Evidence row 2634254

What was observed

{
  "endpoints": [
    [
      "x402",
      "https://telesint-api.onrender.com/ransomware"
    ]
  ],
  "name": "telesint-api.onrender.com/ransomware",
  "owner_address": "0x7f74ce6d34ee0180f0217a16ce05f3b91272570f",
  "raw": {
    "accepts": [
      {
        "amount": "40000",
        "asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
        "extra": {
          "name": "USD Coin",
          "version": "2"
        },
        "maxTimeoutSeconds": 300,
        "network": "eip155:8453",
        "payTo": "0x7F74cE6d34ee0180f0217A16Ce05f3B91272570F",
        "scheme": "exact"
      }
    ],
    "description": "Ransomware group activity from Telegram: victim posts, leak site announcements, extortion demands. Filters: severity, min_confidence, since, tag(lockbit|blackcat|cl0p|ransomhub), sector, country, limit, offset.",
    "extensions": {
      "bazaar": {
        "info": {
          "input": {
            "method": "GET",
            "queryParams": {
              "country": "us",
              "limit": 20,
              "min_confidence": 60,
              "offset": 0,
              "sector": "finance",
              "severity": "high",
              "since": "2026-05-01T00:00:00Z",
              "tag": "lockbit"
            },
            "type": "http"
          },
          "output": {
            "example": {
              "endpoint": "ransomware",
              "items": [
                {
                  "actor": {
                    "aliases": [
                      "LockBit 3.0",
                      "LockBit Black"
                    ],
                    "motivation": "financial",
                    "name": "LockBit",
                    "nation_state": null
                  },
                  "category": "ransomware",
                  "channel": "https://t.me/darkwebinformer",
                  "confidence": 88,
                  "id": "r1a2n3s4-o5m6-7890-abcd-ransom789012",
                  "iocs": [
                    {
                      "context": "Ransomware leak site",
                      "type": "url",
                      "value": "https[://]lockbit3[.]onion/victims/usbank-data"
                    }
                  ],
                  "severity": "critical",
                  "summary": "LockBit 3.0 claims breach of US regional bank — 2.4M customer records including SSNs posted to leak site",
                  "tags": [
                    "lockbit",
                    "ransomware",
                    "finance",
                    "data-leak",
                    "double-extortion"
                  ],
                  "target": {
                    "countries": [
                      "US"
                    ],
                    "organizations": [
                      "Regional Bank Corp"
                    ],
                    "sectors": [
                      "finance"
                    ]
                  },
                  "tlp": "WHITE",
                  "ts": "2026-05-27T08:30:00Z",
                  "ttps": [
                    {
                      "id": "T1486",
                      "name": "Data Encrypted for Impact",
                      "tactic": "Impact"
                    },
                    {
                      "id": "T1041",
                      "name": "Exfiltration Over C2 Channel",
                      "tactic": "Exfiltration"
                    }
                  ]
                }
              ],
              "limit": 20,
              "offset": 0,
              "source": "TeleSint",
              "total": 27
            },
            "type": "json"
          }
        },
        "schema": {
          "$schema": "https://json-schema.org/draft/2020-12/schema",
          "properties": {
            "input": {
              "additionalProperties": false,
              "properties": {
                "method": {
                  "enum": [
                    "GET"
                  ],
                  "type": "string"
                },
                "queryParams": {
                  "properties": {
                    "country": {
                      "description": "Targeted country keyword, e.g. us | uk | de | fr",
                      "type": "string"
                    },
                    "limit": {
                      "description": "Page size, default 20, max 100",
                      "type": "number"
                    },
                    "min_confidence": {
                      "description": "Minimum AI confidence score 0-100",
                      "type": "number"
                    },
                    "offset": {
                      "description": "Pagination offset, default 0",
                      "type": "number"
                    },
                    "organization": {
                      "description": "Targeted organization name partial match",
                      "type": "string"
                    },
                    "sector": {
                      "description": "Targeted sector: finance | healthcare | government | energy | retail",
                      "type": "string"
                    },
                    "severity": {
                      "description": "Minimum severity: critical | high | medium | low | info",
                      "type": "string"
                    },
                    "since": {
                      "description": "ISO 8601 timestamp filter, e.g. 2026-05-01T00:00:00Z",
                      "type": "string"
                    },
                    "tag": {
                      "description": "Ransomware group tag, e.g. lockbit, blackcat, cl0p, ransomhub, play, akira",
                      "type": "string"
                    }
                  },
                  "type": "object"
                },
                "type": {
                  "const": "http",
                  "type": "string"
                }
              },
              "required": [
                "type",
                "method"
              ],
              "type": "object"
            },
            "output": {
              "properties": {
                "example": {
                  "type": "object"
                },
                "type": {
                  "type": "string"
                }
              },
              "required": [
                "type"
              ],
              "type": "object"
            }
          },
          "required": [
            "input"
          ],
          "type": "object"
        }
      }
    },
    "lastUpdated": "2026-11-03T16:28:17.396Z",
    "quality": {
      "l30DaysTotalCalls": 8,
      "l30DaysUniquePayers": 1,
      "lastCalledAt": "2026-11-03T16:28:17.19Z"
    },
    "resource": "https://telesint-api.onrender.com/ransomware",
    "type": "http",
    "x402Version": 2
  },
  "source": "x402_bazaar",
  "summary": "Ransomware group activity from Telegram: victim posts, leak site announcements, extortion demands. Filters: severity, min_confidence, since, tag(lockbit|blackcat|cl0p|ransomhub), sector, country, limit, offset."
}

What the leaf hashes

{"body":"61a541e85d6e00a08777d269383bfccc2c4ac57178dcfdc329171ac63e3eedad","id":2634254,"kind":"listing","method":"sync.x402_bazaar/1","observed_us":1793734509168843,"prev":1792223,"subject":"x402_bazaar:https://telesint-api.onrender.com/ransomware","subject_kind":"source_record"}

Proof

Fold these into the leaf in order, hashing each sorted pair with keccak256, to reach the root of 2026-11-03 (425475 rows).

1. 0xafe0c12f7b0b5d48424b5cf0840c73ec31709a132e23432c9c107db9f3019e53
2. 0x8f4e25c6c63105cd58357f14719c640920266e7246c872d0c40ab9beff467ad3
3. 0xd1fa03ece69b00a56f30c8c28615748ab6d10a6dfa6c91b57955864708fbdd6f
4. 0xb6bb25dc4d72eee8e69635a7b7fc4ad88cfa89dde853e0007e399aea974aab64
5. 0x87f175ad1acbe3f47fb1290d6d5dbd8fb80b345d8bcb63b7193d28bbf6fffc35
6. 0x86a5f364d5302d91771f62c71efdd301a68061aaaade3e6a3ec1cdb01df64258
7. 0x37f5b49f4373a267e746f15466aed05714415a7c49557893cbffbbfc9dfbc48f
8. 0x4e6f1e19c8c90f63f3be7fc4f3db3ec13c2c2286f116c3164509a1729b7104ec
9. 0x2e26e04b552a1c41341990e0ff4438527fa2cb8fc673516ff60cba29603d1cf7
10. 0x86296f0c33233372ba12b9cfca9ecd431c6ac042757b14ad2ccc4395e72ff095
11. 0x63d19cdeae618ad9dfc1190840a76b2ae909360c3970067c04e70222711fd719
12. 0xe76f791089ba448cf5c37346afb8fe5ee2f3f91391fde676597825bbe36679a0
13. 0xe77cb660ad4fc9cdf06388820598606d0cfed52a41772cd9d2f56246f2635e96
14. 0x11934b37b54663f98169a4c48cc2b0a60fa4a3c4018d1ce3e508ac01ae614249
15. 0xa538822e863ef8366c4eb66bf75faf8a639aa1f066f65f7444fa54d54d48ec53
16. 0xdbc1c0882584cff2eba84dcd18af41b5fd070127c962a21b00db1ec3e352cc94
17. 0x39dab39081985bbfffe23b080399a9d1a9cb9c2c8960102350c4212113cb2cba
18. 0xac5402954216dc6c7020a6405675c8fc3b0828c2ab02943d80de52677a2f1fc3
19. 0x85f3a27c16056a361d9ba33355a575ca7123f86de901b204c88953c4b8ea441a

Day root

0xb646ffa569e24bf8336b0a15a9d98d0a2f1239f58e10c2b18a9d22e43343566a

Chained

0x35e926359fd19031c6b5e08fb3b44f2524386a57c8fdd353336c185603f53d43

Published

On Arc Testnet, block 70601990: 0xa5f9dadba13cde129126b950e64b815e6833cb8ff53b75026c9dbe769c3768c7