Categories › Security › Pentest & threat intel
Web malware techniques, kits and EtherHiding contracts from Ohey's website scans. No sign-in.
Remote server: your requests and data go to ohey.ca. Claude Code: claude mcp add --transport http ohey-research https://ohey.ca/mcp/research · Claude app: Settings → Connectors → Add custom connector.
The tools this server listed when we connected to it, in its own words.
list_threats — Every technique Ohey publishes, with its page, a summary, site counts and the slugs of its kits. get_threat on a technique lists its kits wiget_threat — A technique or kit page's statistics: sites matched by month, how many sites were still infected when rescanned, WordPress and Joomla shareslist_research_articles — Ohey research articles, newest first: incident write-ups with timelines, code analysis and indicators. get_article returns one article's facget_article — One research article's summary, key facts (sample hashes, active window, scale) and its indicators of compromise section as Markdown, defangsearch_etherhiding_contracts — Smart contracts that compromised websites read their next stage from, as the EtherHiding contract tracker lists them: chain, kit, current deget_etherhiding_contract — One contract's destinations over time, the contracts or endpoints it names next, and when Ohey first and last read it. Returns contracts as get_feed_stats — The size of the Ohey feed and the last seven full UTC days of changes to it, ending the day before asOf. hosts: hosts in the feed now. deniesearch_clickfix_commands — Hosts that ClickFix lure commands fetch from or report to, as the ClickFix command tracker lists them, busiest first or newest first: the kiNot tested by KitScout yet. When our harness runs it, pros, cons and the tasks we tried appear here, with the date and evidence.