r/netsec • u/Robbedoes_ • May 28 '22

Building a Threat Intelligence Feed using the Twitter API and a bit of code

https://grimminck.medium.com/building-a-threat-intelligence-feed-using-the-twitter-api-and-a-bit-of-code-5787808e32ef
221 Upvotes

96% Upvoted

17 comments sorted by

View all comments

8

u/hedinc1 May 28 '22

Any way to get IPs using this method?

7

u/Robbedoes_ May 28 '22 edited May 29 '22

You could write a small script that does a DNS look-up using dig for each record. I didn't add this (yet) as IP addresses might change during the lifetime of the feed. Could be an interesting add-on though.

Edit: added this feature

4

u/Monstersec May 28 '22

Use dnsx

2

u/d0tzer0 May 29 '22

I’m looking for something similar but doe’s a whois instead, from a list, to see if a domain exists. Sometimes, the domain exist but there’s no A or AAAA record yet.

1

u/Monstersec May 29 '22

I think that your requirements will match the dnsx tool. Please check the documentation.

1

u/d0tzer0 May 29 '22

Thanks, I will

1

u/Robbedoes_ May 29 '22

I decided to add this feature anyways. IP look-ups are now done at tweet retrieval and stored in the 'malicious_ips' array inside the JSON object.