{
 "report": "2026-09-26 ARION cold read \u2014 'Hold & Earn' OKX-impersonation drainer kit",
 "dated_utc": "2026-09-26T22:40-22:55Z",
 "host": {
  "domain": "0kxloyaltycommunityopenhub-ou9s.netlify.app",
  "cdn": "Netlify",
  "root_get": {
   "status": 200,
   "bytes": 0
  },
  "index_get": {
   "status": 200,
   "bytes": 52547,
   "sha256": "c31531f80234c08f213bb54e8fba538fcfdaa9979da476e0ae4c90dc9dd4b3e5"
  },
  "scanner_evasion": "blank root; real kit only at /index.html"
 },
 "loader": {
  "path": "/0be3f72e63.js",
  "bytes": 5489,
  "sha256": "30bbc2d3ff0508ab73b168d3a7a21f039b4c586960ffa4e6c2ee9340baca991f",
  "anti_sandbox": [
   "HeadlessChrome",
   "PhantomJS",
   "callPhantom",
   "__nightmare",
   "_phantom",
   "__phantomjs",
   "__playwright",
   "__RC__",
   "webdriver",
   "outerWidth==0"
  ],
  "c2_pointer": {
   "chain": "eip155:56",
   "contract": "0x1AC7d768E37B147c993dE943D704c4e92d7861A1",
   "selector": "0xb68d1809",
   "rpcs": [
    "bsc-dataseed1",
    "bsc-dataseed2",
    "bsc.blockrazor.xyz",
    "bsc-rpc.publicnode.com"
   ],
   "resolved_to": "https://zenzenzendrnzenzenzenzen.xyz",
   "verified_independent_rpcs": 2
  }
 },
 "c2": {
  "domain": "zenzenzendrnzenzenzenzen.xyz",
  "permit_key": "pBhX0kq6sh1YGmLjxWLk",
  "endpoints": {
   "POST /x7k/gc": {
    "status": 200,
    "bytes": 7676,
    "kind": "stage2-eval"
   },
   "POST /x7k/gf": {
    "status": 200,
    "bytes": 1442996,
    "kind": "drain-bundle-LZ"
   },
   "POST /x7k": {
    "status": 301
   },
   "GET /": {
    "status": 404
   }
  }
 },
 "harvest": {
  "endpoint": "POST same-origin /api/wallet-balance",
  "body": "{wallet,chain}",
  "role": "server-side victim triage (eligible flag gates claim flow)"
 },
 "skinning": {
  "param": "?contract=<addr>",
  "source": "api.dexscreener.com/latest/dex/search",
  "effect": "page repaints as any named token"
 },
 "unknowns": [
  "drain destination address (inside signed flow of 1.44MB bundle)",
  "victim count",
  "config-contract deploy date"
 ]
}