Evidence row 1791389

What was observed

{
  "endpoints": [
    [
      "x402",
      "https://telesint-api.onrender.com/intent"
    ]
  ],
  "name": "telesint-api.onrender.com/intent",
  "owner_address": "0x7f74ce6d34ee0180f0217a16ce05f3b91272570f",
  "raw": {
    "accepts": [
      {
        "amount": "50000",
        "asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
        "extra": {
          "name": "USD Coin",
          "version": "2"
        },
        "maxTimeoutSeconds": 300,
        "network": "eip155:8453",
        "payTo": "0x7F74cE6d34ee0180f0217A16Ce05f3B91272570F",
        "scheme": "exact"
      }
    ],
    "description": "Pre-attack intent signals from Telegram: access sales, 0days, ransomware targeting. Filters: sector, country, organization, intent_type(access_sale|0day|ransomware|exploit), limit. Signals appear before attacks.",
    "extensions": {
      "bazaar": {
        "info": {
          "input": {
            "method": "GET",
            "queryParams": {
              "country": "us",
              "intent_type": "ransomware",
              "limit": 20,
              "offset": 0,
              "organization": "hospital",
              "sector": "healthcare"
            },
            "type": "http"
          },
          "output": {
            "example": {
              "endpoint": "intent",
              "items": [
                {
                  "category": "intent",
                  "channel": "https://t.me/ctifeeds",
                  "confidence": 72,
                  "id": "i1n2t3e4-n5t6-7890-abcd-intent789012",
                  "iocs": [
                    {
                      "context": "Access sale listing",
                      "type": "url",
                      "value": "https[://]exploit[.]in/threads/healthcare-access"
                    }
                  ],
                  "severity": "critical",
                  "summary": "Threat actor selling VPN access to US healthcare network: 5,000 employee credentials, domain admin included",
                  "tags": [
                    "access-sale",
                    "healthcare",
                    "vpn",
                    "initial-access-broker"
                  ],
                  "target": {
                    "countries": [
                      "US"
                    ],
                    "organizations": [],
                    "sectors": [
                      "healthcare"
                    ]
                  },
                  "tlp": "WHITE",
                  "ts": "2026-05-27T07:22:00Z",
                  "ttps": [
                    {
                      "id": "T1078",
                      "name": "Valid Accounts",
                      "tactic": "Initial Access"
                    },
                    {
                      "id": "T1110",
                      "name": "Brute Force",
                      "tactic": "Credential Access"
                    }
                  ]
                }
              ],
              "limit": 20,
              "offset": 0,
              "source": "TeleSint",
              "total": 3
            },
            "type": "json"
          }
        },
        "schema": {
          "$schema": "https://json-schema.org/draft/2020-12/schema",
          "properties": {
            "input": {
              "additionalProperties": false,
              "properties": {
                "method": {
                  "enum": [
                    "GET"
                  ],
                  "type": "string"
                },
                "queryParams": {
                  "properties": {
                    "claim_type": {
                      "description": "announcement (future attack) | claim (completed) | sale | recruitment | propaganda | report",
                      "type": "string"
                    },
                    "country": {
                      "description": "Targeted country keyword, e.g. us | uk | de | fr",
                      "type": "string"
                    },
                    "intent_type": {
                      "description": "Signal type: access_sale | 0day | ransomware | exploit | recruitment",
                      "type": "string"
                    },
                    "limit": {
                      "description": "Page size, default 20, max 100",
                      "type": "number"
                    },
                    "offset": {
                      "description": "Pagination offset, default 0",
                      "type": "number"
                    },
                    "organization": {
                      "description": "Targeted organization name partial match",
                      "type": "string"
                    },
                    "sector": {
                      "description": "Targeted sector: finance | healthcare | government | energy | retail",
                      "type": "string"
                    }
                  },
                  "type": "object"
                },
                "type": {
                  "const": "http",
                  "type": "string"
                }
              },
              "required": [
                "type",
                "method"
              ],
              "type": "object"
            },
            "output": {
              "properties": {
                "example": {
                  "type": "object"
                },
                "type": {
                  "type": "string"
                }
              },
              "required": [
                "type"
              ],
              "type": "object"
            }
          },
          "required": [
            "input"
          ],
          "type": "object"
        }
      }
    },
    "lastUpdated": "2026-10-31T18:01:04.111Z",
    "quality": {
      "l30DaysTotalCalls": 6,
      "l30DaysUniquePayers": 2,
      "lastCalledAt": "2026-10-31T18:01:03.849Z"
    },
    "resource": "https://telesint-api.onrender.com/intent",
    "type": "http",
    "x402Version": 2
  },
  "source": "x402_bazaar",
  "summary": "Pre-attack intent signals from Telegram: access sales, 0days, ransomware targeting. Filters: sector, country, organization, intent_type(access_sale|0day|ransomware|exploit), limit. Signals appear before attacks."
}

What the leaf hashes

{"body":"9ac5edcbe8c17a95f1b66043f3426978f37b145c7e6a88f25b82f133c1cbd541","id":1791389,"kind":"listing","method":"sync.x402_bazaar/1","observed_us":1793559983157907,"prev":220278,"subject":"x402_bazaar:https://telesint-api.onrender.com/intent","subject_kind":"source_record"}

Proof

Fold these into the leaf in order, hashing each sorted pair with keccak256, to reach the root of 2026-11-01 (302406 rows).

1. 0x569c4094dcb45c637635bccd801b6be5ecb5073d4c069cc305fc388a17b8c238
2. 0x20d5ee18970f0ef913884e25d973ccae395a6c86f48765f3235d305ec157b43e
3. 0x83d263df5756dce09ef874015d1fae8bdb0a0ea69d44212c0f1fd4ad37606cbd
4. 0x81c6d6d857a2535948dd466c10cfa43c7b3961316d9139d59d3c7c4bf2823d1b
5. 0x2a7bc70f6bad0de0c9150f59ab0d3c73ebd7e544591732571e542f6a623cc1f2
6. 0x96374d803f0e40bf4b1f687f73033fe09378f2b1951280f0851eac9099f7ca1a
7. 0x23eb297a2b1039fc2870a62cb1beb89f899b48bd6f9f43fb20c7979ae513d993
8. 0xb8d22a9f50fdba76c234d0852e6b0576b5929e9be67697b2bcf0c2b2d82859a9
9. 0x8442363da6a2a6dd6bfffed861b8a60186ad417e6181337b106183a467d05374
10. 0x0fe878e26eb6f6d964eb6e96461bf9eef96fad3d6ca4c41e61cbe23e53108ddc
11. 0xbd61b224059184447bdd190af8968b36032eda8a68bb6541a95065cedff414d4
12. 0xde1fd31d10ba36dac3c345ea907bd1d4fd47e4fc9fb148e86bb9173da80d02bd
13. 0x25c3242ac264be301989809e7441ef0e86b1880cd2901fd07b765f01885b4af0
14. 0x9338fa49a0c5f3f5d810da4bc7c55c4f87067074ebe5e189dc6fb19ffee0ed93
15. 0xe622664153c4bb92e64b5edf8615a790cb48a8f528ac34b3faa4ef4dd70e05dd
16. 0xc1f6e8dd182b37cbb6e04d0e69486bd40d440934f8e373b9bae8cb78de508bba
17. 0x97f6f39e601b6ef0e47b730aa0488b718c0d7882ad840342bbd7d3a705a1b3a2
18. 0x1973893697931b7512ae5dc1a3c92ef92f633ae3574dce9029a35b5e94d2d364
19. 0x3315fd2757fdd435852cc277377234a3f3909a6d2a089d0e36f6d59aacfda910

Day root

0x7fa2cba1cf3d6b35630896f5fe1a650adb307ea2c376e80a5f2d9276b7cb5ab3

Chained

0x577ff89ba012beeff3197bcff7fa86752074bdf54205a24359cc437be2a952a4

Published

On Arc Testnet, block 70262758: 0x435bc1b9331471d72e1998f2e420983b5189d4da65ffbd6f27ef40daf5e1ea90