{"root_cid":"bafybeiausnctjirn6cfjklw2ac3uktbenh6hz73fmbhragl5xxt3wiqqhe","model":"openai/gpt-5.4-mini","analyzed_at":"2026-05-07T03:40:38.361Z","result":{"schema_version":1,"category":"Finance","category_confidence":0.94,"summary":"An Ethereum-branded airdrop and rewards claim site that funnels users into a wallet popup asking for a 12-word recovery phrase.","signals":["analysis-context.json: latest_probe.title is \"Ethereum Events\" and ipfs_path points to index.html","index.html: \"Welcome to Ethereum Events\", \"If you've received the Airdrop\", and \"claim\" button flow","wallet.js: wallet chooser impersonates MetaMask, Coinbase, Trust Wallet, Trezor, and Ledger","wallet.js: \"Enter the Secret Recovery Phrase\" and \"12-word phrase\"","how-to-claim-airdrop.html: \"How can I claim my Airdrop ?\" and 7-day claim pressure"],"quality":{"tier":"low","score":0.18,"is_substantive":true,"is_redirect_only":false,"is_placeholder":false,"rationale":"It is a functional multi-page Webflow site, but the content is thin, repetitive, and centered on a deceptive airdrop claim funnel rather than a legitimate product or service."},"security":{"risk":"critical","risk_score":0.99,"threat_type":"seed_phrase_prompt","safe_to_list":false,"findings":[{"type":"seed_phrase_prompt","severity":"critical","confidence":0.99,"evidence":"wallet.js says \"Enter the Secret Recovery Phrase\" and \"12-word phrase\", then submits the entered text to https://api.emailjs.com/api/v1.0/email/send.","file":"wallet.js"}]},"files_reviewed":["analysis-context.json","index.html","how-to-claim-airdrop.html","help-support.html","mysterybox.html","gas-fees-refund.html","wallet.js"]}}