ca.ohey/research · v1.0.0 · security
Ohey research is healthy: it completed an MCP handshake in 2854 ms and exposes 7 tools.
Web malware techniques, kits and EtherHiding contracts from Ohey's website scans. No sign-in.
Endpoint: https://ohey.ca/mcp/research (streamable-http)
Repository · Website · JSON · Add to my inventory
| Users (last 30 days) | 0 |
| Handshake | Healthy |
| Auth needed | None |
| Tool count | 7 |
| Latency | 2854 ms |
| Last checked (UTC) | 2026-11-04T14:40:29.602Z |
| Checked (UTC) | Status | Latency | Error |
|---|---|---|---|
| 2026-11-04T14:40:29.602Z | Healthy | 2854 |
list_threats | Every technique Ohey publishes, with its page, a summary, site counts and its kits. |
get_threat | A technique or kit page's statistics: sites matched by month, how many sites were still infected when rescanned, WordPress and Joomla shares, common plugins and core versions, kits seen together on the same sites, its EtherHiding contracts, the hosts its ClickFix commands download from (the 20 on th |
list_research_articles | Ohey research articles, newest first: incident write-ups with timelines, code analysis and indicators. |
search_etherhiding_contracts | Smart contracts that compromised websites read their next stage from, as the EtherHiding contract tracker lists them: chain, kit, current destinations and when Ohey last read each one. Set destination to find the contracts that point, or pointed, at a host. |
get_etherhiding_contract | One contract's destinations over time, the contracts or endpoints it names next, and when Ohey first and last read it. |
get_feed_stats | The size of the Ohey feed and the last seven full UTC days of changes to it, ending the day before asOf. hosts: hosts in the feed now. denied: hosts confirmed as legitimate services and kept out. week.added (and daily): hosts that entered the feed. week.entered: website tips that reached review. wee |
search_clickfix_commands | Hosts that ClickFix lure commands download from, as the ClickFix command tracker lists them, busiest first: the kits credited with each, sites whose captured command used it, first and last seen, and the latest URL and command, defanged. command is empty when the command assembles its host while it |