STIX
STIX (Structured Threat Information Expression) is the OASIS JSON standard for sharing threat intelligence such as indicators, malware and campaigns between tools.
How it works
A STIX 2.1 bundle contains objects (indicator, domain-name, url, malware, relationship) with identifiers and timestamps. TAXII is the companion protocol for exchanging bundles.
PhishDestroy publishes its phishing-domain feed as a STIX 2.1 bundle next to JSON and MISP formats.
How to protect yourself
- Import STIX feeds into a TIP or SIEM instead of copying indicators by hand.
- Keep valid_from and valid_until so stale indicators expire.