← The evidence ledger
Evidence row 67930
Observed , by baseline/1.
- Kind
- listing
- About
- source_record x402_bazaar:https://api.orioncmd.com/v1/watch
- Recorded
- Previous row
- None: the first of its kind about this subject
- Body SHA-256
- c6bc7880206d02d131064a9e8cd39e0ca2a14eefb168a09c7b33d5a18c2640a8
- Leaf
- 0x2d76f79a25b37322df439c51b5766f3fb56cf3c03a99a5557c3e5a9d01ec9327
What was observed
{
"endpoints": [
[
"x402",
"https://api.orioncmd.com/v1/watch"
]
],
"name": "OrionCMD Checks",
"owner_address": "0x2daf658b01e257206375798a15832e9f547d65dd",
"raw": {
"accepts": [
{
"amount": "300000",
"asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
"extra": {
"name": "USD Coin",
"version": "2"
},
"maxTimeoutSeconds": 120,
"network": "eip155:8453",
"payTo": "0x2dAF658B01e257206375798a15832E9f547D65dD",
"scheme": "exact"
}
],
"description": "OrionCMD Checks: Prepaid domain threat watch: up to 25 domains for 30 days, webhook alerts. Pay once; each domain is re-checked about once a day for 30 days. You get an HMAC-signed JSON POST at your https webhook_url (event watch.changed) when a domain or its IPv4 appears in (or leaves) ThreatCluster's high-confidence IOC feed, when a new ransomware leak-site claim names it, when its A/NS/MX records change, or when registration expiry changes or falls within 30 days. A watch.created POST is sent",
"extensions": {
"bazaar": {
"info": {
"input": {
"body": {
"items": [
"example.com"
],
"webhook_url": "https://example.com/hooks/orion-watch"
},
"bodyType": "json",
"method": "POST",
"type": "http"
},
"output": {
"example": {
"days": 30,
"expires_at": "2026-11-16T00:00:00.000Z",
"status": "active",
"status_url": "https://api.orioncmd.com/v1/watch/ocw_abcdefghijklmnop",
"watch_id": "ocw_abcdefghijklmnop",
"webhook_secret": "(shown once)"
},
"type": "json"
}
},
"schema": {
"$schema": "https://json-schema.org/draft/2020-12/schema",
"properties": {
"input": {
"additionalProperties": false,
"properties": {
"body": {
"properties": {
"items": {
"description": "Domains",
"items": {
"type": "string"
},
"maxItems": 25,
"minItems": 1,
"type": "array"
},
"webhook_url": {
"description": "Public https URL that receives POSTs",
"type": "string"
}
},
"required": [
"items",
"webhook_url"
],
"type": "object"
},
"bodyType": {
"enum": [
"json",
"form-data",
"text"
],
"type": "string"
},
"method": {
"enum": [
"POST"
],
"type": "string"
},
"type": {
"const": "http",
"type": "string"
}
},
"required": [
"type",
"method",
"bodyType",
"body"
],
"type": "object"
},
"output": {
"properties": {
"example": {
"type": "object"
},
"type": {
"type": "string"
}
},
"required": [
"type"
],
"type": "object"
}
},
"required": [
"input"
],
"type": "object"
}
}
},
"lastUpdated": "2026-10-17T06:10:23.876Z",
"quality": {
"l30DaysTotalCalls": 1,
"l30DaysUniquePayers": 1,
"lastCalledAt": "2026-10-17T06:10:23.707Z"
},
"resource": "https://api.orioncmd.com/v1/watch",
"serviceName": "OrionCMD Checks",
"tags": [
"ssl",
"tls",
"certificate",
"dns",
"domain"
],
"type": "http",
"x402Version": 2
},
"source": "x402_bazaar",
"summary": "OrionCMD Checks: Prepaid domain threat watch: up to 25 domains for 30 days, webhook alerts. Pay once; each domain is re-checked about once a day for 30 days. You get an HMAC-signed JSON POST at your https webhook_url (event watch.changed) when a domain or its IPv4 appears in (or leaves) ThreatCluster's high-confidence IOC feed, when a new ransomware leak-site claim names it, when its A/NS/MX records change, or when registration expiry changes or falls within 30 days. A watch.created POST is sent"
}What the leaf hashes
{"body":"c6bc7880206d02d131064a9e8cd39e0ca2a14eefb168a09c7b33d5a18c2640a8","id":67930,"kind":"listing","method":"baseline/1","observed_us":1793025465376309,"prev":null,"subject":"x402_bazaar:https://api.orioncmd.com/v1/watch","subject_kind":"source_record"}Proof
Fold these into the leaf in order, hashing each sorted pair with keccak256, to reach the root of (296695 rows).
- 0x2d76c551b3ae7a5809fe68503b1806fa2bef8b580ea7e1491ffe44aead956ae0
- 0xbe1fdfdb6a700a960bed5d09ea2bc5db8aa9c15190b8f425c8a9ac234d76987e
- 0x8e27a6a5f6d5271142d10db2942d383d13ba21be090ac93b55a701ceda5d0bbb
- 0x2b23b7482e3c2a6ab813acb4ef3378ae71abfd81e5d6a169ad73db3365c869f5
- 0x8ed303d1239a747fe14f24e8224f62045c2d9bba2a7621d7750740b0ad949431
- 0x4a81d7347705bdd59e2f83ec3b349eecb066dc7feda486d411284e23be35a842
- 0xbde33e5d073a2e2671acb1104d83dfbb09c54f8b3f2fb9dd3ba8339043a89ea2
- 0x1ad1e6fcec3100bdab24d471ea26fb88d10f720b7f8d71deb85393c6edd2fad3
- 0x4118d31d6eb113d76e872c5d62016ea7d7579ae5f20f6cce8a0705bfb6a4921f
- 0xfebc7a0b0bf8746a2821ac5da36e68a391f5528503546c156de64dcfb3f4e54e
- 0x0a14d7531a251f3320f61b058ccd68e743331eaf8f3058982b949d68be76670c
- 0xf89d9951e0a8e08b9cf11177a1f4e0fd86d9facc5dfecaabbfe564675ebefef7
- 0xb87e8b32cda179c9e632e227bbd8a6d1f6f61d9d81bb92dbd4dd835d2b3b5caa
- 0x683955a5b2250ad50568d022a6580d8739b6aff1356779d72a773b088e7c289c
- 0x610738e0c43687aded83c613c73de8b5226c73c375858a167436461c522ea213
- 0x06d71bfa7d8b41d62c8836efc2c601e1cc3772d9453596b2ae4950887f3310ca
- 0x8c756542e482157df0c36464d75c937b845e4423dbbcfad08f0cf8d5a16b9a13
- 0x20704208aa6923d6b2450ef74ede87a6e0265d46447926038fe9506e9e154b2d
- 0x9b9ce5b74b9bab5121612ef6b64920a8d453cbf311096a423eef9702747e868a
- Day root
- 0xf43e8dcc3d451a4788b26be904c55e8c4c0fa75c9666796c51db38d37e2c0df8
- Chained
- 0x702d5ac508f08b0d1accf36af25822d8e5660367494edd17a642fb61e158a57a
- Published
- On Arc Testnet, block 69251483: 0x495162f8936e19f0039918feebe6c307f327cd6bf8c37219620b1970041fa9ae