{"id":19211543,"url":"https://github.com/pwrxpsycho/ttia","last_synced_at":"2025-07-26T09:15:07.980Z","repository":{"id":103438666,"uuid":"536850326","full_name":"PWRxPSYCHO/TTIA","owner":"PWRxPSYCHO","description":"  Twitter Threat Intel API:  API to parse through #opendir hashtag on Twitter to find malicious links and parse the data back to users.","archived":false,"fork":false,"pushed_at":"2023-03-15T13:00:13.000Z","size":35,"stargazers_count":0,"open_issues_count":1,"forks_count":0,"subscribers_count":1,"default_branch":"master","last_synced_at":"2025-02-23T07:44:07.402Z","etag":null,"topics":["cybersecurity","java","osint","twitter"],"latest_commit_sha":null,"homepage":"","language":"Java","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/PWRxPSYCHO.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2022-09-15T03:31:21.000Z","updated_at":"2022-09-15T13:59:21.000Z","dependencies_parsed_at":null,"dependency_job_id":"9c28ec23-c4b2-4e0f-a1f9-e0c69efd258c","html_url":"https://github.com/PWRxPSYCHO/TTIA","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/PWRxPSYCHO/TTIA","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PWRxPSYCHO%2FTTIA","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PWRxPSYCHO%2FTTIA/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PWRxPSYCHO%2FTTIA/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PWRxPSYCHO%2FTTIA/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/PWRxPSYCHO","download_url":"https://codeload.github.com/PWRxPSYCHO/TTIA/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PWRxPSYCHO%2FTTIA/sbom","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":267144598,"owners_count":24042639,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","status":"online","status_checked_at":"2025-07-26T02:00:08.937Z","response_time":62,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["cybersecurity","java","osint","twitter"],"created_at":"2024-11-09T13:42:45.963Z","updated_at":"2025-07-26T09:15:07.910Z","avatar_url":"https://github.com/PWRxPSYCHO.png","language":"Java","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Twitter Threat Intelligence API (TTIA)\n\nUsing the Twitter API and the #opendir hashtag we can use OSINT to help find malicious links out in the wild on specific websites. This API allows you to retrieve the most recent feed of tweets and will pull out the URL's, IP addresses, and usernames of those who found these phishing links.\n\n\n\n## Project Setup\n\nYou will need the following installed to use this project\n\n- Java 17\n- Maven\n- VSCode\n- The extensions listed in the `extensions.json` file.\n- Twitter API account\n\nIn the `resources/application.yml` add your bearer token to make the requests to the Twitter API\n```\ntoken:\n  bearer: BEARERTOKENGOESHERE\n```\n\nAfter you have that setup you will need to import the postman collection into postman in order to start making requests:\n\n`postman-collection/Twitter Threat Intelligence API (TTIA).postman_collection.json`\n\nIs located in the project for your convenience\n\n\n# Swagger\nOnce you have the application running you can view the response objects, errors, and templates on swagger's UI for API documentation.\n\n**http://localhost:8080/swagger-ui.html#/**\n\n# Get Users\n**http://localhost:8080/api/v1/tweets/users**\n\nThis api call will return the username's of all the users that posted in the last 100 entries of the feed.\n\nThe response will be:\n```json\n{\n    \"response\":[\n        \"username1\",\n        \"username2\"\n    ]\n}\n```\n\n# Get urls\n\n**http://localhost:8080/api/v1/tweets/urls**\n\nThis api call will return the formatted url's of the last 100 entries of the feed. The url's are usually inserted into Twitter with `hxxp://` and `hxxps://`. The API will convert them to `http://` and `https://` and remove any other link breaking format. \n\n**DO NOT CLICK THE LINKS IN THE RESPONSE THEY ARE MALICIOUS**\n\nThe response will be:\n```json\n{\n    \"response\":[\n        \"https://some.malicious.zip\",\n        \"http://some.malicous.zip\"\n    ]\n}\n```\n\n# Get malicious-ips\n\n**http://localhost:8080/api/v1/tweets/malicious-ips**\n\nThis api call will return the host and ip of the url's that were parsed from the Twitter feed. If it cannot find an ip or host it will not return a match and an error will be thrown server side.\n\nThe response will be:\n```json\n{\n    \"response\":[\n        \"host/ip\",\n        \"host/ip\"\n    ]\n}\n```\n\n# Get all-data\n**http://localhost:8080/api/v1/tweets/all-data**\n\nThis api call will return a combination of data from the twitter feed. You will know the username of who posted the tweet, when it was created, the id of the author, the malicious IP(s) with Host(s), the formatted URL(s), and then text of the tweet for the last 100 tweets.\n```json\n[\n  {\n        \"username\": \"Chris Bertsch\",\n        \"authorId\": 69097408,\n        \"maliciousIp\": [\n            \"bttechnology.art/198.54.115.184\"\n        ],\n        \"urls\": [\n            \"https://bttechnology.art/EMS-CI.zip\"\n        ],\n        \"tweetText\": \"RT @ecarlesi: Possible threat on hxxps://bttechnology[.]art/EMS-CI[.]zip #phishing #opendir  #nc\",\n        \"createdAt\": \"Tue Jun 07 23:46:38 +0000 2022\",\n        \"tweetUrl\": \"https://twitter.com/Malwar3Ninja/status/1534568419302854657\"\n    },\n]\n```\n\n# Get tweet-data\n**http://localhost:8080/api/v1/tweets/tweet-data**\n\nThis api call will return the Twitter API Search V1 response object. If you wanted to dig into the Twitter API and get all the information of the tweets.\n\nThe response will be:\n```json\n{\n         \"data\": [\n        {\n            \"created_at\": \"Wed Jun 08 12:56:42 +0000 2022\",\n            \"id\": 1534519789791502337,\n            \"id_str\": \"1534519789791502337\",\n            \"text\": \"RT @Malwar3Ninja: [https://t.co/otlIKKaN3I]🌀⚡Our proactive hunter detected #Opendir hosting multiple malicious files at 3.144[.]124[.]4\\n\\n#t…\",\n            \"truncated\": false,\n            \"entities\": {\n                \"hashtags\": [\n                    {\n                        \"text\": \"Opendir\",\n                        \"indices\": [\n                            75,\n                            83\n                        ]\n                    }\n                ],\n                \"symbols\": [],\n                \"user_mentions\": [\n                    {\n                        \"screen_name\": \"Malwar3Ninja\",\n                        \"name\": \"Malwar3Ninja | Threatview.io 💻\",\n                        \"id\": 953204257171238917,\n                        \"id_str\": \"953204257171238917\",\n                        \"indices\": [\n                            3,\n                            16\n                        ]\n                    }\n                ],\n                \"urls\": [\n                    {\n                        \"url\": \"https://t.co/otlIKKaN3I\",\n                        \"expanded_url\": \"http://Threatview.io\",\n                        \"display_url\": \"Threatview.io\",\n                        \"indices\": [\n                            19,\n                            42\n                        ]\n                    }\n                ]\n            },\n            \"metadata\": {\n                \"iso_language_code\": \"en\",\n                \"result_type\": \"recent\"\n            },\n            \"source\": \"\u003ca href=\\\"http://twitter.com/download/iphone\\\" rel=\\\"nofollow\\\"\u003eTwitter for iPhone\u003c/a\u003e\",\n            \"in_reply_to_status_id\": null,\n            \"in_reply_to_status_id_str\": null,\n            \"in_reply_to_user_id\": null,\n            \"in_reply_to_user_id_str\": null,\n            \"in_reply_to_screen_name\": null,\n            \"user\": {\n                \"id\": 1439416397038194696,\n                \"id_str\": \"1439416397038194696\",\n                \"name\": \"104shit\",\n                \"screen_name\": \"1o4shit\",\n                \"location\": \"\",\n                \"description\": \"\",\n                \"url\": null,\n                \"entities\": {\n                    \"description\": {\n                        \"urls\": []\n                    }\n                },\n                \"userProtected\": false,\n                \"followers_count\": 12,\n                \"friends_count\": 227,\n                \"listed_count\": 0,\n                \"created_at\": \"Sun Sep 19 02:29:56 +0000 2021\",\n                \"favourites_count\": 47,\n                \"utc_offset\": null,\n                \"time_zone\": null,\n                \"geo_enabled\": false,\n                \"verified\": false,\n                \"statuses_count\": 1085,\n                \"lang\": null,\n                \"contributors_enabled\": false,\n                \"profile_background_color\": \"F5F8FA\",\n                \"profile_background_image_url\": null,\n                \"profile_background_image_url_https\": null,\n                \"profile_background_tile\": false,\n                \"profile_image_url\": \"http://pbs.twimg.com/profile_images/1506195727881752580/mSurW9JP_normal.jpg\",\n                \"profile_image_url_https\": \"https://pbs.twimg.com/profile_images/1506195727881752580/mSurW9JP_normal.jpg\",\n                \"profile_banner_url\": null,\n                \"profile_link_color\": \"1DA1F2\",\n                \"profile_sidebar_border_color\": \"C0DEED\",\n                \"profile_sidebar_fill_color\": \"DDEEF6\",\n                \"profile_text_color\": \"333333\",\n                \"profile_use_background_image\": true,\n                \"has_extended_profile\": true,\n                \"default_profile\": true,\n                \"default_profile_image\": false,\n                \"following\": null,\n                \"follow_request_sent\": null,\n                \"notifications\": null,\n                \"translator_type\": \"none\",\n                \"withheld_in_countries\": [],\n                \"_translator\": false,\n                \"_translation_enabled\": false\n            },\n            \"geo\": null,\n            \"coordinates\": null,\n            \"place\": null,\n            \"contributors\": null,\n            \"retweeted_status\": {\n                \"created_at\": \"Tue Jun 07 17:27:11 +0000 2022\",\n                \"id\": 1534225470647963648,\n                \"id_str\": \"1534225470647963648\",\n                \"text\": \"[https://t.co/otlIKKaN3I]🌀⚡Our proactive hunter detected #Opendir hosting multiple malicious files at 3.144[.]124[.… https://t.co/E8MpL5Cu1b\",\n                \"truncated\": true,\n                \"entities\": {\n                    \"hashtags\": [\n                        {\n                            \"text\": \"Opendir\",\n                            \"indices\": [\n                                57,\n                                65\n                            ]\n                        }\n                    ],\n                    \"symbols\": [],\n                    \"user_mentions\": [],\n                    \"urls\": [\n                        {\n                            \"url\": \"https://t.co/otlIKKaN3I\",\n                            \"expanded_url\": \"http://Threatview.io\",\n                            \"display_url\": \"Threatview.io\",\n                            \"indices\": [\n                                1,\n                                24\n                            ]\n                        },\n                        {\n                            \"url\": \"https://t.co/E8MpL5Cu1b\",\n                            \"expanded_url\": \"https://twitter.com/i/web/status/1534225470647963648\",\n                            \"display_url\": \"twitter.com/i/web/status/1…\",\n                            \"indices\": [\n                                117,\n                                140\n                            ]\n                        }\n                    ]\n                },\n                \"metadata\": {\n                    \"iso_language_code\": \"en\",\n                    \"result_type\": \"recent\"\n                },\n                \"source\": \"\u003ca href=\\\"http://twitter.com/download/android\\\" rel=\\\"nofollow\\\"\u003eTwitter for Android\u003c/a\u003e\",\n                \"in_reply_to_status_id\": null,\n                \"in_reply_to_status_id_str\": null,\n                \"in_reply_to_user_id\": null,\n                \"in_reply_to_user_id_str\": null,\n                \"in_reply_to_screen_name\": null,\n                \"user\": {\n                    \"id\": 953204257171238917,\n                    \"id_str\": \"953204257171238917\",\n                    \"name\": \"Malwar3Ninja | Threatview.io 💻\",\n                    \"screen_name\": \"Malwar3Ninja\",\n                    \"location\": \"Threatview.io\",\n                    \"description\": \"Malware Hunter | ⚡🆓Threat Intelligence: https://t.co/aidnL0GBmB | Member @CuratedIntel | Cyber Defense | DFIR | Views are personal | Retweet≠endorsement | 🍺🥃\u0026 Cigar\",\n                    \"url\": \"https://t.co/KhCapBTyYQ\",\n                    \"entities\": {\n                        \"url\": {\n                            \"urls\": [\n                                {\n                                    \"url\": \"https://t.co/KhCapBTyYQ\",\n                                    \"expanded_url\": \"https://Threatview.io\",\n                                    \"display_url\": \"Threatview.io\",\n                                    \"indices\": [\n                                        0,\n                                        23\n                                    ]\n                                }\n                            ]\n                        },\n                        \"description\": {\n                            \"urls\": [\n                                {\n                                    \"url\": \"https://t.co/aidnL0GBmB\",\n                                    \"expanded_url\": \"http://Threatview.io\",\n                                    \"display_url\": \"Threatview.io\",\n                                    \"indices\": [\n                                        40,\n                                        63\n                                    ]\n                                }\n                            ]\n                        }\n                    },\n                    \"userProtected\": false,\n                    \"followers_count\": 1651,\n                    \"friends_count\": 2487,\n                    \"listed_count\": 28,\n                    \"created_at\": \"Tue Jan 16 09:56:19 +0000 2018\",\n                    \"favourites_count\": 2209,\n                    \"utc_offset\": null,\n                    \"time_zone\": null,\n                    \"geo_enabled\": false,\n                    \"verified\": false,\n                    \"statuses_count\": 2006,\n                    \"lang\": null,\n                    \"contributors_enabled\": false,\n                    \"profile_background_color\": \"F5F8FA\",\n                    \"profile_background_image_url\": null,\n                    \"profile_background_image_url_https\": null,\n                    \"profile_background_tile\": false,\n                    \"profile_image_url\": \"http://pbs.twimg.com/profile_images/953223267715813381/roa9gsRe_normal.jpg\",\n                    \"profile_image_url_https\": \"https://pbs.twimg.com/profile_images/953223267715813381/roa9gsRe_normal.jpg\",\n                    \"profile_banner_url\": \"https://pbs.twimg.com/profile_banners/953204257171238917/1625323414\",\n                    \"profile_link_color\": \"1DA1F2\",\n                    \"profile_sidebar_border_color\": \"C0DEED\",\n                    \"profile_sidebar_fill_color\": \"DDEEF6\",\n                    \"profile_text_color\": \"333333\",\n                    \"profile_use_background_image\": true,\n                    \"has_extended_profile\": false,\n                    \"default_profile\": true,\n                    \"default_profile_image\": false,\n                    \"following\": null,\n                    \"follow_request_sent\": null,\n                    \"notifications\": null,\n                    \"translator_type\": \"none\",\n                    \"withheld_in_countries\": [],\n                    \"_translator\": false,\n                    \"_translation_enabled\": false\n                },\n                \"geo\": null,\n                \"coordinates\": null,\n                \"place\": null,\n                \"contributors\": null,\n                \"retweet_count\": 17,\n                \"favorite_count\": 33,\n                \"favorited\": false,\n                \"retweeted\": false,\n                \"lang\": \"en\",\n                \"_quote_status\": false\n            },\n            \"retweet_count\": 17,\n            \"favorite_count\": 0,\n            \"favorited\": false,\n            \"retweeted\": false,\n            \"lang\": \"en\",\n            \"_quote_status\": false\n        }\n    ]\n}\n\n```","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fpwrxpsycho%2Fttia","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fpwrxpsycho%2Fttia","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fpwrxpsycho%2Fttia/lists"}