Skip to content
ClickFixReport
Every ClickFix campaign, on the record.

Machine-readable

Data and bulk exports

Every assessed indicator, free, under CC BY 4.0. No key, no sign-up, no rate limit on these files — they are static and served from a CDN. Attribution is the only condition.

Indicators in the export
725
In the blocklist file
512

725 of the 1359 indicators on record. The other 634 have no ownership assessment yet and are excluded from every file. 367 of those are file hashes and filenames, which are excluded by their nature rather than pending: ownership says who controls a host, and a file does not have one. There are no hashes in these exports.

The files

  • Assessed indicators, as CSV

    /export/v1/indicators.csv

    Every indicator whose ownership we have assessed, with its type, registrable domain, ownership classification, first and last seen dates, and how many published sources reported it.

  • Assessed indicators, as JSON

    /export/v1/indicators.json

    The same rows, with the licence and attribution in the envelope.

  • Attacker-controlled hosts only

    /export/v1/domains.txt

    One host per line — domains and bare IP addresses — for feeding into a resolver or firewall. Deliberately much narrower than the CSV — see the warning below.

Read this before you block anything

Most hosts serving ClickFix lures are compromised legitimate websites — typically a small business running an out-of-date plugin. Their owners are victims. indicators.csv tells you which is which, in the ownership column.

domains.txt contains only hosts classified as attacker_controlled, and hosts we have not assessed are excluded from every export entirely. If you build your own list from the CSV, filter on that column. Null-routing a bakery’s website because it was hacked is not defence, it is a second incident.

Versioning

Export URLs are versioned. The shape of a /export/v1/ file will not change — a new column means a v2, never an edit to v1 — because these get pasted into config files and cron jobs and never looked at again. /export/{file} without a version redirects to the current one.

Citing this

ClickFixReport, ClickFix campaign indicator record, https://clickfixreport.com/export, CC BY 4.0. Dated snapshots with a commit hash are planned for the clickfixreport-data repository, so that a citation will be able to point at the exact state of the record on a given day rather than at whatever it says today. Nothing has been published there yet.