{
  "classification": "New exact provider risk assertion; no new actor identity, account-control link or Car-drainer attribution established.",
  "curatedUTC": "2026-10-31T08:29:53.923707+00:00",
  "initialNewCorpora": [
    "scamsniffer/scam-database",
    "MetaMask/eth-phishing-detect"
  ],
  "initialEightObjectBatch": "Two public repository metadata objects, four exact-indicator searches restricted to both corpora, two primary READMEs. All four searches return zero hits without errors.",
  "indicators": [
    "0x3f99139f1c5854bb628c2e576aaf638e99dffc18",
    "0755e767504d8103f6c27b9e765a1026507a17c04513242adb503df7777879e5",
    "C7xcKKrjUnXK",
    "4c6b64a0-a7ef-4c0f-9c70-3a4e6f89065c"
  ],
  "documentedCorpusLimits": [
    "ScamSniffer primary README says the public domain list has a seven-day delay; an Oct29 incident is newer than that delay at Oct31 capture.",
    "ScamSniffer legacy address files stopped updating in February2024; no fresh collector-negative claim can be derived from them.",
    "MetaMask primary README describes malicious domains; no general wallet-address or malware-hash coverage is established.",
    "Four default-branch code queries are not exhaustive inspection of unindexed/large files, branch history, issues/PRs or every threat-intelligence dataset.",
    "Repo metadata returns code-search indexing status null. Empty search results do not affirm complete corpus coverage."
  ],
  "newAddressProviderFindings": [
    {
      "role": "collector",
      "address": "0x3f99139f1c5854bb628c2e576aaf638e99dffc18",
      "chainId": 137,
      "sourceURL": "https://api.gopluslabs.io/api/v1/address_security/0x3f99139f1c5854bb628c2e576aaf638e99dffc18?chain_id=137",
      "capturedUTC": "2026-10-31T08:27:30.857912+00:00",
      "responseSHA256": "b6362029ec78246a8093eed6e012705c2f9bf36e71dcd75076e6bca4943b5bbe",
      "responseCode": 1,
      "selectedProviderFields": {
        "stealing_attack": "1",
        "phishing_activities": "0",
        "contract_address": "0",
        "data_source": "SlowMist"
      },
      "providerLabelCreationTime": null,
      "underlyingIncidentOrTransactionReferences": null,
      "meaning": "Provider assertion at lookup time; not independent theft/actor/control proof. Zero flags do not clear the address."
    },
    {
      "role": "secondary",
      "address": "0x5a2764fbbe5d139ef0ed988ec5f95320ce730c0b",
      "chainId": 137,
      "sourceURL": "https://api.gopluslabs.io/api/v1/address_security/0x5a2764fbbe5d139ef0ed988ec5f95320ce730c0b?chain_id=137",
      "capturedUTC": "2026-10-31T08:27:31.233597+00:00",
      "responseSHA256": "94239a1ce814acca0f0cdf3cb33bdae40630e099af463f3f5d543630a99a7d19",
      "responseCode": 1,
      "selectedProviderFields": {
        "stealing_attack": "0",
        "phishing_activities": "0",
        "contract_address": "1",
        "data_source": ""
      },
      "providerLabelCreationTime": null,
      "underlyingIncidentOrTransactionReferences": null,
      "meaning": "Provider assertion at lookup time; not independent theft/actor/control proof. Zero flags do not clear the address."
    }
  ],
  "newPositiveFinding": "GoPlus flags exact collector on Polygon with stealing_attack=\"1\" and names SlowMist as its data source. This is new retained provider-label provenance, not a recovered original SlowMist record.",
  "underlyingProvenanceSearch": "One unused exact collector query on x.com/SlowMist_Team returned no result; parent separately covered SlowMist registry and .com exact search.",
  "noNewAttributionOrControlEdge": true,
  "noOriginalPayloadSourceOrActorRecovered": true,
  "labelDateUnknown": true,
  "sourceIndex": "SOURCE-CAPTURE-INDEX.json",
  "coverage": "QUERY-COVERAGE.json",
  "priorComparison": "PRIOR-SOURCES-COMPARED.json",
  "rawIntegrityChecks": {
    "READMEGitBlobHashesRebuilt": 2,
    "directHTTPBodySHA256Matched": 5,
    "exactAddressRoutesAndProviderSuccessChecked": 2,
    "initialRepoPublicVisibilityVerified": 2
  },
  "retainedErrors": "Old GoPlus docs route404 and web-tool access errors preserved; current official index/schema and both unauthenticated API responses succeeded.",
  "publicationPolicy": "Curated metadata only; full bodies remain local. No site/old evidence edits, sample upload, submission, rescan, signing, attacker/exfil request or outreach."
}