): 16 plain-text formats for Pi-hole, AdGuard, DNS/firewall/IDS/EDR import. - [Browseable feed page](https://tweetfeed.live/feeds/): HTML index with stats and download buttons. ## API - [API documentation](https://tweetfeed.live/api/): endpoints, examples, query syntax. - [Integration recipes](https://tweetfeed.live/hunt/): copy-paste recipes for the terminal, Splunk, Microsoft Sentinel and Defender, Elastic, IBM QRadar, MISP and TAXII, OpenCTI, IntelOwl, Sigma detection content and AI agents. - [OpenAPI 3.1 spec](https://tweetfeed.live/openapi.yaml): machine-readable schema, every route. - [Status](https://api.tweetfeed.live/v1/status): per-artifact freshness verdict, computed fresh every request. - [Manifest](https://api.tweetfeed.live/v1/manifest): every published artifact - size, row count, SHA-256, URLs. - [Counts](https://api.tweetfeed.live/v1/counts): live volume totals by window and IOC type. - [IOC lookup](https://api.tweetfeed.live/v1/ioc?value=example.com): exact match, 365-day window plus pre-365-day archive. - [Delta sync](https://api.tweetfeed.live/v1/since/2026-01-01T00:00:00Z): incremental pulls since a timestamp, 30-day window. - [TAXII 2.1 server](https://api.tweetfeed.live/taxii2/): read-only discovery for OpenCTI, ThreatQ, taxii2-client. - [Blocklists page](https://tweetfeed.live/blocklists/): human index of the 16 plain-text blocklist formats. - REST time windows: `/v1/{today,week,month,year}` plus type/tag/@researcher filters. No auth, CORS open, JSON only. ## Campaigns and trends - [AI-clustered campaigns](https://tweetfeed.live/campaigns/): human page, daily campaign groupings from the last 30 days. - [Campaigns API](https://api.tweetfeed.live/v1/campaigns): JSON campaign objects - confidence, TTPs, IOC counts, infra rollups. - [Per-campaign export](https://api.tweetfeed.live/v1/campaigns/): full record plus uncapped IOCs; also `.csv` and `.stix.json`. - [Full campaign IOC set](https://api.tweetfeed.live/v1/campaigns/iocs): uncapped IOC rows for every campaign, no MCP wrapper. - [IOC trends](https://tweetfeed.live/trends/): human page, daily volume, top movers, TLD breakdown, novelty rate. - [Trends API](https://api.tweetfeed.live/v1/trends): same trends document, JSON, `ETag`/`304` support. - [Contributors](https://api.tweetfeed.live/v1/contributors): today/week/month/year rankings of reporting handles. ## AI IOC enrichment - Every 6h, an AI job annotates new IOCs: summary, malware family, threat type, suggested tags, confidence. Never alters IOC values. - Exposed via the `ai` field on [IOC lookup](https://api.tweetfeed.live/v1/ioc?value=example.com) and the MCP `enrich_ioc` tool. - Optional sidecar fields on IOC lookup: `related`, `external` (abuse.ch corroboration), `net` (IP org/ASN, plus the official provider IP range that contains it), `reg` (RDAP), `campaigns`, `archive` (pre-365-day history). - [Enrichment sidecar](https://raw.githubusercontent.com/0xDanielLopez/TweetFeed/master/enrichment.json): raw 30-day data, CC0. ## MCP integration (for AI agents) - [Agent setup prompt](https://tweetfeed.live/agent-setup/prompt.md): fetch and follow - registers the MCP server, verifies the connection. - [mcp.tweetfeed.live](https://mcp.tweetfeed.live/): MCP server, JSON-RPC 2.0. 14 tools: `query_iocs`, `check_url`, `check_ip`, `check_hash`, `list_recent_iocs`, `get_tag_info`, `get_trending`, `enrich_ioc`, `get_campaigns`, `get_campaign_iocs`, `get_trends`, `search`, `fetch`, `get_feed_status`. Also 7 resources (`tweetfeed://status`, `tweetfeed://counts`, `tweetfeed://trends`, `tweetfeed://campaigns`, `tweetfeed://iocs/{today|week|month}`) and 2 templates (`tweetfeed://iocs/{time}/{type}`, `tweetfeed://campaigns/{id}`) via resources/read: raw JSON of the same documents as the REST API. And 3 prompts (`triage_ioc`, `daily_brief`, `campaign_summary`): user-invoked recipes that chain the tools. - [/agents/](https://tweetfeed.live/agents/): integration guide - config snippets for Claude Desktop, Cursor, Zed. - [Agent Skills index](https://tweetfeed.live/.well-known/agent-skills/index.json): RFC v0.2.0 manifest, 5 skills. - [MCP server card](https://tweetfeed.live/.well-known/mcp/server-card.json): SEP-1649 metadata. - [API catalog](https://tweetfeed.live/.well-known/api-catalog): RFC 9727 linkset. ## Coverage - IOC types: URL, domain, IPv4/IPv6, SHA-256, MD5 - malicious infrastructure reported by the community. - Tag taxonomy: 95 tags across malware families and tactics; full list in the `/dashboard/` filter. - [Researchers](https://tweetfeed.live/researchers/): ~95 vetted infosec accounts on Twitter/X feed the aggregator. ## Use policy - CC0 1.0 Universal (public domain, no attribution required); no authentication; no hard rate limit on read endpoints - be reasonable. [Feedback](https://github.com/0xDanielLopez/TweetFeed/issues/new?template=feedback.yml) via GitHub Issues. ## More - [Full reference](https://tweetfeed.live/llms-full.txt): everything above expanded, plus methodology, FAQ and every landing page. - [phishunt.io](https://phishunt.io/): sister project, same author, complementary phishing-detection feed.