← The evidence ledger
Evidence row 303989
Observed , by probe.mcp/1.
- Kind
- mcp.tools
- About
- endpoint 31eb0078-e1a7-49ea-afbb-90232c234d49
- Recorded
- Previous row
- None: the first of its kind about this subject
- Body SHA-256
- 3a4dce7305d284597b9e907662a28d831eb202feff034ea8e4ab6f65b7907a95
- Leaf
- 0x3d1154455a9877aa2be5376b834b6b69c9d94f2a9b132647ef9307bcd0fcfb86
What was observed
{
"count": 14,
"tools": [
{
"description": "Full honeypot profile for an ASN (autonomous system / hosting provider). Use for:\n'tell me about AS202425', 'what is Vultr doing in my honeypots?', 'attacks from this\nhosting provider', 'attribute this IP to its network'. asn format: 'AS12345'.\nReturns: total events, unique IPs, top targeted ports, top source countries, top user\nagents, org name. since/until are ISO-8601 UTC strings.",
"inputSchema": {
"additionalProperties": false,
"properties": {
"asn": {
"type": "string"
},
"since": {
"type": "string"
},
"until": {
"type": "string"
}
},
"required": [
"asn",
"since",
"until"
],
"type": "object"
},
"name": "asn_enrich_tool"
},
{
"description": "Attack volume over time, bucketed by hour or day. Use for: 'show attack trends this\nweek', 'was there a spike on port 22?', 'how has SSH scanning changed?', 'attack volume\nfrom China over 30 days'. bucket: 'hour' or 'day'. Optional filters: filter_protocol\n('tls'/'''), filter_country (2-letter code), filter_dest_port. since/until ISO-8601 UTC.",
"inputSchema": {
"additionalProperties": false,
"properties": {
"bucket": {
"default": "day",
"type": "string"
},
"filter_country": {
"anyOf": [
{
"type": "string"
},
{
"type": "null"
}
],
"default": null
},
"filter_dest_port": {
"anyOf": [
{
"type": "integer"
},
{
"type": "null"
}
],
"default": null
},
"filter_protocol": {
"anyOf": [
{
"type": "string"
},
{
"type": "null"
}
],
"default": null
},
"since": {
"type": "string"
},
"until": {
"type": "string"
}
},
"required": [
"since",
"until"
],
"type": "object"
},
"name": "attack_timeline_tool"
},
{
"description": "Who is probing a specific CVE. Use whenever the user names a CVE: 'is CVE-2024-4577\nbeing exploited in the wild?', 'who is scanning for this CVE?', 'show me actors probing\nCVE-2023-1389'. Returns title, severity, KEV status (actively_exploited, and `kev`: the\nCISA catalogue entry with date_added, or null), event and unique-IP counts\nover both sensor types (first_contact_events and interactive_requests split them; an\naddress both saw counts once), the top probing IPs with country/ASN and `scanner`\n(name and kind when the address is a recognised research, commercial or vendor\nscanner, else null), top ASNs and countries, exploiter fingerprints, sample request paths, a daily timeline, and\n`interactive`: what the interactive sensors recorded of the probes. window: 24h, 7d,\n30d or 90d on every plan; 180d, 365d or all (the whole archive) on plans with the full\nhistory, which the daily timeline then spans.\n`observed: false` with a note means we hold no detection pattern for that CVE, which is\nNOT the same as nobody scanning it. Do not use payload_search for a CVE id: the id is\nour tag for a pattern and never appears in the payload text.",
"inputSchema": {
"additionalProperties": false,
"properties": {
"cve_id": {
"type": "string"
},
"limit": {
"default": 25,
"type": "integer"
},
"window": {
"default": "7d",
"type": "string"
}
},
"required": [
"cve_id"
],
"type": "object"
},
"name": "cve_lookup_tool"
},
{
"description": "Plaintext logins captured by the interactive (Feint) sensors: username, password, the\nservice they were tried on, the outcome and the source address, newest first, plus the\npairs tried most and a per-service breakdown. Use when a user asks: 'what passwords are\nattackers trying on SSH?', 'which credentials did this IP try?', 'what logins hit the\nMySQL honeypots this week?'. service is a Feint service name such as ssh-password,\ntelnet-login, mysql-login, rdp-credssp or smb-ntlmssp (empty for all); source is an\naddress or CIDR (empty for all); window is 24h, 7d or 30d. Feint data is kept apart\nfrom the Spip surfaces: it feeds no verdict or feed and ioc_lookup does not include it.",
"inputSchema": {
"additionalProperties": false,
"properties": {
"limit": {
"default": 50,
"type": "integer"
},
"service": {
"default": "",
"type": "string"
},
"source": {
"default": "",
"type": "string"
},
"window": {
"default": "7d",
"type": "string"
}
},
"type": "object"
},
"name": "feint_credentials_tool"
},
{
"description": "Files clients handed to the interactive (Feint) sensors: uploads, mail attachments,\npublished messages and other artifacts, by SHA-256, with name, size, MIME type, the\nsessions that carried them and the VirusTotal verdict when the collector has one. Use\nwhen a user asks: 'have you seen this hash?', 'what files did this IP upload?', 'which\nmalware samples reached the honeypots this month?'. sha256 is one hash (empty for every\nfile in the window); source is an address or CIDR; window is 24h, 7d or 30d.",
"inputSchema": {
"additionalProperties": false,
"properties": {
"limit": {
"default": 50,
"type": "integer"
},
"sha256": {
"default": "",
"type": "string"
},
"source": {
"default": "",
"type": "string"
},
"window": {
"default": "30d",
"type": "string"
}
},
"type": "object"
},
"name": "feint_files_tool"
},
{
"description": "Sessions one address or range held with the interactive (Feint) sensors: when, which\nport and protocol, the persona answered as, the verdict (scan, credential, exploit),\nlabels, turns, bytes, duration, CVE ids evidenced by the payload, path-only CVE\ncandidates and the download URLs the client named, newest first, with verdict, persona\nand port breakdowns. Use after ioc_lookup when a user asks what an address did inside a\nsession: 'what did this IP do on the honeypots?', 'did this range get past a login?',\n'which exploits did this IP try?'. source is required: an address or a CIDR; window is\n24h, 7d or 30d.",
"inputSchema": {
"additionalProperties": false,
"properties": {
"limit": {
"default": 50,
"type": "integer"
},
"source": {
"type": "string"
},
"window": {
"default": "7d",
"type": "string"
}
},
"required": [
"source"
],
"type": "object"
},
"name": "feint_sessions_tool"
},
{
"description": "The population behind a single client fingerprint: how many source IPs carry it,\nacross how many networks (ASNs) and countries, the ports they hit, the top networks\nand a sample of the IPs, plus a read on its shape: concentrated (many IPs on few\nnetworks), dispersed (many networks but one short burst on one or two ports, which\nis a coordinated operation spread thinly on purpose), spread (a common client)\nor mixed. Concentrated and dispersed are both coordinated operations.\nUse when a user asks: 'is this JA4 one botnet or a common tool?', 'how many networks\nuse this HASSH?', 'how specific / concentrated is this fingerprint?'. fp_type: 'ja4'\n(TLS), 'akin' (HTTP request shape) or 'hassh' (SSH). Covers the full retained window\n(no date range).",
"inputSchema": {
"additionalProperties": false,
"properties": {
"fingerprint": {
"type": "string"
},
"fp_type": {
"type": "string"
}
},
"required": [
"fingerprint",
"fp_type"
],
"type": "object"
},
"name": "fingerprint_population_tool"
},
{
"description": "Search honeypot activity by TLS, HTTP, or SSH fingerprint. Use when a user asks:\n'have you seen this JA4 fingerprint?', 'which IPs share this TLS fingerprint?', 'how\ncommon is this HASSH?', 'find all scanners with this SSH client fingerprint'. fp_type:\n'ja4' (TLS client), 'ja3' (legacy TLS client, MD5, still keyed by many TI feeds),\n'akin' (HTTP request shape, e.g. b11cun030_00040014_54d07b6d), 'hassh' (SSH client).\nsince/until are ISO-8601 UTC strings.",
"inputSchema": {
"additionalProperties": false,
"properties": {
"fingerprint": {
"type": "string"
},
"fp_type": {
"type": "string"
},
"limit": {
"default": 50,
"type": "integer"
},
"since": {
"type": "string"
},
"until": {
"type": "string"
}
},
"required": [
"fingerprint",
"fp_type",
"since",
"until"
],
"type": "object"
},
"name": "fingerprint_search_tool"
},
{
"description": "Request shapes within a few headers of an Akin HTTP fingerprint, with what\nthose clients ask for and call themselves, plus the family the token belongs\nto. Use when one odd request shape turns up in your own web, WAF or proxy logs\nand you want to know whether it is a known tool with variants: 'what is close\nto this fingerprint', 'is this the same scanner with one header added', 'what\ndoes this client family go after'. max_distance is in headers, 1 to 4. Only\nAkin can answer this; a hashed fingerprint changes completely when a header is\nadded.",
"inputSchema": {
"additionalProperties": false,
"properties": {
"fingerprint": {
"type": "string"
},
"limit": {
"default": 8,
"type": "integer"
},
"max_distance": {
"default": 2,
"type": "integer"
}
},
"required": [
"fingerprint"
],
"type": "object"
},
"name": "fingerprint_similar_tool"
},
{
"description": "Look up any IP address, CIDR network, set of networks, or domain in the honeypot\n dataset. Use this FIRST whenever the\n user asks: 'is this IP malicious?', 'is this a known scanner?', 'have you seen this IP?',\n 'what does this IP do?', 'when was it last seen?', 'is this IP in your data?'. Returns:\n total_events (0 = never observed), first_seen, last_seen, country, ASN, the 50 most-hit\nports plus ports_targeted_count for the true total,\n top user agents, top URL paths, TLS/HTTP/SSH fingerprints. Covers both IPv4 and domains.\n Also returns our own judgement: `verdict` (human sentence) with `verdict_key` (stable\n machine value to alert on) and `verdict_why`; `scanner` (benign-scanner identity from our\n classification table, or null) so research traffic can be told apart from real attacks;\n and `cve_probes`, the CVE signatures this address was seen probing.\n\n WINDOW: `days` bounds the query to the last N days. For a single address\n leave it unset for every retained event, which is the right default for\n \"have we ever seen this\". A CIDR or a domain defaults to the last 90 days,\n because neither can use an index and unbounded they read the whole table;\n pass `days` explicitly to widen either back out. The website's /lookup\n defaults to 7 days for anonymous visitors, so the same address can read very\n differently on the two surfaces. Every response states which window it used\n in `window`; quote it alongside any count you report.\n\n RANGES: pass a CIDR ('103.66.28.0/22') for a whole-network aggregate, or several at once\n separated by commas, spaces or newlines ('103.66.28.0/22, 8.34.210.32/27') to answer\n 'have any of this vendor's ranges touched us' in ONE call. Never expand a network into\n individual addresses and loop -- that is hundreds of calls for an answer this returns in\n one, and it will exhaust your quota. A range answer sets query_type to 'cidr' or\n 'cidr_set', lists every range back in `ranges`, and gives `per_range` counts plus\n `top_source_ips`; total_events 0 with those fields present is a real observed absence.",
"inputSchema": {
"additionalProperties": false,
"properties": {
"days": {
"anyOf": [
{
"type": "integer"
},
{
"type": "null"
}
],
"default": null
},
"ioc": {
"type": "string"
}
},
"required": [
"ioc"
],
"type": "object"
},
"name": "ioc_lookup_tool"
},
{
"description": "Literal substring search over captured request text: URL path, request body,\nrequest headers and event summary. Use for: 'find attacks targeting /wp-admin',\n'find requests with this user agent string', 'what payloads hit port 80 last week'.\n\nIt matches text that literally appeared in the request, and nothing else. These do\nNOT work and will return an empty list:\n - a CVE id ('CVE-2024-4577'), which is our tag for a pattern, never payload text.\n Use cve_lookup instead. This tool rejects them rather than answering emptily.\n - a product or vendor name ('Cisco FMC', '7-Zip'), which appears in an advisory,\n not in the request. Search the endpoint it exposes instead, e.g. '/ccmadmin' or\n the vulnerable path.\n - a description of behaviour ('SQL injection attempts'). Search a marker that\n occurs in the traffic, e.g. 'UNION SELECT' or '../'.\n\nAn empty list is a real answer: it means no captured request in that window\ncontained the string. Widen since/until before concluding the activity does not\nexist. Free to call; volume is metered like every other tool.\nsince/until are ISO-8601 UTC strings.",
"inputSchema": {
"additionalProperties": false,
"properties": {
"limit": {
"default": 50,
"type": "integer"
},
"query": {
"type": "string"
},
"since": {
"type": "string"
},
"until": {
"type": "string"
}
},
"required": [
"query",
"since",
"until"
],
"type": "object"
},
"name": "payload_search_tool"
},
{
"description": "Return individual raw honeypot events with all fields. Use when the user wants to see\nactual records: 'show me events from this IP', 'what hit port 443 last week', 'events from\nRussia yesterday'. Filters: source_ip, country (2-letter code), asn (e.g. 'AS12345'),\ndest_port, protocol ('tls' or '' = the coarse TLS/raw-TCP signal),\napp_protocol (nDPI L7 protocol label: 'bittorrent', 'ssh', 'rdp', 'mssql-tds', 'mining',\n'rtsp', 'smbv1', ... — find everything speaking a protocol regardless of port),\nhttp_method, request_header (substring of the masked\nHTTP request headers), source_domain (reverse DNS name, substring), ja4/ja3\n(exact TLS client fingerprint), akin (exact HTTP request fingerprint, e.g.\nb11cun030_00040014_54d07b6d),\nhas_client_cert (true = only events where the client presented an mTLS cert),\nip_version (4 or 6 = only IPv4 or IPv6 sources).\nsince/until are ISO-8601 UTC strings. Each record includes: source_ip, country, asn,\ndest_port, user_agent, url_path, http_request_headers, tls_client_ja4, tls_client_ja3,\ntls_client_hello_hex (the raw TLS ClientHello, for verifying or recomputing\nfingerprints), ssh_client_hassh, tls_client_cert_subject/issuer,\nevent_sequence, event_duration, source_bytes/dest_bytes/network_bytes, network_protocol,\napplication_protocol, timestamp.",
"inputSchema": {
"additionalProperties": false,
"properties": {
"akin": {
"anyOf": [
{
"type": "string"
},
{
"type": "null"
}
],
"default": null
},
"app_protocol": {
"anyOf": [
{
"type": "string"
},
{
"type": "null"
}
],
"default": null
},
"asn": {
"anyOf": [
{
"type": "string"
},
{
"type": "null"
}
],
"default": null
},
"country": {
"anyOf": [
{
"type": "string"
},
{
"type": "null"
}
],
"default": null
},
"dest_port": {
"anyOf": [
{
"type": "integer"
},
{
"type": "null"
}
],
"default": null
},
"has_client_cert": {
"anyOf": [
{
"type": "boolean"
},
{
"type": "null"
}
],
"default": null
},
"http_method": {
"anyOf": [
{
"type": "string"
},
{
"type": "null"
}
],
"default": null
},
"ip_version": {
"anyOf": [
{
"type": "integer"
},
{
"type": "null"
}
],
"default": null
},
"ja3": {
"anyOf": [
{
"type": "string"
},
{
"type": "null"
}
],
"default": null
},
"ja4": {
"anyOf": [
{
"type": "string"
},
{
"type": "null"
}
],
"default": null
},
"limit": {
"default": 100,
"type": "integer"
},
"protocol": {
"anyOf": [
{
"type": "string"
},
{
"type": "null"
}
],
"default": null
},
"request_header": {
"anyOf": [
{
"type": "string"
},
{
"type": "null"
}
],
"default": null
},
"since": {
"type": "string"
},
"source_domain": {
"anyOf": [
{
"type": "string"
},
{
"type": "null"
}
],
"default": null
},
"source_ip": {
"anyOf": [
{
"type": "string"
},
{
"type": "null"
}
],
"default": null
},
"until": {
"type": "string"
}
},
"required": [
"since",
"until"
],
"type": "object"
},
"name": "search_events_tool"
},
{
"description": "Ranked leaderboard of attack sources. Use for: 'who is attacking the most?', 'top\nattacking countries', 'most targeted ports', 'most common user agents', 'top ASNs by\nattack volume', 'top IPs from China', 'top attackers hitting port 22'.\n'by' controls grouping: ip, asn, country, port, user_agent, ja4, url_path, domain, cve.\nby='cve' answers 'what CVEs are being mass-scanned right now' and returns\nvalue (the CVE id), title, severity, actively_exploited (on the CISA KEV catalogue),\nkev_date_added and counts; drill into any of them with cve_lookup. by='cve' does not accept the country/dest_port/asn filters.\nOptional filters: country (2-letter ISO, e.g. 'CN'), dest_port, asn (e.g. 'AS12345').\nAdding a filter is required for large time ranges to stay within memory limits.\nsince/until are ISO-8601 UTC strings.",
"inputSchema": {
"additionalProperties": false,
"properties": {
"asn": {
"anyOf": [
{
"type": "string"
},
{
"type": "null"
}
],
"default": null
},
"by": {
"default": "ip",
"type": "string"
},
"country": {
"anyOf": [
{
"type": "string"
},
{
"type": "null"
}
],
"default": null
},
"dest_port": {
"anyOf": [
{
"type": "integer"
},
{
"type": "null"
}
],
"default": null
},
"limit": {
"default": 20,
"type": "integer"
},
"since": {
"type": "string"
},
"until": {
"type": "string"
}
},
"required": [
"since",
"until"
],
"type": "object"
},
"name": "top_attackers_tool"
},
{
"description": "UDP datagrams sent to the sensors: DNS questions, QUIC client fingerprints and other\nUDP probes, with the ports, networks and countries involved. Use when a user asks:\n'who is sending DNS ANY queries?', 'is anyone querying version.bind?', 'have you seen\nthis QUIC JA4?', 'which UDP ports are being probed?', 'what hits 5060/udp?'. query uses\nthe /udp search grammar, for example 'qtype:ANY', 'qname:version.bind', 'proto:quic',\n'port:5060 country:CN', 'ja4:q13d0310h3_55b375c5d22e_cd85d2d88918' or\n'quic:3f1a9c2b7d40'; leave it empty for the overview. window is 24h, 7d or 30d.\nA UDP source address can be forged: treat every address here as claimed, never as\nevidence against it.",
"inputSchema": {
"additionalProperties": false,
"properties": {
"query": {
"default": "",
"type": "string"
},
"samples": {
"default": 10,
"type": "integer"
},
"window": {
"default": "7d",
"type": "string"
}
},
"type": "object"
},
"name": "udp_activity_tool"
}
]
}What the leaf hashes
{"body":"3a4dce7305d284597b9e907662a28d831eb202feff034ea8e4ab6f65b7907a95","id":303989,"kind":"mcp.tools","method":"probe.mcp/1","observed_us":1793055670947352,"prev":null,"subject":"31eb0078-e1a7-49ea-afbb-90232c234d49","subject_kind":"endpoint"}Proof
Fold these into the leaf in order, hashing each sorted pair with keccak256, to reach the root of (296695 rows).
- 0x3d11efd94766f1be490547c7a2a962ff260b11f1e22c93649c050d5feed5396d
- 0xff2522877577e11a65356106e17ed7212035be4426bd3dcc76141307ccc314a2
- 0x51baad96c71e69e21e0d93df0f71ad7344fa52eadba17b0ad01f0141df65128c
- 0xbfbf9e9ddd959d796bff674de4c1db8aec732feb6fee061e93054a9ee295056d
- 0x7d39ebc409cf81d4ebdb01546b30befa05697a38506be977d0365b67212b223c
- 0xca84a89b5bdfe23ca305657bd7b6aee3404654a4d7913961fe1f9dba02fe2e7a
- 0x56067bd30dd549f738ca5d3dd8ed85fb05d9f56977617db6e8f5c0ddb9ef8421
- 0xd86ec2dcf7df37f557085948579370c72300cf810de57af63b6322f36573f31d
- 0x7ed5307b5f1fd6387adb988ca74889a8053f81f17a453933322c228bf44a58f4
- 0xae66718d5a1d562c4f24366c92ce0f9cda65031931b8a838a2d71f1f81f474ea
- 0xd7dd18a37a5bb07e81a8083d8d1469e052ceebb2814b00f5a8d4f4cd181a5108
- 0xd04df0f7f3be4d014b4cea8172ada286fbcf5bcb32ae1b281704fd75627b661b
- 0x215f432600b78f2e7c9629cd10ce6ce4b7f3351b0b71f3f2c7dcb8e650f6cd63
- 0x7f594f5609f388d64d3cda87b5631d393ee8300bb09bad71f150113a5886ee33
- 0x4b52a97f7a80ff7778a702b85267b8d2e5c93ce160942656435c29ae7be68bf4
- 0x2e6a32eb32761c210560e852405e2f865f958ddbe01027894f8b9c1b3433b9f0
- 0x9a83be955a206deb65b995adfd92c58fa31c95fbbf926bd199d300e70b08b26d
- 0x20704208aa6923d6b2450ef74ede87a6e0265d46447926038fe9506e9e154b2d
- 0x9b9ce5b74b9bab5121612ef6b64920a8d453cbf311096a423eef9702747e868a
- Day root
- 0xf43e8dcc3d451a4788b26be904c55e8c4c0fa75c9666796c51db38d37e2c0df8
- Chained
- 0x702d5ac508f08b0d1accf36af25822d8e5660367494edd17a642fb61e158a57a
- Published
- On Arc Testnet, block 69251483: 0x495162f8936e19f0039918feebe6c307f327cd6bf8c37219620b1970041fa9ae