crypttrace 0.9.0__tar.gz → 0.10.0__tar.gz

{crypttrace-0.9.0/src/crypttrace.egg-info → crypttrace-0.10.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: crypttrace
-Version: 0.9.0
+Version: 0.10.0
 Summary: OSINT toolkit for crypto investigations: trace stolen funds across Ethereum, Bitcoin, Tron and Solana
 Author: bobslayerX
 License-Expression: MIT
@@ -338,11 +338,16 @@ Tested on a documented Tron case from August 2026: from the victim's wallet it
 finds the 2,527,862 USDT sent to `TDDDHi…rCr9Ps`, a look-alike of
 `TDDD34…rCr9Ps`, an address the wallet had paid 8.4M USDT in all. From the
 attacker's side it finds the same payment and two more victims of $2.4M and
-$2.0M, each lured by a look-alike created three to twelve minutes earlier.
-
-Cheap look-alikes match only one or two characters at each end, which happens
-by chance; those are reported only when they arrived as bait after the real
-address was in use.
+$2.0M, each lured by a look-alike created three to twelve minutes earlier, and
+for all three it names the address that was imitated.
+
+Look-alikes come in three strengths. Matching several characters at both ends is
+reported on sight. So is one that copies only the ending, as long as the shared
+ending is long enough to be no accident (6 characters on Tron and Solana, 7 on
+bech32 Bitcoin, 8 on hex) — one of the three victims above was caught that way,
+by `…E1doqb`. Cheap look-alikes that match one or two characters at each end
+happen by chance, so they are reported only when they arrived as bait after the
+real address was in use.
 
 ### Off-ramp detection
 

{crypttrace-0.9.0 → crypttrace-0.10.0}/README.md

@@ -304,11 +304,16 @@ Tested on a documented Tron case from August 2026: from the victim's wallet it
 finds the 2,527,862 USDT sent to `TDDDHi…rCr9Ps`, a look-alike of
 `TDDD34…rCr9Ps`, an address the wallet had paid 8.4M USDT in all. From the
 attacker's side it finds the same payment and two more victims of $2.4M and
-$2.0M, each lured by a look-alike created three to twelve minutes earlier.
-
-Cheap look-alikes match only one or two characters at each end, which happens
-by chance; those are reported only when they arrived as bait after the real
-address was in use.
+$2.0M, each lured by a look-alike created three to twelve minutes earlier, and
+for all three it names the address that was imitated.
+
+Look-alikes come in three strengths. Matching several characters at both ends is
+reported on sight. So is one that copies only the ending, as long as the shared
+ending is long enough to be no accident (6 characters on Tron and Solana, 7 on
+bech32 Bitcoin, 8 on hex) — one of the three victims above was caught that way,
+by `…E1doqb`. Cheap look-alikes that match one or two characters at each end
+happen by chance, so they are reported only when they arrived as bait after the
+real address was in use.
 
 ### Off-ramp detection
 

{crypttrace-0.9.0 → crypttrace-0.10.0}/src/crypttrace/__init__.py

@@ -1,2 +1,2 @@
 """crypttrace — OSINT crypto investigation CLI."""
-__version__ = "0.9.0"
+__version__ = "0.10.0"

{crypttrace-0.9.0 → crypttrace-0.10.0}/src/crypttrace/fetchers/tron.py

@@ -82,10 +82,31 @@ def balance(address: str) -> float:
     return (data[0].get("balance") or 0) / SUN
 
 
+PAGE = 200    # TronGrid's page size
+
+
+def _pages(path: str, limit: int) -> List[Dict]:
+    """Up to `limit` items, following TronGrid's fingerprint cursor page by page.
+
+    One page (200 items) used to be all we read, so a busy wallet's history
+    ended a few days back and older transfers were simply invisible."""
+    items: List[Dict] = []
+    params = {"limit": min(limit, PAGE)}
+    while len(items) < limit:
+        d = _get(path, dict(params))
+        page = d.get("data", []) or []
+        items += page
+        cursor = (d.get("meta") or {}).get("fingerprint")
+        if len(page) < params["limit"] or not cursor:
+            break
+        params["fingerprint"] = cursor
+    return items[:limit]
+
+
 def _native(address: str, limit: int) -> List[Dict]:
-    d = _get(f"/v1/accounts/{address}/transactions", {"limit": min(limit, 200)})
+    # the endpoint lists every transaction type; TRX transfers are a subset of it
     rows = []
-    for tx in d.get("data", []) or []:
+    for tx in _pages(f"/v1/accounts/{address}/transactions", limit):
         try:
             c = (tx.get("raw_data", {}).get("contract") or [])[0]
             if c.get("type") != "TransferContract":
@@ -106,9 +127,8 @@ def _native(address: str, limit: int) -> List[Dict]:
 
 def token_transfers(address: str, limit: int = 200) -> List[Dict]:
     """TRC20 transfers (USDT and friends) — already base58 in the API."""
-    d = _get(f"/v1/accounts/{address}/transactions/trc20", {"limit": min(limit, 200)})
     rows = []
-    for t in d.get("data", []) or []:
+    for t in _pages(f"/v1/accounts/{address}/transactions/trc20", limit):
         # the endpoint also lists Approval events, whose "value" is an allowance
         # (often 2**256-1), not money that moved
         if t.get("type", "Transfer") != "Transfer":

{crypttrace-0.9.0 → crypttrace-0.10.0}/src/crypttrace/poisoning.py

@@ -19,6 +19,7 @@ Three views of the same attack:
   * campaign(address)   — an address sending zero/dust transfers to many
     unrelated wallets (the dust-sending style, common on Tron).
 """
+import math
 from collections import defaultdict
 from typing import Dict, List, Optional, Tuple
 
@@ -30,6 +31,20 @@ from crypttrace import analysis, assets, chains
 # the look-alike arrived with bait after the genuine address was in use.
 STRONG = (3, 3, 7)          # min prefix, min suffix, min total
 WEAK = (1, 2, 3)
+# Many people check only the ending, and poisoners know it: a look-alike can match
+# the last characters alone. That is strong evidence once the shared ending carries
+# 32 bits — 6 base58 characters, 7 bech32, 8 hex — about 1 in 4 billion by chance.
+SUFFIX_BITS = 32
+
+
+def _suffix_chars(address: str, chain: str) -> int:
+    if chains.is_evm(chain):
+        bits = 4.0                                  # hex
+    elif address.lower().startswith(("bc1", "tb1")):
+        bits = 5.0                                  # bech32
+    else:
+        bits = 5.86                                 # base58: Tron, Solana, legacy Bitcoin
+    return math.ceil(SUFFIX_BITS / bits)
 # A campaign: this many distinct recipients of zero/dust transfers.
 CAMPAIGN_MIN_TARGETS = 10
 
@@ -62,9 +77,12 @@ def resemblance(a: str, b: str, chain: str) -> Optional[str]:
     if chains.norm_addr(a, chain) == chains.norm_addr(b, chain):
         return None
     pre, suf = match_lengths(a, b, chain)
-    for name, (p, s, t) in (("strong", STRONG), ("weak", WEAK)):
-        if pre >= p and suf >= s and pre + suf >= t:
-            return name
+    p, s, t = STRONG
+    if (pre >= p and suf >= s and pre + suf >= t) or suf >= _suffix_chars(a, chain):
+        return "strong"
+    p, s, t = WEAK
+    if pre >= p and suf >= s and pre + suf >= t:
+        return "weak"
     return None
 
 
@@ -128,13 +146,17 @@ def lookalikes(address: str, chain: str, limit: int = 1000) -> List[dict]:
             c["sent_first_ts"] = ts if c["sent_first_ts"] is None else min(c["sent_first_ts"], ts)
 
     # only compare addresses that could match: bucket by visible ends
+    # (and by the ending alone, for look-alikes that only imitate the last characters)
     buckets = defaultdict(list)
     for a in seen:
         b = _body(a, chain)
         if len(b) >= WEAK[0] + WEAK[1]:
-            buckets[(b[:WEAK[0]], b[-WEAK[1]:])].append(a)
+            buckets[("ends", b[:WEAK[0]], b[-WEAK[1]:])].append(a)
+        n = _suffix_chars(a, chain)
+        if len(b) > n:
+            buckets[("tail", b[-n:])].append(a)
 
-    findings = []
+    findings, compared = [], set()
     for group in buckets.values():
         if len(group) < 2:
             continue
@@ -144,7 +166,10 @@ def lookalikes(address: str, chain: str, limit: int = 1000) -> List[dict]:
             return (c["sent_first_ts"] is None, c["sent_first_ts"] or c["first_ts"], c["first_ts"])
         genuine = min(group, key=rank)
         for fake in group:
-            level = resemblance(genuine, fake, chain) if fake != genuine else None
+            if fake == genuine or (genuine, fake) in compared:
+                continue            # a pair can sit in both kinds of bucket
+            compared.add((genuine, fake))
+            level = resemblance(genuine, fake, chain)
             if not level:
                 continue
             g, f = seen[genuine], seen[fake]

{crypttrace-0.9.0 → crypttrace-0.10.0/src/crypttrace.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: crypttrace
-Version: 0.9.0
+Version: 0.10.0
 Summary: OSINT toolkit for crypto investigations: trace stolen funds across Ethereum, Bitcoin, Tron and Solana
 Author: bobslayerX
 License-Expression: MIT
@@ -338,11 +338,16 @@ Tested on a documented Tron case from August 2026: from the victim's wallet it
 finds the 2,527,862 USDT sent to `TDDDHi…rCr9Ps`, a look-alike of
 `TDDD34…rCr9Ps`, an address the wallet had paid 8.4M USDT in all. From the
 attacker's side it finds the same payment and two more victims of $2.4M and
-$2.0M, each lured by a look-alike created three to twelve minutes earlier.
-
-Cheap look-alikes match only one or two characters at each end, which happens
-by chance; those are reported only when they arrived as bait after the real
-address was in use.
+$2.0M, each lured by a look-alike created three to twelve minutes earlier, and
+for all three it names the address that was imitated.
+
+Look-alikes come in three strengths. Matching several characters at both ends is
+reported on sight. So is one that copies only the ending, as long as the shared
+ending is long enough to be no accident (6 characters on Tron and Solana, 7 on
+bech32 Bitcoin, 8 on hex) — one of the three victims above was caught that way,
+by `…E1doqb`. Cheap look-alikes that match one or two characters at each end
+happen by chance, so they are reported only when they arrived as bait after the
+real address was in use.
 
 ### Off-ramp detection