TweetFeed IOC Feed and API

Use in your agent

Load defanged TweetFeed IOCs into pandas and Parquet. Checked against the provider's documentation on Nov 1, 2026.

Access

• No account or key. The JSON REST API and static feed files are public.
• Use defang=1 so URL, domain and IP values are inert in the stored output; do not request any listed destination.

Request

curl 'https://api.tweetfeed.live/v1/today?defang=1'

Format

JSON rows with UTC date, reporter handle, IOC type, defanged value, tag array and source-tweet URL.

Load into pandas and Parquet

Needs Python 3 with requests, pandas and pyarrow.

"""TweetFeed IOCs posted today, defanged -> pandas -> Parquet. Do not request listed destinations."""
import json
import requests
import pandas as pd

URL = "https://api.tweetfeed.live/v1/today"
HEADERS = {"User-Agent": "Mozilla/5.0 (X11; Linux x86_64) SignalLabCheck/1.0"}
r = requests.get(URL, headers=HEADERS, params={"defang": "1"}, timeout=60)
r.raise_for_status()
df = pd.DataFrame(r.json())
df["date"] = pd.to_datetime(df["date"], utc=True)
df["tags"] = df["tags"].map(json.dumps)
df.to_parquet("tweetfeed_today.parquet", index=False)
print(len(df), "IOCs", df["date"].min().isoformat(), "to",
      df["date"].max().isoformat(), "types", ",".join(sorted(df["type"].unique())))

Run by us on 2026-11-01 (python 3.13.5 | pandas 3.1.0 | pyarrow 26.0.0 | requests 2.34.2). Result: 65 IOCs 2026-11-01T01:05:51+00:00 to 2026-11-01T15:56:13+00:00 types domain,ip,sha256,url

Limits

• Rate limit: no hard limit for normal use; abusive traffic may be throttled or blocked.
• API responses are capped at 10,000 rows and carry X-Result-Truncated when rows were dropped.
• The public files are rolling today, week, month and 365-day windows rather than a permanent full archive.

Quirks

• The CSV files have no header; their fields are date, reporter, type, value, tags and source tweet in that order.
• Add defang=1 to today, week or month API requests; the year route redirects to CSV and is never defanged.
• The data is community-sourced and unverified. Do not add indicators directly to a blocklist without separate corroboration.
• Do not visit or fetch listed URLs or hosts; request only TweetFeed endpoints and feed files.

Terms and attribution

• TweetFeed data feeds and API responses are CC0-1.0; attribution is appreciated but not required.
• Lawful use is required, abusive traffic can be blocked, and the provider makes no uptime or accuracy commitment.

Sources

• https://tweetfeed.live/feeds/: “Static files you fetch on your own schedule. Public domain (CC0), no key, no sign-up.”
• https://tweetfeed.live/feeds/: “Windows roll forward and are rebuilt every 15 minutes.”
• https://tweetfeed.live/api/: “No hard rate limit for normal use.”
• https://tweetfeed.live/tos/: “False positives and false negatives occur routinely.”