Ohey research

ca.ohey由 ohey.ca 發布官方發布者v1.0.0更新於 Nov 4, 2026

Web malware techniques, kits and EtherHiding contracts from Ohey's website scans. No sign-in.

發布方自己的服務：Ohey

已驗證Streamable HTTP可網頁執行網頁搜尋與抓取安全與監控

概覽

AI 產生的概覽

Ohey 公開研究伺服器：可瀏覽其網站掃描所得的網頁惡意軟體手法、工具包、EtherHiding 合約與 ClickFix 主機。

可以做什麼
  • 列出並檢視惡意軟體手法與工具包，含網站計數、逐月符合數、CMS 佔比、常見外掛及相關工具包
  • 依時間倒序閱讀 Ohey 研究文章，包括事件時間軸與指標
  • 依工具包、鏈或目標主機搜尋並檢視 EtherHiding 智慧合約及其目標變化歷程
  • 搜尋 ClickFix 指令主機，依活躍度排序，含歸屬工具包、首次與最後出現時間，以及去活化的 URL 與指令
  • 讀取資料來源統計：目前主機數、已排除主機，以及最近七個完整 UTC 日的新增情形
適用情境
適合需要說明或研判 ClickFix、EtherHiding、網頁側錄程式、釣魚工具包等網頁注入活動的情況，或需要引用 Ohey 公布的統計與文章時。它提供唯讀研究資料，不提供單一主機即時查詢或掃描服務。
執行需求
遠端 Streamable HTTP 端點 ohey.ca/mcp/research，不需登入、API 金鑰或本機執行環境。單一主機查詢、資料來源搜尋與 URL 掃描位於另一個 Ohey 伺服器，需要具備 API 權限的 Ohey 帳號。
安裝前請注意
合約目標與 ClickFix 指令主機是活躍的惡意基礎設施，已用 [.] 和 hxxp 去活化；請勿開啟、還原或執行。計數為自 recordsBegin 起的網站符合數，引用數字時應附上頁面 URL。另一個資料來源伺服器在登入時會建立 API 金鑰，並依金鑰計算呼叫次數。

安裝

在 SourceWeft 中

  1. 開啟 儀表板中的 Ohey research，將其新增到工作區。
  2. 為需要使用其工具的對話啟用該服務。

Web executable，透過 Streamable HTTP。 遠端服務在工作區中設定後即可從網頁執行環境執行。

交給代理程式安裝

把這段提示詞貼上到 Claude Code、Codex、Cursor 等代理程式，或 SourceWeft 對話中。代理程式會讀取該伺服器的安裝指南，先向你展示發布者、端點和登入方式，經你同意後再把它新增到你的客戶端。金鑰不會寫進任何命令。

閱讀 https://sourceweft.com/mcp/ca.ohey%2Fresearch/install.md，並按其中說明把這個 MCP 伺服器接入我的客戶端。修改任何設定之前，先告訴我它的發布者、端點和登入方式，等我確認。不要把 API 金鑰寫進命令或我會提交的檔案；問我金鑰應從哪裡取得。

檢視代理程式所依據的安裝指南

其他 MCP 客戶端

把它新增到你客戶端的 mcpServers 設定中。

{
  "mcpServers": {
    "ohey-research": {
      "type": "http",
      "url": "https://ohey.ca/mcp/research"
    }
  }
}

README

Ohey MCP servers

Ohey scans websites for injected malware: ClickFix and fake update lures, skimmers, phishing kits, EtherHiding loaders, and the C2 and distribution servers behind them. There are two remote MCP servers (Streamable HTTP).

ServerURLSign-in
Researchhttps://ohey.ca/mcp/researchNone
Feed and APIhttps://ohey.ca/mcpOhey account with API access

Research server

The research Ohey publishes on ohey.ca/threats, as tools. Anyone can connect.

ToolWhat it does
list_threatsEvery technique, with its page, a summary, site counts and its kits.
get_threatA technique or kit: sites matched by month, how many were still infected when rescanned, WordPress and Joomla shares, common plugins, kits seen on the same sites, its EtherHiding contracts and articles.
list_research_articlesResearch articles, newest first.
search_etherhiding_contractsContracts that compromised sites read their next stage from, by kit, chain or destination host.
get_etherhiding_contractOne contract's destinations over time.
get_feed_statsFeed size, last week's additions and removals, and the capture archive.

Counts update daily from Ohey's scans.

Claude Code:

bash
claude mcp add --transport http ohey-research https://ohey.ca/mcp/research

Feed and API server

Ohey's API as tools: look up any host, search the feed, read CVEs and scan URLs. You sign in with your Ohey account, so there is no API key to copy. Ask for an account with API access at ohey.ca/contact.

Connect

Claude: Settings, Connectors, Add custom connector, then paste the URL.

Claude Code:

bash
claude mcp add --transport http ohey https://ohey.ca/mcp

Other clients: add https://ohey.ca/mcp as a remote MCP server. The client finds the sign-in pages from the server's OAuth metadata and registers itself.

Signing in opens ohey.ca. Approve the connection there and the client gets access.

Tools

ToolWhat it does
search_indicatorsHosts in the feed, filtered by tag or family, with roles, families, tags and the reason each was admitted.
get_hostA host's feed entry, vulnerable software from its latest capture, its captures summary and DNS records.
get_host_capturesEach time the scanner loaded the host: when, what it returned and what matched.
list_delistedHosts that review excluded or took out of the feed, with the reason and who decided.
get_vulnerabilityOne CVE with its NVD, EPSS, KEV, GitHub and OSV data.
list_vulnerabilitiesPublished CVEs in order, or only WordPress plugin, theme and core CVEs.
start_scanLoads a URL in Ohey's scanner and records what it finds.
get_scanThe scan result: whether the page is malicious, what matched, commands and clipboard writes it tried to plant, and suspected C2.

The scan tools appear only when you tick "Scan URLs" while approving. Scans count against your account.

Access and revoking it

Approving a client creates an API key named after it, under Account in the Ohey portal. Tool calls are rate limited and counted against that key like any API request. Revoke the key to disconnect the client.

The full API, with every response field, is documented at ohey.ca/docs.

Security

Report security issues to [email protected]. See security.txt.

來源：README.md，提交 0990eda

工具

7

list_threats

List techniques

Every technique Ohey publishes, with its page, a summary, site counts and its kits.

無需輸入參數。

get_threat

Get a technique or kit

A technique or kit page's statistics: sites matched by month, how many sites were still infected when rescanned, WordPress and Joomla shares, common plugins and core versions, kits seen together on the same sites, its EtherHiding contracts, the hosts its ClickFix commands download from (the 20 on the most sites) and the articles about it.

輸入參數slug必填

list_research_articles

List research articles

Ohey research articles, newest first: incident write-ups with timelines, code analysis and indicators.

輸入參數threat

search_etherhiding_contracts

Search EtherHiding contracts

Smart contracts that compromised websites read their next stage from, as the EtherHiding contract tracker lists them: chain, kit, current destinations and when Ohey last read each one. Set destination to find the contracts that point, or pointed, at a host.

輸入參數kitchainlimitdestination

get_etherhiding_contract

Get an EtherHiding contract

One contract's destinations over time, the contracts or endpoints it names next, and when Ohey first and last read it.

輸入參數address必填

get_feed_stats

Get feed statistics

The size of the Ohey feed and the last seven full UTC days of changes to it, ending the day before asOf. hosts: hosts in the feed now. denied: hosts confirmed as legitimate services and kept out. week.added (and daily): hosts that entered the feed. week.entered: website tips that reached review. week.accepted: of those, the ones accepted into the feed. week.removed: tips an analyst rejected at review. week.denied: hosts confirmed legitimate that week. archive: the scanner's captures, the responses in them, host IP observations, response bodies judged malicious or clean, and feed status changes.

無需輸入參數。

search_clickfix_commands

Search ClickFix command hosts

Hosts that ClickFix lure commands download from, as the ClickFix command tracker lists them, busiest first: the kits credited with each, sites whose captured command used it, first and last seen, and the latest URL and command, defanged. command is empty when the command assembles its host while it runs. For research purposes only: the commands are real and their hosts may serve live malware, so pass on the notice field with any command you quote. Set host to check one host or URL; *[.]domain rows cover a domain that hands out a subdomain per visit.

輸入參數kithostlimit

版本歷史

1
  1. v1.0.0最新Nov 4, 2026

評分

已滿足適用檢查項的 90%

該評分衡量此收錄條目的完整程度，依據註冊中心條目、端點與公開來源計算得出。它不是對伺服器本身的評價，也不表示伺服器安全或目前可用：可連通性是帶日期的檢查結果，評分也不包含安裝量或使用者評價。

  • 近 30 天內可連通必需25 分
  • 已宣告認證方式必需10 分
  • 已列出工具必需15 分
  • 描述必需15 分
  • 圖示10 分
  • 文件15 分
  • 授權條款10 分

    請在儲存庫或註冊中心條目中宣告授權條款。

其他 Ohey 整合

Ohey

ca.ohey官方發布者

Ohey 的遠端 MCP 伺服器，可在其網頁惡意軟體情報來源中查詢主機、讀取 CVE 與研究資料，並掃描 URL。

Streamable HTTP可網頁執行驗證方式
網頁搜尋與抓取需要憑證Nov 4, 2026