tweetfeed.live

Query the TweetFeed API for Indicators of Compromise (IOCs: URLs, domains, IPs, MD5/SHA256 hashes) shared by the infosec community on Twitter/X.

Check whether a URL (or substring) appears in the TweetFeed corpus over the past 30 days.

Check whether an IP address appears in the TweetFeed corpus.

Check whether a file hash (MD5 or SHA-256) appears in the TweetFeed corpus.

List TweetFeed IOCs added since a given date, useful for delta-syncing a blocklist or Threat Intelligence pipeline.

Bundle of TweetFeed activity for a single tag: aggregate counts across today/week/month/year windows plus the most recent IOCs.

Top tags and IOC-type distribution for a given time window, computed from the live counts.json aggregate.

Look up an IOC value in TweetFeed.

AI-clustered campaign groupings of the last 30 days of community-shared TweetFeed IOCs: each campaign bundles related URLs/domains/IPs/hashes under a name, a short context summary, a clustering confidence (high/medium/low), and a targeted brand/sector/country when identified (AI-inferred, may be null; sector is a STIX 2.1 industry-sector-ov slug, country ISO 3166-1 alpha-2), a ttps array of up to 4 MITRE ATT&CK Enterprise technique ids (AI-inferred, closed vocabulary, deliberately infrastructure-only because the clustering step never observes a payload running - so it names things like staged payloads or dynamic-DNS C2, never encryption or persistence; may be an empty array), threat_types and families rollups over the full campaign membership, not just the sample (families is malware family counts and usually empty since attribution is sparse; enriched_count says how many of the campaign's IOCs those two rollups cover), an infra array when the campaign has at least one IP IOC (ASN/org, IP count, country per network, sorted by IP count descending), an optional patterns array (up to 3 deterministic regexes over the campaign's own registered domains, each with evidence counts: domain_count, ioc_count, domains_elsewhere_30d, examples, first_seen/last_seen; live since 2026-09-01 but earned by a minority of campaigns, so absent on most - only families whose registered domains share a strong enough naming shape get one), an optional history object (365-day evidence behind the 30-day card: first_seen_365d/last_seen_365d, domains_365d, iocs_365d, iocs_before_window and a by_pattern breakdown; absent when the yearly scan failed), anchors.families only on an orphan hash/IP bucket that local enrichment attributed to one malware family (such a bucket has no domain/path/tag anchor - the shared family is what makes it one campaign), plus a sample of member IOCs, each optionally carrying its own ai threat_type/family and net org/country, mirroring enrich_ioc.

IOC trend analytics from the last 31 days: daily volume by type, top moving tags week-over-week, most-abused TLDs, new vs recurring indicator ratio, and feed producer concentration.