---
title: "STIX 2.1 bundle"
method: GET
path: "/stix/bundle.json"
---

# STIX 2.1 bundle

`GET /stix/bundle.json`

## Request

- Base URL: `https://phishunt.io`
- URL: `https://phishunt.io/stix/bundle.json`
- Auth: none declared

The active suspicious phishing feed as a STIX 2.1 Bundle: one `identity` object for phishunt, the OASIS TLP:CLEAR marking-definition, and one `indicator` per active detection (`[domain-name:value = '...']` pattern). Updated every hour, same cadence and cache TTL as `/feed.json`.
Each indicator's `confidence` is derived directly from that detection's own `score` (see the `Site.score` description) - it is never a constant across indicators, unlike feeds that hardcode one confidence value for every entry.

## Response `200`

STIX 2.1 Bundle object.

- StixBundle: STIX 2.1 Bundle (https://docs.oasis-open.org/cti/stix/v2.1/os/stix-v2.1-os.html).
  - `type` 'bundle'
  - `id` string
  - `objects` union[]
    - union
      - StixIdentity: Single object in every bundle, identifying phishunt as the producer.
        - `type` 'identity'
        - `id` string
        - `name` string
        - `identity_class` 'organization'
      - StixMarkingDefinition: Single object in every bundle: the OASIS canonical TLP:CLEAR marking-definition (TLP 2.0), embedded verbatim.
        - `type` 'marking-definition'
        - `id` string
        - `name` 'TLP:CLEAR'
      - StixIndicator: One per active detection.
        - `type` 'indicator'
        - `id` string
        - `created` string, date-time
        - `modified` string, date-time
        - `valid_from` string, date-time
        - `name` string: The detected domain.
        - `description` string
        - `indicator_types` string[]
        - `pattern` string: STIX Pattern Grammar expression.
        - `pattern_type` 'stix'
        - `confidence` integer: Derived directly from this detection's own `score` (see the `Site.score` field) - never a constant across indicators. OPTIONAL: the property is omitted entirely when no usable score exists for the row, rather than emitted as 0. STIX reads `confidence: 0` as an assertion that the producer disbelieves its own indicator, which is a different and stronger claim than having no score. Absent means unspecified.
        - `labels` string[]: The impersonated brand slug, when known.
        - `created_by_ref` string: References the bundle's StixIdentity object.
        - `object_marking_refs` string[]
        - `external_references` object[]
          - `source_name` string
          - `url` string
          - `description` string

---

[API](https://skmtc.dev/phishunt/apis/phishunt-api.md) · [All operations](https://skmtc.dev/phishunt/apis/phishunt-api/llms.txt) · [OpenAPI document](https://skmtc.dev/phishunt/apis/phishunt-api/revisions/0e07c255f282?raw)