---
name: tweetfeed-ioc-feed-ingestion
description: "How to get TweetFeed IOC Feed and API data into a pandas DataFrame and Parquet: access, the request, the format, limits, quirks and terms."
---

# Load defanged TweetFeed IOCs into pandas and Parquet

Source entry: https://signal-lab-jet.vercel.app/datasets/tweetfeed-ioc-feed
Provider: https://tweetfeed.live/feeds/
Checked against the provider's documentation: 2026-11-01

## Access
- No account or key. The JSON REST API and static feed files are public.
- Use defang=1 so URL, domain and IP values are inert in the stored output; do not request any listed destination.

## Request
```bash
curl 'https://api.tweetfeed.live/v1/today?defang=1'
```

## Format
JSON rows with UTC date, reporter handle, IOC type, defanged value, tag array and source-tweet URL.

## Load into pandas and Parquet
Needs Python 3 with requests, pandas and pyarrow.
```python
"""TweetFeed IOCs posted today, defanged -> pandas -> Parquet. Do not request listed destinations."""
import json
import requests
import pandas as pd

URL = "https://api.tweetfeed.live/v1/today"
HEADERS = {"User-Agent": "Mozilla/5.0 (X11; Linux x86_64) SignalLabCheck/1.0"}
r = requests.get(URL, headers=HEADERS, params={"defang": "1"}, timeout=60)
r.raise_for_status()
df = pd.DataFrame(r.json())
df["date"] = pd.to_datetime(df["date"], utc=True)
df["tags"] = df["tags"].map(json.dumps)
df.to_parquet("tweetfeed_today.parquet", index=False)
print(len(df), "IOCs", df["date"].min().isoformat(), "to",
      df["date"].max().isoformat(), "types", ",".join(sorted(df["type"].unique())))
```
Run by us on 2026-11-01 (python 3.13.5 | pandas 3.1.0 | pyarrow 26.0.0 | requests 2.34.2). Result: 65 IOCs 2026-11-01T01:05:51+00:00 to 2026-11-01T15:56:13+00:00 types domain,ip,sha256,url

## Limits
- Rate limit: no hard limit for normal use; abusive traffic may be throttled or blocked.
- API responses are capped at 10,000 rows and carry X-Result-Truncated when rows were dropped.
- The public files are rolling today, week, month and 365-day windows rather than a permanent full archive.

## Quirks
- The CSV files have no header; their fields are date, reporter, type, value, tags and source tweet in that order.
- Add defang=1 to today, week or month API requests; the year route redirects to CSV and is never defanged.
- The data is community-sourced and unverified. Do not add indicators directly to a blocklist without separate corroboration.
- Do not visit or fetch listed URLs or hosts; request only TweetFeed endpoints and feed files.

## Terms and attribution
- TweetFeed data feeds and API responses are CC0-1.0; attribution is appreciated but not required.
- Lawful use is required, abusive traffic can be blocked, and the provider makes no uptime or accuracy commitment.
- Terms page: https://tweetfeed.live/tos/

## Sources
- https://tweetfeed.live/feeds/: "Static files you fetch on your own schedule. Public domain (CC0), no key, no sign-up."
- https://tweetfeed.live/feeds/: "Windows roll forward and are rebuilt every 15 minutes."
- https://tweetfeed.live/api/: "No hard rate limit for normal use."
- https://tweetfeed.live/tos/: "False positives and false negatives occur routinely."

## Help improve this skill
Missing a source, or see something to improve? Call the MCP tool suggest_source or feedback (or POST /api/suggest or /api/feedback). Reviewed ideas: https://signal-lab-jet.vercel.app/agent-suggestions

Information for educational purposes only. Free tiers, limits and licenses belong to the providers and may change; check the provider's own terms before using the data.