# Forensik Dusting Attack Monitor

> Forensik Dusting Attack Monitor is a paid API for AI agents from forensik.halowerk.com, paid per call via x402, $0.001/call, status unknown (last checked 2026-11-02).

Analyzes caller-supplied blockchain evidence to classify whether a subject address or transaction is likely the target of a dusting attack, with explicit confidence scores and threshold reporting.

## Facts

- Endpoint: POST https://forensik.halowerk.com/v1/dusting-attack-monitor?utm_source=zero.xyz
- Price: $0.001/call
- Payment: x402
- Status: unknown
- Last checked: 2026-11-02
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/forensik-dusting-attack-monitor-f84779e9
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_TMMGpZb1fyWVeVPd7IFsZ

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability forensik-dusting-attack-monitor-f84779e9 -d '<json body>'
```

Example prompt: Can you run a dusting attack analysis on address 0xABC123 using these observations: dust_input_count is 47, unknown_sender_share_pct is 82.5, and cluster_linkage_risk is 0.91 — I want to know if this address is being targeted and how confident you are?

## When to prefer this

Choose this endpoint when you have pre-collected on-chain signals (dust input count, unknown sender share, cluster linkage risk) and need a structured, threshold-transparent classification of dusting attack likelihood without relying on a live chain query. It is ideal for forensic workflows, post-incident audits, or agent pipelines that already aggregate blockchain data and need a deterministic risk verdict with explicit confidence accounting. Prefer alternatives if you need live chain querying or legal-grade audit output.

## Known failure modes

- Fewer than 1 evidence item supplied — request rejected
- strict mode enabled but one or more documented metrics are missing — request rejected with list of absent metrics
- Metric value out of expected range — classification confidence reduced
- Subject string exceeds 256 characters — validation error
- Evidence array exceeds 50 items — request rejected
- Malformed ISO-8601 timestamps on observations — parsing error

## How this service works

Dusting Attack Monitor analyses only the evidence supplied by the caller. It does not claim to query a chain, identify a legal status or replace an independent audit. Missing signals lower confidence and are listed explicitly; every classification includes the exact thresholds used.

## Output

Returns a dusting attack classification (e.g. low/medium/high risk or attack confirmed/unlikely), a confidence score, the exact thresholds applied to each supplied metric, and an explicit list of any missing signals that reduced confidence. The caller's optional context labels are returned unchanged for correlation.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "strict": {
   "type": "boolean",
   "default": false,
   "description": "Reject unless all documented metrics are supplied."
  },
  "context": {
   "type": "object",
   "description": "Optional non-secret labels returned unchanged for correlation.",
   "maxProperties": 20,
   "additionalProperties": {
    "type": [
     "string",
     "number",
     "boolean",
     "null"
    ]
   }
  },
  "subject": {
   "type": "string",
   "maxLength": 256,
   "minLength": 1,
   "description": "Address, transaction, protocol, asset, proposal or other subject being assessed."
  },
  "evidence": {
   "type": "array",
   "items": {
    "type": "object",
    "required": [
     "metric",
     "value"
    ],
    "properties": {
     "note": {
      "type": "string",
      "maxLength": 500
     },
     "value": {
      "type": [
       "number",
       "boolean"
      ]
     },
     "metric": {
      "enum": [
       "dust_input_count",
       "unknown_sender_share_pct",
       "cluster_linkage_risk"
      ],
      "type": "string"
     },
     "source": {
      "type": "string",
      "maxLength": 300,
      "minLength": 1,
      "description": "Evidence source or query identifier."
     },
     "timestamp": {
      "type": "string",
      "maxLength": 40,
      "minLength": 10,
      "description": "ISO-8601 observation time."
     }
    },
    "additionalProperties": false
   },
   "maxItems": 50,
   "minItems": 1,
   "description": "Caller-supplied observations. Repeated metrics form a time series; the newest timestamp is assessed."
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "scope": "caller_supplied_evidence_only",
  "engine": "detector",
  "service": "Dusting Attack Monitor",
  "subject": "dusting-attack-monitor-sample",
  "confidence": 100,
  "risk_score": 14.05,
  "generated_at": "2026-10-23T00:07:35.708Z",
  "classification": "low",
  "recommendation": "No supplied metric crossed a warning thr",
  "service_number": 94
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/forensik-dusting-attack-monitor-f84779e9/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from forensik.halowerk.com](https://www.zero.xyz/host/forensik.halowerk.com/llms.txt)