Chollima Hunter

Submit IOC/Profile

Send an indicator, a profile lead, a correction or removal request, or a tip by email. Every submission is reviewed manually; nothing is published automatically. If you are listed, see If you are listed on this site.

A submission is an ordinary email to chollimahunter@gmail.com; it never passes through the site.

Email your submission

The link opens your mail client with the template below filled in.

What not to send Do not attach malware; send the file hash and a link to published analysis. Do not include other people’s personal data beyond what identifies the entry. Email is not confidential.
Email template 
Submission type (New IOC / New Profile / Correction or removal request / General tip):

Your contact (optional, only used to follow up on this submission):

Description (what you're submitting, and why you believe it's DPRK-linked):


--- If this is a new IOC, also fill in ---
Indicator type (email address, phone number, GitHub, LinkedIn or other
platform account, persona name, npm or PyPI package, file hash, domain, IP
address, wallet or smart contract address, or other):
Indicator value:
Associated campaign/cluster (if known):

--- If this is a correction or removal request, also fill in ---
Page address:
What is wrong, or why the entry concerns your own identity:
Public record supporting the correction (if any):
--- If this is a new profile lead, also fill in ---
Subject name / known aliases:
Alleged activity:
Links to supporting public sources (one per line; required for any claim
about a named person):
New profile leads

A claim about a named individual needs a public source, such as an indictment, sanctions designation, press release or named threat-intelligence report. Without one it will not be published.