unbound.conf

<div align="center">
    <h1 align="center">TweetFeed</h1>
    <h3 align="center">Feeds of IOCs posted by the community on Twitter/X</h3>

<p align="center">
    <b>
    <a href="https://tweetfeed.live">TweetFeed.live</a>&nbsp;&nbsp;&nbsp;|&nbsp;&nbsp;&nbsp;
    <a href="https://tweetfeed.live/docs/">Docs</a>&nbsp;&nbsp;&nbsp;|&nbsp;&nbsp;&nbsp;
    <a href="https://api.tweetfeed.live/v1">API</a>&nbsp;&nbsp;&nbsp;|&nbsp;&nbsp;&nbsp;
    <a href="https://github.com/0xDanielLopez/TweetFeed/issues/new/choose">Feedback</a>
    </b>
</p>

---

  ![TweetFeed.live](https://raw.githubusercontent.com/0xDanielLopez/TweetFeed/master/assets/tweetfeed.png)

---
</div>

## ☰ Content

- [Consuming this data](#satellite-consuming-this-data)
- [Data collected](#page_facing_up-data-collected)
- [Programmatic access](#gear-programmatic-access)
- [Some statistics](#bar_chart-some-statistics)
- [How it works](#question-how-it-works)
- [Use TweetFeed in your stack](#mag-use-tweetfeed-in-your-stack)
- [Agent-ready surface](#robot-agent-ready-surface)
- [License](#balance_scale-license)
- [Author](#bust_in_silhouette-author)
- [Disclaimer](#pushpin-disclaimer)

> The counters below (timestamp, per-type totals, tag count, top tags, top reporters) are regenerated by the pipeline every 15 minutes. Hand-written sections are stable.

## :satellite: Consuming this data

- **Please do not clone or poll this repository to keep a feed fresh.** The same data is served with conditional requests from the API and the ready-made files: JSON windows at [`api.tweetfeed.live/v1/today`](https://api.tweetfeed.live/v1/today) (`week`, `month`, type/tag/user filters), [blocklists](https://tweetfeed.live/blocklists/) (`domains.txt`, `ips.txt`, `urls.txt`, `hosts.txt`, `adguard.txt`, `rpz.txt`, `zeek-intel.txt`, Wazuh CDB lists...), [TAXII 2.1 / STIX 2.1](https://tweetfeed.live/feeds/#stix), the [MISP feed](https://tweetfeed.live/feeds/#misp) and [RSS](https://tweetfeed.live/rss.xml).
- **Poll at most every 15 minutes** (the pipeline publishes every 15 minutes) and send `If-None-Match` (ETag) or `If-Modified-Since`: every `200` response carries `ETag` and `Last-Modified`, and an unchanged file answers `304` with an empty body.
- **If you really need a local copy**: the history of this repository is rewritten once a day (single-commit snapshot), so a plain `git pull` breaks daily. Use `git clone --depth 1 --filter=blob:none https://github.com/0xDanielLopez/TweetFeed.git` and refresh with `git fetch --depth 1 origin master && git reset --hard origin/master`, never more often than every 15 minutes.
- **Freshness**: [`/v1/status`](https://api.tweetfeed.live/v1/status) gives a verdict per artifact and [`/v1/manifest`](https://api.tweetfeed.live/v1/manifest) lists every published file.

## :heart: Support the project
If you like the project, please consider:
- Giving it a star :star:
- Invite to a [coffee](https://www.buymeacoffee.com/dlopez) :coffee:

## :page_facing_up: Data collected
<div align="center">

<h3>CSV feeds</h3>

<table>
    <thead>
    </thead>
    <tbody>
    <tr>
        <th colspan=4>2026-10-14 06:30:20 (UTC)</th>
    </tr>
    <tr>
            <th>Today</th>
            <th>Last 7 days</th>
            <th>Last 30 days</th>
            <th>Last 365 days</th>
    </tr>
    <tr>
            <td>:clipboard: <a href="https://github.com/0xDanielLopez/TweetFeed/blob/master/today.csv">Today</a> (<a href="https://raw.githubusercontent.com/0xDanielLopez/TweetFeed/master/today.csv">raw</a>)</td>
            <td>:clipboard: <a href="https://github.com/0xDanielLopez/TweetFeed/blob/master/week.csv">Week</a> (<a href="https://raw.githubusercontent.com/0xDanielLopez/TweetFeed/master/week.csv">raw</a>)</td>
            <td>:clipboard: <a href="https://github.com/0xDanielLopez/TweetFeed/blob/master/month.csv">Month</a> (<a href="https://raw.githubusercontent.com/0xDanielLopez/TweetFeed/master/month.csv">raw</a>)</td>
            <td>:clipboard: <a href="https://github.com/0xDanielLopez/TweetFeed/blob/master/year.csv">Year</a> (<a href="https://raw.githubusercontent.com/0xDanielLopez/TweetFeed/master/year.csv">raw</a>)</td>
     </tr>
    </tbody>
</table>

<h3>Other formats</h3>

<table>
    <thead>
        <tr>
            <th>Format</th>
            <th>URL</th>
            <th>Notes</th>
        </tr>
    </thead>
    <tbody>
        <tr>
            <td><b>RSS 2.0</b></td>
            <td><a href="https://raw.githubusercontent.com/0xDanielLopez/TweetFeed/master/rss.xml">rss.xml</a></td>
            <td>Today's IOCs (regenerated every 15 min)</td>
        </tr>
        <tr>
            <td><b>MISP</b></td>
            <td><a href="https://raw.githubusercontent.com/0xDanielLopez/TweetFeed/master/misp/manifest.json">misp/manifest.json</a></td>
            <td>One event per day, 365 days of history. In MISP's default feed list since 2.5.47 (<i>Sync Actions &rarr; List Feeds &rarr; Load default feed metadata</i>, then enable TweetFeed); on older versions add

... (truncated)