Evidence row 122483

What was observed

{
  "endpoints": [
    [
      "x402",
      "https://telesint-api.onrender.com/intent"
    ]
  ],
  "name": "telesint-api.onrender.com/intent",
  "owner_address": "0x7f74ce6d34ee0180f0217a16ce05f3b91272570f",
  "raw": {
    "accepts": [
      {
        "amount": "50000",
        "asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
        "extra": {
          "name": "USD Coin",
          "version": "2"
        },
        "maxTimeoutSeconds": 300,
        "network": "eip155:8453",
        "payTo": "0x7F74cE6d34ee0180f0217A16Ce05f3B91272570F",
        "scheme": "exact"
      }
    ],
    "description": "Pre-attack intent signals from Telegram: access sales, 0days, ransomware targeting. Filters: sector, country, organization, intent_type(access_sale|0day|ransomware|exploit), limit. Signals appear before attacks.",
    "extensions": {
      "bazaar": {
        "info": {
          "input": {
            "method": "GET",
            "queryParams": {
              "country": "us",
              "intent_type": "ransomware",
              "limit": 20,
              "offset": 0,
              "organization": "hospital",
              "sector": "healthcare"
            },
            "type": "http"
          },
          "output": {
            "example": {
              "endpoint": "intent",
              "items": [
                {
                  "category": "intent",
                  "channel": "https://t.me/ctifeeds",
                  "confidence": 72,
                  "id": "i1n2t3e4-n5t6-7890-abcd-intent789012",
                  "iocs": [
                    {
                      "context": "Access sale listing",
                      "type": "url",
                      "value": "https[://]exploit[.]in/threads/healthcare-access"
                    }
                  ],
                  "severity": "critical",
                  "summary": "Threat actor selling VPN access to US healthcare network: 5,000 employee credentials, domain admin included",
                  "tags": [
                    "access-sale",
                    "healthcare",
                    "vpn",
                    "initial-access-broker"
                  ],
                  "target": {
                    "countries": [
                      "US"
                    ],
                    "organizations": [],
                    "sectors": [
                      "healthcare"
                    ]
                  },
                  "tlp": "WHITE",
                  "ts": "2026-05-27T07:22:00Z",
                  "ttps": [
                    {
                      "id": "T1078",
                      "name": "Valid Accounts",
                      "tactic": "Initial Access"
                    },
                    {
                      "id": "T1110",
                      "name": "Brute Force",
                      "tactic": "Credential Access"
                    }
                  ]
                }
              ],
              "limit": 20,
              "offset": 0,
              "source": "TeleSint",
              "total": 3
            },
            "type": "json"
          }
        },
        "schema": {
          "$schema": "https://json-schema.org/draft/2020-12/schema",
          "properties": {
            "input": {
              "additionalProperties": false,
              "properties": {
                "method": {
                  "enum": [
                    "GET"
                  ],
                  "type": "string"
                },
                "queryParams": {
                  "properties": {
                    "claim_type": {
                      "description": "announcement (future attack) | claim (completed) | sale | recruitment | propaganda | report",
                      "type": "string"
                    },
                    "country": {
                      "description": "Targeted country keyword, e.g. us | uk | de | fr",
                      "type": "string"
                    },
                    "intent_type": {
                      "description": "Signal type: access_sale | 0day | ransomware | exploit | recruitment",
                      "type": "string"
                    },
                    "limit": {
                      "description": "Page size, default 20, max 100",
                      "type": "number"
                    },
                    "offset": {
                      "description": "Pagination offset, default 0",
                      "type": "number"
                    },
                    "organization": {
                      "description": "Targeted organization name partial match",
                      "type": "string"
                    },
                    "sector": {
                      "description": "Targeted sector: finance | healthcare | government | energy | retail",
                      "type": "string"
                    }
                  },
                  "type": "object"
                },
                "type": {
                  "const": "http",
                  "type": "string"
                }
              },
              "required": [
                "type",
                "method"
              ],
              "type": "object"
            },
            "output": {
              "properties": {
                "example": {
                  "type": "object"
                },
                "type": {
                  "type": "string"
                }
              },
              "required": [
                "type"
              ],
              "type": "object"
            }
          },
          "required": [
            "input"
          ],
          "type": "object"
        }
      }
    },
    "lastUpdated": "2026-10-21T13:03:27.84Z",
    "quality": {
      "l30DaysTotalCalls": 1,
      "l30DaysUniquePayers": 1,
      "lastCalledAt": "2026-10-21T13:03:27.446Z"
    },
    "resource": "https://telesint-api.onrender.com/intent",
    "type": "http",
    "x402Version": 2
  },
  "source": "x402_bazaar",
  "summary": "Pre-attack intent signals from Telegram: access sales, 0days, ransomware targeting. Filters: sector, country, organization, intent_type(access_sale|0day|ransomware|exploit), limit. Signals appear before attacks."
}

What the leaf hashes

{"body":"23fac7391647a549c2158ca51639034b79c0016c24f0d73dd8c0192b8652687e","id":122483,"kind":"listing","method":"baseline/1","observed_us":1793025621682379,"prev":null,"subject":"x402_bazaar:https://telesint-api.onrender.com/intent","subject_kind":"source_record"}

Proof

Fold these into the leaf in order, hashing each sorted pair with keccak256, to reach the root of 2026-10-26 (296695 rows).

1. 0xa12a557e46c6d80d884c8b0d1b868959057abd37f45f81807c779ceea4622d08
2. 0x4b26c1d0356821c824487bda0006eaadff1c5745324c38509df25644578ed1df
3. 0x8629301e53476ca9cbff73ab0776788ffd5d9018c057430263e1a1cbec571a39
4. 0x53646dafc2041f1814202c7b82daac9c5486b36546306a24ea455c1e207a19a1
5. 0xcfdb9a670d0d61da050c22809d51bed1ad056d1550e1d057bda791e2d7a3a4ae
6. 0x969be2d2ddb5aac0e9b7c0d21d27754b62eed4a13714568ed4be8b583816b1b5
7. 0x818313d35a07fb072aff3ecb9f3f29f71c7f2f3766bfe34f60cf3a1b6db2d18f
8. 0xa2fd6f7e5152595f140705cb17b741d18652dc435513b24d537d7106fa1f70ce
9. 0x94a882db6311b5de6c22f6ce40639f214b0d77b2898891d5d3f7a08ed0d28f72
10. 0xa258d479aaaaa82015c735d0ef4aa282cf307dff00c18952915a153965fc837e
11. 0x6e2c6fb1ec16c0d8a0fa917725bdfc512e7ed9f39e77d64f0a911d30e68a27de
12. 0x95576cc3dd18642c859f679cefa1cf80bfc6c690b065916c3585b14e8ef4b1b3
13. 0xf8d3e004d9a208d2c5e82ab676956d80f8a3c78387c61dad15a3a8269efee0d8
14. 0x6713795704ddd9c528d421fadd9cc96b0200a4ddbba84f88e718d4968dde888b
15. 0x62a900133713919f4eed33d8336876b7a6d538233b8a4f3ed03b29aa44f5bad0
16. 0x1ac20d30773e1f4f2f811540e9a99b5cca9177c9e2e029acc0d80cf3f1d11f0f
17. 0xd21942ae3214eff88e08ab04884fd4b11958b51af9a0741b7668e2d07a2c56c9
18. 0x9a9024edb5069d88a324facb310a5ce8e495214bbaa968f077bede437390194f
19. 0x9b9ce5b74b9bab5121612ef6b64920a8d453cbf311096a423eef9702747e868a

Day root

0xf43e8dcc3d451a4788b26be904c55e8c4c0fa75c9666796c51db38d37e2c0df8

Chained

0x702d5ac508f08b0d1accf36af25822d8e5660367494edd17a642fb61e158a57a

Published

On Arc Testnet, block 69251483: 0x495162f8936e19f0039918feebe6c307f327cd6bf8c37219620b1970041fa9ae