0xdaniellopez / tweetfeed

TweetFeed collects Indicators of Compromise (IOCs) shared by the infosec community at Twitter. Here you will find malicious URLs, domains, IPs, and SHA256/MD5 hashes.

👋 Hey there!

I'm Daniel López, a Security Engineer from Seville, Spain.

Love Cybersecurity and building tools.

Twitter   |    LinkedIn   |    Links

---

phishunt.io	TweetFeed.live	StakeWatcher.com

tweetfeed's Issues

No more up-to-date data available

The daily (etc.) feed lists had been updated on 19 July 2023. I suspect that the framework is now broken with Twitter's new policies?

Can anyone confirm?

How rely on posts like this?

https://twitter.com/FromPorts/status/1572569325730693121

Once parsed this produces a block of:
https://gov.it

Default Gateway ip added as IOC

Hi, by mistake due to the parsing on this tweet: https://twitter.com/drb_ra/status/1764620344080421175 , the ip address 192.168.0.1 has been added as a indicator of compromise in the following file https://github.com/0xDanielLopez/TweetFeed/blob/master/202403/20240304.csv. I have had problems with remote users which could not connect to their home network.

[Feature Request] Provide domain & IP list feeds?

It would be very nice if the feed can be directly consumed with domain and IP list 😃

There are some DNS level blockers like Pi-Hole, blocky, and AdGuard Home, can use domain list as feed without any additional works!

TweetFeed with MISP?

Is there any way to integrate TweetFeed with MISP (module)? It would be amazing. 😬

Clarify intervals

Hi, very nice initiative here, thanks!

For now, week/month/year are a bit misleading as one could understand it as "This week, this month, this year" whereas it seems to be more like "Last 7days, last 30 days, last 365 days". I suggest this should be renamed.

Thanks again.

User not updated

This user is not being updated and is seen to be last updated last year.

user : sicehice

link : https://twitter.com/sicehice

week : https://api.tweetfeed.live/v1/week/@sicehice

Would be grateful if you could look into this!

Integrating https://red.flag.domains - suspicious domains from french DNS TLD

Hello @0xDanielLopez,

Do you think you could integrate results from https://red.flag.domains/ ?
It's from this guy: https://twitter.com/_mikolajek_

Cheers !

Can the code of this platform be open source?

Can the code of this platform be open source? (https://tweetfeed.live/)

Data Wiped

First love the service and glad you got it working again. Unfortunately it seems all of the current and historical CSVs were wiped with blank files, was that intentional?

Defang URLs

Hello o/

I was browsing TweetFeed when I realized the malicious URLs and Domains on the site, for example on search https://tweetfeed.live/search.html are clickable despite the icon seemingly indicating it may just offer a copy in clipboard.

This issue is to suggest to Defang the URLs and Domains to avoid misclicks.

Post to remove

This following post produces an entry blocking "db.com" ( Deutsche Bank )
https://twitter.com/silentpush_labs/status/1613974293645230107

2023-01-13 19:00:32,silentpush_labs,domain,db.com,#phishing,https://twitter.com/silentpush_labs/status/1613974293645230107