{"root_cid":"bafybeiajq2omd4ioirvr3e3tcgae2jru3o5lvda6kv3npuhu2cct4rfv74","model":"openai/gpt-5.4-mini","analyzed_at":"2026-05-06T00:43:53.904Z","result":{"schema_version":1,"category":"Redirect","category_confidence":0.98,"summary":"A small Telegram promo page that funnels visitors to a seller advertising RAT malware.","signals":["analysis-context.latest_probe: title is 'Craxs RAT Seller | Telegram Profile' and content_url points to the IPFS root page","root/index.html: meta description advertises 'CraxsRAT, EagleSpy, IM RAT & more' and calls it the 'Official Telegram profile'","root/index.html: the only primary call to action is an outbound link to 'https://t.me/craxs_rat_selller'","root/index.html: minimal native content beyond a styled landing card and one image in root/images/@craxs_rat_selller.png"],"quality":{"tier":"low","score":0.24,"is_substantive":true,"is_redirect_only":true,"is_placeholder":false,"rationale":"This is a thin landing page with little native content and a single outbound Telegram CTA, so it is functional but low-value."},"security":{"risk":"high","risk_score":0.87,"threat_type":"other","safe_to_list":false,"findings":[{"type":"other","severity":"high","confidence":0.94,"evidence":"root/index.html: meta description says 'Get access to CraxsRAT, EagleSpy, IM RAT & more' and the page links users to 'https://t.me/craxs_rat_selller'","file":"root/index.html"}]},"files_reviewed":["analysis-context.json","root/index.html","root/images"]}}