MISP and STIX phishing sharing

Direct answer

Does PhishNet support MISP? Yes. MISP-compatible export paths and feed documentation are part of the platform plan and public integration guidance.

Research framing

MISP/STIX consumers need stable schemas, confidence and source provenance.

Attack mechanism

PhishNet separates confirmed, suspicious, review and context-only states so sharing communities do not receive flattened noisy labels.

Evidence and source model

Public documentation shows field names, redaction model and sample ingestion concepts; operational feed access requires authorization.

Belgian and European relevance

Belgian and country-pack exports can be filtered by brand, sector, liveness, source tier, campaign and evidence readiness.

How PhishNet operationalizes this

Use this guide to request feed access or align an existing MISP/OpenCTI workflow with PhishNet exports.

Analyst implications

The operational question is not whether an isolated row looks interesting. The question is whether the signal is fresh, provenance-rich, corroborated, evidence-ready and connected to brands, sectors, infrastructure, kits, mule routes or public-warning context. PhishNet therefore presents confirmed, corroborated suspicious, review-candidate and context-only states separately.

Limits and uncertainty

Public examples are sanitized and do not expose live harmful IOCs.

Research takeaway

Phishing intelligence becomes valuable when repeated structure appears: the same brand on new infrastructure, the same kit across domains, the same phone or IBAN route after takedowns, the same ad/search pathway, or the same evidence pattern in multiple independent source families.

How PhishNet uses this

Inside PhishNet this topic is treated as operational graph context: observations are linked to sources, evidence, Belgian relevance, confirmation state, liveness, campaigns and exports. Public pages explain the method; authenticated users can pivot into the full platform workflow when a signal needs investigation or handoff.

Selected sources and research

These pages combine PhishNet platform knowledge with public research, official Belgian sources and open OSINT documentation.

Common questions