01 · Product name
TweetFeed
IOC feed from public posts. The table is CC0.
Published by TweetFeed.
In short
TweetFeed collects indicators the infosec community posts publicly and lists them at tweetfeed.live. On 23 Oct 2026 the live table said it was reading today.csv from October 23rd, 2026 00:41:55 UTC to 07:01:27 UTC, with 11 URLs, 11 domains, 1 IP, 2 SHA256, and 0 MD5. The docs say everything is free, open and CC0. The GitHub API field was CC0-1.0, with 694 stars. No dollar was printed. The live table contained phishing URLs, which this listing does not repeat. A row is a lead, not a method.
Product pricing strategy
02
Free
TweetFeed printed no dollar price on 23 Oct 2026. The docs say everything is free, open and CC0. The GitHub API license field was CC0-1.0. The docs page and the API field agree on CC0. 694 is the API star count. pushed_at was 2026-10-23T08:15:34Z. The repository was not archived. Free and CC0 are the license sentences. They are not a seat price. The counts 11, 11, 1, 2, and 0 are the morning's today.csv window. They are not fees. The ~1,640 word line is the docs' size for a guide. It is not a price. This review did not open a paid feed.
Utility and features
03
The homepage table is labeled Data from: today.csv. The window printed that morning was From October 23rd, 2026 00:41:55 UTC to October 23rd, 2026 07:01:27 UTC. The count row was URLs 11, Domains 11, IPs 1, SHA256 2, MD5 0. The rows under that header included live phishing URLs and lookalike domains. Those strings are not copied here. A count is not a procedure.
- Morning window was 11 URLs. today.csv from 00:41:55 UTC to 07:01:27 UTC on 23 Oct 2026. Also 11 domains, 1 IP, 2 SHA256, and 0 MD5.
- Docs say CC0. The docs say everything is free, open and CC0. The API field was CC0-1.0. Stars 694. Pushed 2026-10-23T08:15:34Z.
- The URLs stay off this page. The table contained phishing URLs. The counts are quoted. The hostnames are not.
The docs page says everything is free, open and CC0. A guide block says ~1,640 words. A tag line says 25 tags and begins with the names Kimsuky, Lazarus, Cobalt Strike, AsyncRAT, and Lumma. That is the page's count and the start of its list. It is not a targeting guide. The same docs page labels the web feed, the REST API, an MCP server, and the raw GitHub data as CC0. The GitHub repository 0xDanielLopez/TweetFeed returned SPDX CC0-1.0, 694 stars, pushed_at 2026-10-23T08:15:34Z, archived false. The repository description says TweetFeed collects indicators of compromise shared by the infosec community at Twitter, and that the set includes malicious URLs, domains, IPs, and SHA256/MD5 hashes. No dollar price was printed on the homepage, the docs, or the repository.
- 1
Quote the five counts with the UTC window. Do not paste a URL from the table.
- 2
Say the docs are CC0 and the API field is CC0-1.0.
- 3
Treat a row as a lead. Do not add a request step.
Caveats
04
The live table is a list of indicators, and on this morning it included phishing URLs. Those URLs are not repeated, and they were not screenshotted. Publishing the hostname would republish the lure. The counts are the page's counts for that UTC window. They will be different on a later read of today.csv.
25 tags is the docs' count. The names that follow it are the start of that list. Do not turn the list into a description of how to use a lure. CC0 on the docs page and CC0-1.0 on the API field are the same dedication named two ways. The star count 694 is the API. A row is a lead for someone defending a network they hold. It is not confirmation that the host is still serving the page, and it is not a fetch procedure.
Potential use cases
06
- A phishing URL from the live table is about to be pasted into a note. On 23 Oct 2026 the table said today.csv ran from 00:41:55 UTC to 07:01:27 UTC, with 11 URLs, 11 domains, 1 IP, 2 SHA256, and 0 MD5. The URL and domain values included lures. The counts can be quoted. The hostnames stay off the page. A later read of today.csv will not have the same window.
- The tag list is about to become a targeting note. The docs say 25 tags and start the list with Kimsuky, Lazarus, Cobalt Strike, AsyncRAT, and Lumma. That is the page's count and the start of its list. A guide block says ~1,640 words. Neither line is a procedure. The docs say everything is free, open and CC0.
- CC0 is about to be split from the API field. The docs say CC0. The GitHub API field was CC0-1.0, with 694 stars, pushed_at 2026-10-23T08:15:34Z, and archived false. No dollar was printed. A row is a lead for a defender. It is not confirmation the host still serves the page, and it is not a request to make.
Hard cases
The case where the first result is easy to over-read.
A lure from the table is republished
The morning count was 11 URLs. The values were phishing pages. Copying a hostname into a writeup publishes the lure again. Quote the count and the UTC window. Leave the string in the source table.
Questions
Is TweetFeed free?
The docs say everything is free, open and CC0. The GitHub API field on 23 Oct 2026 was CC0-1.0. No dollar price was printed. The repository had 694 stars and was not archived.
What did the live table count that morning?
From 00:41:55 UTC to 07:01:27 UTC on 23 Oct 2026, the page said 11 URLs, 11 domains, 1 IP, 2 SHA256, and 0 MD5. The URL values are not repeated here.
Citations
07
Titled sources. These public pages are what the quotes on this listing come from.
Product
TweetFeed homepage
https://tweetfeed.live/Documentation
TweetFeed docs
https://tweetfeed.live/docs/Documentation
TweetFeed repository
https://github.com/0xDanielLopez/TweetFeed