Data and downloads
Indicators can be downloaded in bulk in four areas: remote workers (20,059), espionage (5,621), PolinRider repositories (2,451) and EtherHiding (463).
Files
| File | Format | Records |
|---|---|---|
| /assets/data/ioc-index.csv | CSV | Remote workers only (20,059). See CSV columns. |
| /assets/data/ioc-index-type.csv | CSV | One file per indicator type; see files by type. |
| /assets/data/ioc-index.json | JSON | Remote workers, espionage and PolinRider (28,131). See JSON keys. |
| /assets/data/ioc-search.json | JSON | Records without contexts. |
| /assets/data/ioc-contexts.json | JSON | The contexts table alone. |
| /assets/data/repo-scanner-index.json | JSON | Scan rules and compromised repositories (3,304). |
| /feed.xml | Atom | Profiles and hunts; no indicators. |
| /sitemap.xml | XML sitemap index | Every page address. |
| /license.txt | Text | Licence terms; see below. |
EtherHiding records have no bulk file; use the watchlist table. Every record has a page under Browse indicators.
When the files change
Files are regenerated on each build. The JSON files carry a
generated_at timestamp, currently
2026-11-13T04:32:58Z.
The CSV files carry no date.
CSV columns
One row per indicator. Cells that read as formulas are prefixed with an apostrophe.
| Column | Meaning |
|---|---|
value | The normalised indicator. |
ioc_type | The type, such as email_address. |
persona | The fabricated identity the value was filed under. |
account_status | live, removed or recycled for a checked account. See account status. |
network | The network kind or VPN provider, for a looked-up IP address. See network kinds. |
campaigns | The tagged activity clusters, joined with ; . |
first_seen | The earliest citing-source date. |
last_seen | The latest citing-source date. |
provenance | How the value reached the index, as a code. See provenance labels. |
model | The extracting model, for llm provenance. |
source_urls | The citing sources, joined with | . |
source_titles | Their titles, in the same order. |
context | The passage around the value in each source. |
Files by type
The same columns, one file per type for remote workers:
ip address (9,279) email address (5,252) github profile (2,005) npm package (718) alias (681) file hash (357) wallet address (278) linkedin profile (182) phone number (170) telegram account (155) malicious repository (136) domain (124) hosted site (119) x account (97) gitlab account (85) payload url (54) username (54) devto account (50) dockerhub account (36) medium account (25) filename (19) skype account (18) huggingface account (17) asn (12) calendly account (12) freelancer account (11) codesandbox account (8) keybase account (8) personal site (8) ens name (7) trello account (7) discord account (6) fiverr account (6) torre account (5) xing account (5) facebook account (4) laborx account (4) pypi package (4) remoteok account (4) freelancermap account (3) himalayas account (3) instagram account (3) stackoverflow account (3) linktree account (2) quora account (2) remotehub account (2) upwork account (2) web3career account (2) chrome extension (1) cryptojobs account (1) cryptojobslist account (1) devpost account (1) entre account (1) f6s account (1) github dork (1) hashnode account (1) klimbup account (1) odnoklassniki account (1) peerlist account (1) producthunt account (1) useme account (1) wantedly account (1) youtube account (1)
JSON keys
ioc-index.json and repo-scanner-index.json share one compact shape. The top level holds:
v, the format version (currently 2), andgenerated_at;- the lookup tables
types,methods,sourcesandcontexts, referred to by position; records, with the keys below; absent values arenull.
| Key | Meaning |
|---|---|
i | The record id. |
t | Position in types. |
v | The normalised value. |
d | The value as printed, where it differs. |
r | The area, such as remote-workers. |
p | The persona name. |
h | The persona page slug, for a single persona. |
c | Reserved; empty. |
k | The activity clusters, as a list. |
e | Position in methods. |
g | 1 if found in the source text, otherwise 0. |
m | live or removed, for a checked repository or package. |
a | For a checked account, its state and checked date. |
n | For an IP address, the network kind and its label. |
w | For an email address, the reported password and reuse-group id. |
f, l | First and last seen. |
rr, rk | For a value no dated source names: the creation date of the account, or of the persona's LinkedIn or GitHub account (rk is linkedin or github), else the day this site first recorded it. The Report date column shows which. |
s | The citations, each a list of source position, context position, retrieval date, section heading and passage origin. |
ioc-search.json omits contexts and any key that is
null, 0, an empty list or an r of
remote-workers; a missing key means that value.
ioc-contexts.json holds only v, generated_at and
contexts.
STIX 2.1, MISP and other result downloads
The indicator searches on Remote Workers, each cluster page and the Repo Scanner download current results as STIX 2.1, MISP, CSV, text or JSON. These files are built in the browser and have no fixed address.
Licence, marking and citation
Prose and data are licensed under CC BY 4.0 and code under the MIT licence. Photographs and quoted vendor passages remain with their publishers; see the licence file.
Indicators are marked TLP:CLEAR; CSV and JSON files carry no marking.
Suggested citation: Chollima Hunter, "Data and downloads", https://chollimahunter.github.io/data/, accessed 28 September 2026.
What the data is not
The files are not a blocklist to apply unreviewed: many indicators are shared infrastructure or belong to people whose identities were stolen. See If you find a match first.