ca.ohey/research

up checked 2026-11-11T12:37:56.371Z

Unclaimed · Unverified

Publisher-provided title

Ohey research

Publisher-provided description

Web malware techniques, kits and EtherHiding contracts from Ohey's website scans. No sign-in.

Summary by lookupd

Query research on web malware, kits, ClickFix commands and EtherHiding smart contracts, with indicators of compromise and threat statistics.

Install

Claude Code, remote (streamable-http)

claude mcp add --transport http research https://ohey.ca/mcp/research

Codex, remote (streamable-http)

codex mcp add research --url https://ohey.ca/mcp/research

Cursor, remote (streamable-http) → .cursor/mcp.json

{
  "mcpServers": {
    "research": {
      "url": "https://ohey.ca/mcp/research"
    }
  }
}

Other clients: docs. Or tell your agent: Set up lookupd for me: read https://lookupd.com/agent.md and follow it.

Publisher-provided text

list_threats Every technique Ohey publishes, with its page, a summary, site counts and the slugs of its kits. get_threat on a technique lists its kits with names and site co
get_threat A technique or kit page's statistics: sites matched by month, how many sites were still infected when rescanned, WordPress and Joomla shares, common plugins and
list_research_articles Ohey research articles, newest first: incident write-ups with timelines, code analysis and indicators. get_article returns one article's facts and indicators.
get_article One research article's summary, key facts (sample hashes, active window, scale) and its indicators of compromise section as Markdown, defanged as published. Rea
search_etherhiding_contracts Smart contracts that compromised websites read their next stage from, as the EtherHiding contract tracker lists them: chain, kit, current destinations and when
get_etherhiding_contract One contract's destinations over time, the contracts or endpoints it names next, and when Ohey first and last read it. Returns contracts as an array, one entry
get_feed_stats The size of the Ohey feed and the last seven full UTC days of changes to it, ending the day before asOf. hosts: hosts in the feed now. denied: hosts confirmed a
search_clickfix_commands Hosts that ClickFix lure commands fetch from or report to, as the ClickFix command tracker lists them, busiest first or newest first: the kits credited with eac

Shows this live status and links here; updates hourly.

[![lookupd status](https://lookupd.com/badge/ca.ohey/research.svg)](https://lookupd.com/servers/ca.ohey/research)