It appears that some URLs are cut off by Twitter. You might have to add some code to expand those URLs.
For example: https://xunmaus.xn--rvg
In the meantime, I'm using a modified command like so: `curl https://twitter.threatintel.rocks/ --silent | jq -r '.malicious_urls | .[]' | sort -u | grep -v …`
It seems this is only the case if it's a tweet that contains a retweet. These are now removed from the stream as they're not of relevance.