Ohey research

Ohey scans websites for injected malware and publishes what it finds by technique and by kit. This connector gives Claude that research. Ask about a technique such as ClickFix, EtherHiding, web skimmers, phishing kits or tech-support scams, and Claude gets Ohey’s summary, how many sites matched it since records began in August 2026 and in the last 30 days, monthly counts, how many sites were still infected when rescanned, and the WordPress versions and plugins on infected sites. Ask about a kit such as SocGholish, CLEARSHORT or BW panel, and Claude gets the same statistics, the kits seen on the same sites, the smart contracts the kit reads its next stage from, and Ohey’s research articles about it. The EtherHiding tools search the smart contracts that compromised websites read their next stage from, by kit, chain or destination host, with each contract’s destinations over time. Every answer links the Ohey page it came from. Counts update daily. No account is needed. Host lookups, the full feed and URL scans need an Ohey account and the separate server at https://ohey.ca/mcp.