bots.st/ohey-research
Ohey research
Summarize threat pages and contract activity
1638 ms
answered our call
- State
- Answered
- Protocol
- MCP 2025-06-18
- Tools listed
- 8
- Answered
- 4 of the last 4 calls
How to reach it
- MCP, HTTP
https://ohey.ca/mcp/research
What it can do
| Tool | What it says it does |
|---|---|
get_article | One research article's summary, key facts (sample hashes, active window, scale) and its indicators of compromise section as Markdown, defanged as published. Read the page at url for the full write-up. |
get_etherhiding_contract | One contract's destinations over time, the contracts or endpoints it names next, and when Ohey first and last read it. Returns contracts as an array, one entry per chain the address is tracked on (usually one), each with history: its 20 most recent changes, and historyCapped is true only when… |
get_feed_stats | The size of the Ohey feed and the last seven full UTC days of changes to it, ending the day before asOf. hosts: hosts in the feed now. denied: hosts confirmed as legitimate services and kept out. week.added (and daily): hosts that entered the feed. week.entered: website tips that reached review… |
get_threat | A technique or kit page's statistics: sites matched by month, how many sites were still infected when rescanned, WordPress and Joomla shares, common plugins and core versions, kits seen together on the same sites, its EtherHiding contracts, the hosts its ClickFix commands fetch from (the 20 on the… |
list_research_articles | Ohey research articles, newest first: incident write-ups with timelines, code analysis and indicators. get_article returns one article's facts and indicators. |
list_threats | Every technique Ohey publishes, with its page, a summary, site counts and the slugs of its kits. get_threat on a technique lists its kits with names and site counts in one call. |
search_clickfix_commands | Hosts that ClickFix lure commands fetch from or report to, as the ClickFix command tracker lists them, busiest first or newest first: the kits credited with each (a ClickFix kit is credited when it is on at least half the sites whose command used the host), sites whose captured command used it… |
search_etherhiding_contracts | Smart contracts that compromised websites read their next stage from, as the EtherHiding contract tracker lists them: chain, kit, current destinations and when Ohey last read each one. firstSeen is the day Ohey first read the contract, not when it was deployed; many contracts share the day… |
In its maker's words
Web malware techniques, kits and EtherHiding contracts from Ohey's website scans. No sign-in.
- Website
- ohey.ca/threats
- Source
- github.com/Oheyresearch/ohey-mcp
- Publisher
- ohey.ca (2 listings in the registry)
- Listed from
- the official MCP Registry as
ca.ohey/research - Version
- 1.0.0, updated 4 Nov 2026
- Kinds of work
- Search and research, Security and trust
The domain it lives on
- ohey.ca
- registered 3 Jan 2024 (2 years ago), at CENTRALNIC CANADA INC, its name does not resolve now
From our own crawl of domain names: registry records and the home page as our crawler last saw it.
Every call we made
| When | What happened | Time |
|---|---|---|
| Answered | 1638 ms | |
| Answered | 878 ms | |
| Answered | 371 ms | |
| Answered | 371 ms |
Next door
Is this your bot? Claim its address to add a verified badge and keep the listing current.