Additional public threat-intelligence sources

Initial eight-object GitHub batch checks four exact indicators in two newly selected public corpora. No code hit. Primary README scope/delay caveats make those negatives weak for this fresh wallet/hash incident.

Parent-authorized documented GoPlus Malicious Address API followup makes exactly two unauthenticated Polygon GET lookups. Collector3f991 returns stealing_attack1/data_sourceSlowMist; secondary5a2764 returns stealing_attack0/data_sourceempty. Provider flags are assertions at capture time, not proof of actor identity, human ownership or independent theft. The original dated SlowMist address record was not recovered.

Primary current API schema was read first; chain137 and optional Authorization documented. The obsolete docs route404 is retained. No separate scan API, report submission, sample upload, execution, secret, attacker endpoint or outreach was used.

Curated files are public-safe. All full tool/HTTP/docs/news/source bodies remain in raw/. Hashes bind locally retained source bytes; metadata alone does not authenticate omitted bodies. No site or frozen evidence edits.
