Decoding Cloudflare cfemail XOR obfuscation

Many sites hide emails as <span class="__cf_email__" data-cfemail="<hex>">. The decode is dead simple: hex-decode the string, take the first byte as the XOR key, XOR every remaining byte with it to recover ASCII. Also: most modern luxury apartment sites are JS-rendered SPAs that return nothing useful to curl — emails (if exposed at all) live behind contact forms, not on the homepage. Most properties expose only a form, no public email address.