{"root_cid":"bafybeibi4jppk7e6z4z4rmi6wrpagzptewyf6dxoddkulywgro5jyc7hia","model":"openai/gpt-5.4-mini","analyzed_at":"2026-05-01T15:59:58.225Z","result":{"schema_version":1,"category":"Wallet","category_confidence":0.95,"summary":"A deceptive Ethereum airdrop portal that prompts for a recovery phrase and sends submissions to Telegram.","signals":["analysis-context.json: latest_probe.title is \"Ethereum Nexus · Secure Portal\" and latest_probe.ipfs_path points to index.html","index.html: contains \"12-word recovery phrase\" input and a \"Connect\" button","index.html: labels submission as \"Wallet Connection Attempt\" and posts it to Telegram via fetch('https://api.telegram.org/bot.../sendMessage')","index.html: shows \"Connect the correct wallet that received the Airdrop\" and \"Verify your eligibility and access your Ethereum Nexus allocation\""],"quality":{"tier":"low","score":0.18,"is_substantive":true,"is_redirect_only":false,"is_placeholder":false,"rationale":"The page is functional and content-rich, but it is a thin, deceptive airdrop-style portal with anti-analysis code and no legitimate product depth."},"security":{"risk":"critical","risk_score":0.99,"threat_type":"seed_phrase_prompt","safe_to_list":false,"findings":[{"type":"seed_phrase_prompt","severity":"critical","confidence":0.99,"evidence":"index.html includes a \"12-word recovery phrase\" textarea, builds a message titled \"Wallet Connection Attempt\", and sends the entered text to Telegram using fetch('https://api.telegram.org/bot.../sendMessage').","file":"index.html"}]},"files_reviewed":["analysis-context.json","index.html","js/webflow-script.js","js/aa.json"]}}