Evidence row 1508042

What was observed

{
  "endpoints": [
    [
      "x402",
      "https://verdict.kechlab.com/v1/phishing-url"
    ]
  ],
  "name": "Verdict 402",
  "owner_address": "0xb36c56a749f81ffeb44a134082dd4744e1d254eb",
  "raw": {
    "accepts": [
      {
        "amount": "8800",
        "asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
        "extra": {
          "name": "USD Coin",
          "version": "2"
        },
        "maxTimeoutSeconds": 120,
        "network": "eip155:8453",
        "payTo": "0xb36c56A749f81FFeb44a134082DD4744E1d254Eb",
        "scheme": "exact"
      }
    ],
    "description": "Before an agent opens or follows a link: is this address a trap? Code finds the technical signs (IP address, deceptive characters, hidden at-sign, shortened link, lookalike of the expected brand), then the engine reads what code cannot see: imitation of a known brand and a message that pushes to cli",
    "extensions": {
      "bazaar": {
        "info": {
          "input": {
            "body": {
              "brand": "paypal.com",
              "message": "Sign in to view your statement.",
              "url": "https://www.paypal.com/signin"
            },
            "bodyType": "json",
            "method": "POST",
            "type": "http"
          },
          "output": {
            "example": {
              "mode": "phishing-url",
              "paid_sats": 20,
              "payment_hash": "x402:<sha256 hex>",
              "receipt": {
                "payload": {
                  "at": "<ISO 8601 time>",
                  "kid": "<signing key id>",
                  "mode": "phishing-url",
                  "payment_hash": "x402:<sha256 hex>",
                  "v": 1,
                  "verdict_sha256": "<sha256 hex of the verdict>"
                },
                "signature": "<base64url Ed25519 signature>"
              },
              "verdict": {
                "decision": "allow",
                "reasons": [],
                "rule": "block if brand lookalike, at-sign in the address, or certain imitation (>= 0.8) with a technical signal ; review if any signal, imitation >= 0.4 or pressure >= 0.6 ; otherwise allow",
                "scores": {
                  "impersonation": 0.03,
                  "lure": 0.05
                },
                "signals": []
              }
            },
            "type": "json"
          }
        },
        "schema": {
          "$schema": "https://json-schema.org/draft/2020-12/schema",
          "properties": {
            "input": {
              "additionalProperties": false,
              "properties": {
                "body": {
                  "properties": {
                    "brand": {
                      "description": "(optional but recommended) the expected official site, for example paypal.com",
                      "type": "string"
                    },
                    "message": {
                      "description": "(optional) the text that comes with the link",
                      "type": "string"
                    },
                    "url": {
                      "description": "the address to check (http or https)",
                      "type": "string"
                    }
                  },
                  "required": [
                    "url"
                  ],
                  "type": "object"
                },
                "bodyType": {
                  "enum": [
                    "json",
                    "form-data",
                    "text"
                  ],
                  "type": "string"
                },
                "method": {
                  "enum": [
                    "POST"
                  ],
                  "type": "string"
                },
                "type": {
                  "const": "http",
                  "type": "string"
                }
              },
              "required": [
                "type",
                "method",
                "bodyType",
                "body"
              ],
              "type": "object"
            },
            "output": {
              "properties": {
                "example": {
                  "type": "object"
                },
                "type": {
                  "type": "string"
                }
              },
              "required": [
                "type"
              ],
              "type": "object"
            }
          },
          "required": [
            "input"
          ],
          "type": "object"
        }
      }
    },
    "lastUpdated": "2026-10-31T07:27:54.147Z",
    "quality": {
      "l30DaysTotalCalls": 1,
      "l30DaysUniquePayers": 1,
      "lastCalledAt": "2026-10-31T07:27:53.303Z"
    },
    "resource": "https://verdict.kechlab.com/v1/phishing-url",
    "serviceName": "Verdict 402",
    "tags": [
      "phishing",
      "links",
      "ai-agents"
    ],
    "type": "http",
    "x402Version": 2
  },
  "source": "x402_bazaar",
  "summary": "Before an agent opens or follows a link: is this address a trap? Code finds the technical signs (IP address, deceptive characters, hidden at-sign, shortened link, lookalike of the expected brand), then the engine reads what code cannot see: imitation of a known brand and a message that pushes to cli"
}

What the leaf hashes

{"body":"679a7b3ad02739fb92faf815bfa528bff8eac32bacc483817bae370989251442","id":1508042,"kind":"listing","method":"sync.x402_bazaar/1","observed_us":1793472706662590,"prev":null,"subject":"x402_bazaar:https://verdict.kechlab.com/v1/phishing-url","subject_kind":"source_record"}

Proof

Fold these into the leaf in order, hashing each sorted pair with keccak256, to reach the root of 2026-10-31 (246033 rows).

1. 0x3cb32ebe49d0d549206d7db040d35959e3039454a6adf53ace39719103a1b744
2. 0x081132750e1fa2ad74c66a54188dd61c2a186772a68f21086242b6fc12805208
3. 0x4a5b564d104d09e0a6dec040bc0ef8278d7ee7240447a25b2f02fdb8287f8fd8
4. 0x20ef9db7e3fa059c5c827260d6478c3d5cc7f90082df5c42f0e29f64aa850566
5. 0xfe405bfeec3f37691ca9061a53f1a1cca1df98de98faa4fb65faf485b5b742d0
6. 0x7e9a5abd1d2e500076f99960d1aaf430473af02d801013169391a1cc68c9dc3c
7. 0x7267304023866cadad393a51397d06169c5b51b81f1c1f382662ef251e9314ab
8. 0xb9eb97ccf71d2f89ea1bcae9bb783ff4397165ec809bc9946a8ea8d79abd90ab
9. 0xaf56c334d09fb2dd78876b23bf6349046f3dda2aa5b523dc10fdf5181e537141
10. 0x4c46ecb0487a05498ce7780780181a7d322de6dfc2ba662c6306f19e072116f1
11. 0xd1cb0f4f3e0d1ff9fad86b89c5bf43c8b46295fa2557b170028bcec9e76ee9af
12. 0x8c03bfa1086a826db5ededcd620542546be4a77b1df6b3f1b528300dad6134de
13. 0x13b302bc666612c6a2355a9f2772bb5e8b41864f84bd2faa6fde4925d59ffbeb
14. 0x52abc997ae7243cb8d8ecfd77101582ba9534053215bf053c093c35dae7572c6
15. 0xc712f139a437e96ecb98a6d83c47c29921720c39ba2e7e94f4973de043fb567c
16. 0x24ea73817c2ff07f87a42be89aff36ac5fe49b64420a647cd406ee60e6a77f70
17. 0x37f13582abb3c002d51c2f190c312129cbc3a39754618fee2c75c2441bb1eb94
18. 0x59f83f7228f07febe2780660e422e171b0359b8aa031ee3be07e991118130c15

Day root

0x24463725d1c0d9894bd6123691d532547aaa79f0762c0e45aa6a68acf1fd71ab

Chained

0x7d4824ff313dee7252a46f9d5c37b452851deb6c9f24a40c2f74ee0e53c82980

Published

On Arc Testnet, block 70093156: 0xedb7b832f4ebf6781b5ecd2ed241c435b862f4d3761541fa31adc1831b8c44a0