{
  "capturedUTC": "2026-10-31T08:42:56.678695+00:00",
  "result": "Additional sources add a provider risk flag and a primary historical editorial-contact record; no attacker identity or Car-drainer control link.",
  "collector": {
    "role": "collector",
    "address": "0x3f99139f1c5854bb628c2e576aaf638e99dffc18",
    "chainId": 137,
    "sourceURL": "https://api.gopluslabs.io/api/v1/address_security/0x3f99139f1c5854bb628c2e576aaf638e99dffc18?chain_id=137",
    "capturedUTC": "2026-10-31T08:27:30.857912+00:00",
    "responseSHA256": "b6362029ec78246a8093eed6e012705c2f9bf36e71dcd75076e6bca4943b5bbe",
    "responseCode": 1,
    "selectedProviderFields": {
      "stealing_attack": "1",
      "phishing_activities": "0",
      "contract_address": "0",
      "data_source": "SlowMist"
    },
    "providerLabelCreationTime": null,
    "underlyingIncidentOrTransactionReferences": null,
    "meaning": "Provider assertion at lookup time; not independent theft/actor/control proof. Zero flags do not clear the address."
  },
  "secondary": {
    "role": "secondary",
    "address": "0x5a2764fbbe5d139ef0ed988ec5f95320ce730c0b",
    "chainId": 137,
    "sourceURL": "https://api.gopluslabs.io/api/v1/address_security/0x5a2764fbbe5d139ef0ed988ec5f95320ce730c0b?chain_id=137",
    "capturedUTC": "2026-10-31T08:27:31.233597+00:00",
    "responseSHA256": "94239a1ce814acca0f0cdf3cb33bdae40630e099af463f3f5d543630a99a7d19",
    "responseCode": 1,
    "selectedProviderFields": {
      "stealing_attack": "0",
      "phishing_activities": "0",
      "contract_address": "1",
      "data_source": ""
    },
    "providerLabelCreationTime": null,
    "underlyingIncidentOrTransactionReferences": null,
    "meaning": "Provider assertion at lookup time; not independent theft/actor/control proof. Zero flags do not clear the address."
  },
  "projectContact": {
    "statusID": "1988027597306163591",
    "canonicalURL": "https://x.com/PredictFolio/status/1988027597306163591",
    "primaryResponseURL": "https://cdn.syndication.twimg.com/tweet-result?id=1988027597306163591&lang=en&token=1",
    "createdUTC": "2025-11-10T23:34:49.000Z",
    "authorHandle": "PredictFolio",
    "authorNumericID": "1655904643078144000",
    "responseFile": "raw/project-writer-contact-original.source",
    "responseSHA256": "abd9cee0a4c0f95ab6cba9e893c3ffc8b53c6fd68da5badfa8126ab82ec4aac6",
    "kind": "Project-authored quote-post; not a formal reply.",
    "paraphrase": "PredictFolio directed prospective writers to Car while quoting his invitation to write about Polymarket.",
    "quotedCarStatusID": "1988007657899205079",
    "quotedCarAuthorNumericID": "1966325768499376131",
    "quotedCarCreatedUTC": "2025-11-10T22:15:35.000Z",
    "newSourceVersusExistingClaim": "This exact project status ID was absent from 136 JSON/source/text files in five selected prior directories. The quoted Car writing invitation was already retained in the earlier historical widget review. This bounded ID check does not establish global novelty.",
    "supports": "An author-bound project statement identifying Car as an editorial contact in November 2025, before his June 2026 divestment statement.",
    "doesNotEstablish": [
      "June 2026 handover acknowledgment",
      "legal ownership or completed legal transfer",
      "continuing CMS, repository, deployment or vendor access",
      "a malicious script write path or attacker control"
    ]
  },
  "payload": {
    "SHA256": "0755e767504d8103f6c27b9e765a1026507a17c04513242adb503df7777879e5",
    "MD5": "90cebf34df1a83a7a194b8cabc44e525",
    "SHA1": "f7bcd72f79abacda5462a3a7e3c61da0ea707f5e",
    "bytes": 15187,
    "OTXPulse": "6ae4564eb479948d2335e8d1",
    "pulseCreatedAsReported": "2026-10-30T08:33:18.931000",
    "timestampTimezone": "Not supplied",
    "pulseReference": "https://www.infostealers.com/article/polymarket-breach-alert-wallet-draining-code-found-in-a-third-party-script/",
    "independentEarlierCaptureRecovered": false,
    "staticStringsAreNotObservedIncidentConfig": true
  },
  "sourceTypes": [
    "ScamSniffer public security corpus",
    "MetaMask public domain security corpus",
    "GoPlus current address-risk API",
    "OTX existing file/pulse/analysis records",
    "Website-linked PredictFolio project records",
    "SlowMist incident registry"
  ],
  "URLscan": "Additional bounded facets reused the12known captures; failed queries retained separately.",
  "noNewCarDrainerControlEvidence": true,
  "newFundTransferClaim": false,
  "sourceBodyPolicy": "Exact two public address-risk JSON responses are included. Social, article, profile, full README and malware/report bodies remain local; curated facts/URLs/times/hashes only elsewhere."
}