crypttrace 0.7.0__tar.gz → 0.8.0__tar.gz

{crypttrace-0.7.0/src/crypttrace.egg-info → crypttrace-0.8.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: crypttrace
-Version: 0.7.0
+Version: 0.8.0
 Summary: OSINT toolkit for crypto investigations: trace stolen funds across Ethereum, Bitcoin, Tron and Solana
 Author: bobslayerX
 License-Expression: MIT
@@ -131,7 +131,11 @@ crypttrace serve            # then open http://127.0.0.1:8000
 Paste an address, pick a chain and direction, and get an interactive fund-flow
 graph: nodes coloured by what they are, arrows showing where value went, click a
 node for its full profile, click a transfer line to open it on the block
-explorer. A side panel shows the profile, first-funder chain and off-ramp check.
+explorer. A side panel shows the profile, first-funder chain, off-ramp check
+and whether USDT/USDC at the address is frozen. Tabs add the assessment, the
+timeline, the list of who sent funds here, and address poisoning (look-alikes
+planted in the wallet's history, and payments lured by this address). **Case
+file** downloads the same one-page HTML report `crypttrace report` writes.
 Everything runs on your machine — nothing is uploaded anywhere.
 
 This exists so non-technical victims can use the tool at all: a form and a

{crypttrace-0.7.0 → crypttrace-0.8.0}/README.md

@@ -97,7 +97,11 @@ crypttrace serve            # then open http://127.0.0.1:8000
 Paste an address, pick a chain and direction, and get an interactive fund-flow
 graph: nodes coloured by what they are, arrows showing where value went, click a
 node for its full profile, click a transfer line to open it on the block
-explorer. A side panel shows the profile, first-funder chain and off-ramp check.
+explorer. A side panel shows the profile, first-funder chain, off-ramp check
+and whether USDT/USDC at the address is frozen. Tabs add the assessment, the
+timeline, the list of who sent funds here, and address poisoning (look-alikes
+planted in the wallet's history, and payments lured by this address). **Case
+file** downloads the same one-page HTML report `crypttrace report` writes.
 Everything runs on your machine — nothing is uploaded anywhere.
 
 This exists so non-technical victims can use the tool at all: a form and a

{crypttrace-0.7.0 → crypttrace-0.8.0}/src/crypttrace/__init__.py

@@ -1,2 +1,2 @@
 """crypttrace — OSINT crypto investigation CLI."""
-__version__ = "0.7.0"
+__version__ = "0.8.0"

{crypttrace-0.7.0 → crypttrace-0.8.0}/src/crypttrace/report.py

@@ -174,22 +174,32 @@ def collect(address: str, chain: str, depth: int, branching: int, asset=None) ->
 def generate(address: str, chain: str, depth: int, branching: int,
              out_dir: Path, asset=None, guidance: Optional[dict] = None) -> Dict[str, Path]:
     """Write <case>.html, <case>.md and <case>.json; returns their paths."""
-    data = collect(address, chain, depth, branching, asset)
-    if guidance:
-        data["guidance"] = guidance
+    data, raw, digest = build(address, chain, depth, branching, asset, guidance)
     out_dir.mkdir(parents=True, exist_ok=True)
-    base = f"{chain}_{address[:10]}_{datetime.now().strftime('%Y%m%d_%H%M%S')}"
+    base = case_name(address, chain)
     paths = {k: out_dir / f"{base}.{k}" for k in ("html", "md", "json")}
-    raw = json.dumps(data, indent=2, ensure_ascii=False, default=str)
     # bytes, not text mode: on Windows text mode turns LF into CRLF, and the hash
     # printed in the HTML would no longer match the file next to it
     paths["json"].write_bytes(raw.encode("utf-8"))
-    digest = hashlib.sha256(raw.encode("utf-8")).hexdigest()
     paths["md"].write_text(_render_md(data, paths["json"].name), encoding="utf-8")
     paths["html"].write_text(render_html(data, raw, digest, paths["json"].name), encoding="utf-8")
     return paths
 
 
+def case_name(address: str, chain: str) -> str:
+    return f"{chain}_{address[:10]}_{datetime.now().strftime('%Y%m%d_%H%M%S')}"
+
+
+def build(address: str, chain: str, depth: int, branching: int, asset=None,
+          guidance: Optional[dict] = None):
+    """(data, raw JSON, its SHA-256) — the web UI renders the page from this in memory."""
+    data = collect(address, chain, depth, branching, asset)
+    if guidance:
+        data["guidance"] = guidance
+    raw = json.dumps(data, indent=2, ensure_ascii=False, default=str)
+    return data, raw, hashlib.sha256(raw.encode("utf-8")).hexdigest()
+
+
 # ------------------------------------------------------------------ markdown
 
 def _render_md(d: dict, json_name: str) -> str:
@@ -460,8 +470,10 @@ def render_html(d: dict, raw_json: str, digest: str, json_name: str) -> str:
     P.append(f"<h2>Method and limits</h2><p>{_e(_METHOD)}</p>")
     if d.get("errors"):
         P.append("<p class='muted'>Parts that could not be read: " + _e("; ".join(d["errors"])) + "</p>")
-    P.append(f"<p class='muted'>The raw data is saved next to this file as <span class='mono'>{_e(json_name)}"
-             f"</span> (SHA-256 <span class='mono'>{digest}</span>) and embedded below for analysts.</p>")
+    where = (f"saved next to this file as <span class='mono'>{_e(json_name)}</span>"
+             if json_name else "embedded in this file")
+    P.append(f"<p class='muted'>The raw data is {where} (SHA-256 of the JSON: "
+             f"<span class='mono'>{digest}</span>) and embedded below for analysts.</p>")
     # JSON inside <script type=application/json> is data, never executed. Every "<" is
     # written as < (still valid JSON), so a crafted token or label name can neither
     # close the element nor push the parser into its "<!--<script" escaping states.

{crypttrace-0.7.0 → crypttrace-0.8.0}/src/crypttrace/web/index.html

@@ -228,6 +228,7 @@
   <select id="depth" title="Depth"><option>2</option><option selected>3</option><option>4</option><option>5</option></select>
   <button id="go">Investigate</button>
   <button id="fit" class="ghost" title="Fit graph to view">Fit</button>
+  <button id="casefile" class="ghost" title="Download a one-page case file for an exchange or the police">Case file</button>
 </div>
 
 <div class="legend">
@@ -246,6 +247,7 @@
     <button class="tab" data-view="assess">Assessment</button>
     <button class="tab" data-view="timeline">Timeline</button>
     <button class="tab" data-view="victims">Who sent funds here</button>
+    <button class="tab" data-view="poison">Poisoning</button>
   </div>
   <div class="stage">
     <div class="loader" id="loader"></div>
@@ -255,6 +257,7 @@
     <div class="view" id="v-assess"></div>
     <div class="view" id="v-timeline"></div>
     <div class="view" id="v-victims"></div>
+    <div class="view" id="v-poison"></div>
     <div class="scaleview" id="scaleview" style="display:none">100%</div>
     <div class="zoomctl" id="zoomctl">
       <button id="zin"  title="Zoom in">+</button>
@@ -474,7 +477,7 @@ async function run(){
   setStatus('tracing the chain…',false,true); loader(35);
   $('#hint').classList.add('hide');
   loaded={};                       // new address -> other views must reload
-  $('#v-timeline').innerHTML=''; $('#v-victims').innerHTML=''; $('#v-assess').innerHTML='';
+  $('#v-timeline').innerHTML=''; $('#v-victims').innerHTML=''; $('#v-assess').innerHTML=''; $('#v-poison').innerHTML='';
   try{
     const dir=$('#direction').value;
     const g=await api(`/api/trace?address=${q(a)}&chain=${chain()}&depth=${$('#depth').value}&asset=${q($('#asset').value)}&direction=${dir}`);
@@ -524,12 +527,14 @@ function showView(v){
   $('#v-assess').classList.toggle('on',v==='assess');
   $('#v-timeline').classList.toggle('on',v==='timeline');
   $('#v-victims').classList.toggle('on',v==='victims');
+  $('#v-poison').classList.toggle('on',v==='poison');
   const a=$('#addr').value.trim();
   if(a && !loaded[v+a]) {
     loaded[v+a]=true;
     if(v==='timeline') loadTimeline(a);
     if(v==='victims') loadVictims(a);
     if(v==='assess') loadAssessment(a);
+    if(v==='poison') loadPoisoning(a);
   }
 }
 document.querySelectorAll('.tab').forEach(t=>t.onclick=()=>showView(t.dataset.view));
@@ -647,6 +652,67 @@ async function verifyInto(container, addr){
   }catch(e){ slot.innerHTML=`<span class="vfy vfy-unavailable">verification unavailable</span>`; }
 }
 
+// Address poisoning: look-alikes planted in this wallet's history, and — seen from
+// the other side — payments this address received right after luring the payer.
+async function loadPoisoning(a){
+  const el=$('#v-poison');
+  el.innerHTML='<div class="muted"><span class="spin"></span>Comparing every address in this history…</div>';
+  try{
+    const r=await api(`/api/poisoning?address=${q(a)}&chain=${chain()}`);
+    const amt=v=>Number(v).toLocaleString(undefined,{maximumFractionDigits:2});
+    const addr=x=>`<a class="mono" href="${safeUrl(addrUrl(x))}" target="_blank" rel="noopener">${esc(x)}</a>`;
+    let h='';
+    for(const x of r.lured||[]){
+      h+=`<div class="verdict">Lured payment: ${addr(x.payer)} paid <b>${amt(x.paid)} ${esc(x.symbol)}</b>
+        on ${dstamp(x.paid_ts)} UTC, right after this address lured it (${esc(x.lure)}).
+        ${x.imitates?`It imitates ${addr(x.imitates)}, an address the payer had really used.`
+          :'<span class="muted">The imitated address was not found in the payer\'s recent history.</span>'}</div>`;
+    }
+    const paid=(r.lookalikes||[]).filter(p=>p.sent_to_lookalike>0);
+    for(const p of paid){
+      h+=`<div class="verdict">Money went to a look-alike: <b>${amt(p.sent_to_lookalike)} ${esc(p.symbols.join('/'))}</b>
+        <div class="kv"><span class="k">real address</span><span class="v">${addr(p.genuine)}</span></div>
+        <div class="kv"><span class="k">look-alike</span><span class="v">${addr(p.lookalike)}</span></div>
+        <div class="muted">Same first ${p.matching.prefix} and last ${p.matching.suffix} characters;
+        the look-alike first appeared ${dstamp(p.lookalike_first_seen)} UTC.</div></div>`;
+    }
+    if(r.campaign){
+      h+=`<div class="verdict">Poisoning campaign: this address sent ${r.campaign.bait_transfers} zero, dust or
+        counterfeit transfers to ${r.campaign.targets} different wallets.</div>`;
+    }
+    const planted=(r.lookalikes||[]).filter(p=>!(p.sent_to_lookalike>0));
+    if(planted.length){
+      h+=`<h3 style="font-size:11px;letter-spacing:.09em;color:var(--dim);margin:16px 0 8px">
+        ${planted.length} LOOK-ALIKE ADDRESS(ES) PLANTED IN THIS HISTORY — NEVER COPY AN ADDRESS FROM HERE</h3>
+        <table class="grid"><thead><tr><th>Look-alike</th><th>Imitates</th><th>Match</th>
+        <th style="text-align:right">Bait</th><th>First seen (UTC)</th></tr></thead><tbody>`+
+        planted.map(p=>`<tr><td>${addr(p.lookalike)}</td><td>${addr(p.genuine)}</td>
+          <td>${esc(p.resemblance)} (${p.matching.prefix}+${p.matching.suffix})</td>
+          <td class="num">${p.bait_transfers}</td><td>${dstamp(p.lookalike_first_seen)}</td></tr>`).join('')+
+        '</tbody></table>';
+    }
+    el.innerHTML=h||'<div class="muted">No look-alike addresses or poisoning pattern in this history.</div>';
+  }catch(e){ el.innerHTML=`<div class="err">${esc(e.message)}</div>`; }
+}
+
+// The case file: the same one-page HTML `crypttrace report` writes, built by the
+// backend and handed to the browser as a download.
+async function downloadCaseFile(){
+  const a=$('#addr').value.trim(), b=$('#casefile');
+  if(!a){ setStatus('enter an address',true); return; }
+  b.disabled=true; setStatus('building the case file…',false,true);
+  try{
+    const r=await fetch(`/api/report?address=${q(a)}&chain=${chain()}&asset=${q($('#asset').value)}&depth=${q($('#depth').value)}`);
+    if(!r.ok){ const j=await r.json().catch(()=>({})); throw new Error(j.error||`HTTP ${r.status}`); }
+    const name=((r.headers.get('Content-Disposition')||'').match(/filename="([^"]+)"/)||[])[1]||'case-file.html';
+    const u=URL.createObjectURL(await r.blob()), l=document.createElement('a');
+    l.href=u; l.download=name; l.click(); URL.revokeObjectURL(u);
+    setStatus(`case file saved: ${name}`);
+  }catch(e){ setStatus(e.message,true); }
+  finally{ b.disabled=false; }
+}
+$('#casefile').addEventListener('click',downloadCaseFile);
+
 function downloadCsv(){
   const head=['address','hop',`amount_sent_${victimSym}`,'transactions','first_seen_utc','last_seen_utc','label','explorer'];
   const body=victimRows.map(r=>[r.address,r.hop,r.value,r.txs,dstamp(r.first_seen),dstamp(r.last_seen),

{crypttrace-0.7.0 → crypttrace-0.8.0}/src/crypttrace/webapp.py

@@ -10,7 +10,7 @@ Launch with:  crypttrace serve   (then open http://127.0.0.1:8000)
 from datetime import datetime
 from pathlib import Path
 
-from flask import Flask, jsonify, request, send_from_directory
+from flask import Flask, Response, jsonify, request, send_from_directory
 
 from crypttrace.fetchers import etherscan
 from crypttrace.labels import labels
@@ -255,6 +255,40 @@ def create_app() -> Flask:
             return jsonify({"error": str(e)}), 400
         return jsonify({"hops": hops})
 
+    @app.route("/api/poisoning")
+    def api_poisoning():
+        addr = request.args.get("address", "")
+        chain = request.args.get("chain", "eth")
+        bad = validate(addr, chain)
+        if bad:
+            return jsonify({"error": bad}), 400
+        from crypttrace import poisoning
+        try:
+            return jsonify({"lookalikes": poisoning.lookalikes(addr, chain),
+                            "lured": poisoning.baited_payments(addr, chain),
+                            "campaign": poisoning.campaign(addr, chain)})
+        except _KNOWN_ERRORS as e:
+            return jsonify({"error": str(e)}), 400
+
+    @app.route("/api/report")
+    def api_report():
+        """The HTML case file, built in memory and handed over as a download."""
+        addr = request.args.get("address", "")
+        chain = request.args.get("chain", "eth")
+        bad = validate(addr, chain)
+        if bad:
+            return jsonify({"error": bad}), 400
+        from crypttrace import report as report_mod
+        try:
+            asset = assets.resolve_asset(request.args.get("asset") or None, chain)
+            depth = max(1, min(5, int(request.args.get("depth", 3))))
+            data, raw, digest = report_mod.build(addr, chain, depth, 3, asset)
+        except _KNOWN_ERRORS as e:
+            return jsonify({"error": str(e)}), 400
+        name = report_mod.case_name(addr, chain) + ".html"
+        return Response(report_mod.render_html(data, raw, digest, None), mimetype="text/html",
+                        headers={"Content-Disposition": f'attachment; filename="{name}"'})
+
     @app.route("/api/freeze")
     def api_freeze():
         addr = request.args.get("address", "")

{crypttrace-0.7.0 → crypttrace-0.8.0/src/crypttrace.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: crypttrace
-Version: 0.7.0
+Version: 0.8.0
 Summary: OSINT toolkit for crypto investigations: trace stolen funds across Ethereum, Bitcoin, Tron and Solana
 Author: bobslayerX
 License-Expression: MIT
@@ -131,7 +131,11 @@ crypttrace serve            # then open http://127.0.0.1:8000
 Paste an address, pick a chain and direction, and get an interactive fund-flow
 graph: nodes coloured by what they are, arrows showing where value went, click a
 node for its full profile, click a transfer line to open it on the block
-explorer. A side panel shows the profile, first-funder chain and off-ramp check.
+explorer. A side panel shows the profile, first-funder chain, off-ramp check
+and whether USDT/USDC at the address is frozen. Tabs add the assessment, the
+timeline, the list of who sent funds here, and address poisoning (look-alikes
+planted in the wallet's history, and payments lured by this address). **Case
+file** downloads the same one-page HTML report `crypttrace report` writes.
 Everything runs on your machine — nothing is uploaded anywhere.
 
 This exists so non-technical victims can use the tool at all: a form and a