{"uid":"cap_TMMGpZb1fyWVeVPd7IFsZ","slug":"forensik-dusting-attack-monitor-f84779e9","name":"Forensik Dusting Attack Monitor","description":"Dusting Attack Monitor analyses only the evidence supplied by the caller. It does not claim to query a chain, identify a legal status or replace an independent audit. Missing signals lower confidence and are listed explicitly; every classification includes the exact thresholds used.","url":"https://forensik.halowerk.com/v1/dusting-attack-monitor?utm_source=zero.xyz","method":"POST","headers":{},"bodySchema":{"type":"object","properties":{"strict":{"type":"boolean","default":false,"description":"Reject unless all documented metrics are supplied."},"context":{"type":"object","description":"Optional non-secret labels returned unchanged for correlation.","maxProperties":20,"additionalProperties":{"type":["string","number","boolean","null"]}},"subject":{"type":"string","maxLength":256,"minLength":1,"description":"Address, transaction, protocol, asset, proposal or other subject being assessed."},"evidence":{"type":"array","items":{"type":"object","required":["metric","value"],"properties":{"note":{"type":"string","maxLength":500},"value":{"type":["number","boolean"]},"metric":{"enum":["dust_input_count","unknown_sender_share_pct","cluster_linkage_risk"],"type":"string"},"source":{"type":"string","maxLength":300,"minLength":1,"description":"Evidence source or query identifier."},"timestamp":{"type":"string","maxLength":40,"minLength":10,"description":"ISO-8601 observation time."}},"additionalProperties":false},"maxItems":50,"minItems":1,"description":"Caller-supplied observations. Repeated metrics form a time series; the newest timestamp is assessed."}}},"responseSchema":{"type":"json","example":{"scope":"caller_supplied_evidence_only","engine":"detector","service":"Dusting Attack Monitor","subject":"dusting-attack-monitor-sample","confidence":100,"risk_score":14.05,"generated_at":"2026-10-23T00:07:35.708Z","classification":"low","recommendation":"No supplied metric crossed a warning thr","service_number":94}},"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.001","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.001/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.001","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.001","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_XG7njBTXvXFnUXytiDnSO","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.001","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Analyzes caller-supplied blockchain evidence to classify whether a subject address or transaction is likely the target of a dusting attack, with explicit confidence scores and threshold reporting.","exampleAgentPrompt":"Can you run a dusting attack analysis on address 0xABC123 using these observations: dust_input_count is 47, unknown_sender_share_pct is 82.5, and cluster_linkage_risk is 0.91 — I want to know if this address is being targeted and how confident you are?","exampleUseCases":[{"title":"DeFi wallet compromise risk check","prompt":"I think my Ethereum wallet 0xDEADBEEF might be under a dusting attack — I've seen 53 tiny dust inputs, about 78% from unknown senders, and the cluster linkage risk came back at 0.88. Can you classify whether this is a real dusting attack and tell me which thresholds triggered?"},{"title":"Exchange address monitoring alert","prompt":"We're monitoring a hot wallet address at our exchange and have collected these signals over the last hour: dust_input_count of 120, unknown_sender_share_pct of 95, and cluster_linkage_risk of 0.97. Run the dusting attack monitor on it and flag any missing confidence signals explicitly."},{"title":"Post-incident forensic audit","prompt":"After a suspected on-chain tracking incident, can you assess this transaction subject with the evidence we gathered — dust_input_count 22, unknown_sender_share_pct 61.3, cluster_linkage_risk 0.74 — and give me the exact classification thresholds used so we can document this for our security report?"}],"resultDescription":"Returns a dusting attack classification (e.g. low/medium/high risk or attack confirmed/unlikely), a confidence score, the exact thresholds applied to each supplied metric, and an explicit list of any missing signals that reduced confidence. The caller's optional context labels are returned unchanged for correlation.","failureModes":["Fewer than 1 evidence item supplied — request rejected","strict mode enabled but one or more documented metrics are missing — request rejected with list of absent metrics","Metric value out of expected range — classification confidence reduced","Subject string exceeds 256 characters — validation error","Evidence array exceeds 50 items — request rejected","Malformed ISO-8601 timestamps on observations — parsing error"],"whenToPreferThis":"Choose this endpoint when you have pre-collected on-chain signals (dust input count, unknown sender share, cluster linkage risk) and need a structured, threshold-transparent classification of dusting attack likelihood without relying on a live chain query. It is ideal for forensic workflows, post-incident audits, or agent pipelines that already aggregate blockchain data and need a deterministic risk verdict with explicit confidence accounting. Prefer alternatives if you need live chain querying or legal-grade audit output.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-11-02T00:33:26.249Z","isFirstParty":false,"canonicalSlug":"forensik-dusting-attack-monitor-f84779e9"}