Look-alike addresses
Compare similar address text and inspect where it appeared, without assuming an attack occurred.
#Plain languageIn plain terms
Addresses are long and nobody reads all of one. People check the first few characters and the last few. Attackers know this. They generate an address that starts and ends the same as one you already use, then send you a tiny or empty transfer from it.
Address poisoning can exploit that confusion. Forensia checks visual similarity only: matching ends do not establish a poisoning attempt, a first introduction or an actual mistaken payment.
#How it worksHow it works
- Collect addresses in unique, non-conflicting activity rows involving the subject, with a captured source reference. Token-reported senders are not necessarily authorized senders.
- For each, take the first four and last four characters after the
0x. - Group addresses that share both.
- Show bounded groups with at least two different addresses. Each member opens its retrieved activity and source; missing or ambiguous references are not replaced with another row from the same transaction.
#Technical detailThe exact rules
Eight hex characters are compared: four at the start and four at the end. The 32 in the middle are ignored. Comparison ignores letter case. The subject's own address is excluded.
This retrieved sample is not uniformly random. Vanity generation, deliberate selection and incomplete history make a random-pair probability unsuitable as a likelihood of attack. No probability or attacker label is assigned.
| Setting | Value |
|---|---|
| Characters compared | First 4 and last 4 |
| Smallest group reported | 2 addresses |
| Maximum groups | 4 |
| Maximum addresses per group | 8 |
| Maximum retrieved occurrences per address | 4 |
The finding is finding:lookalike-counterparties, class lead, confidence unassessed, methodology version 2.0.0 for new captures. It runs for address lookups on Ethereum-style networks. Existing saved findings keep their original version. The report includes the same address-to-occurrence-to-source mapping.
#LimitsWhat it does not tell you
- Only addresses already in the retrieved activity are compared. A poisoning attempt outside that window is not seen.
- There is no check for tiny or zero-value transfers. The match is on the address shape alone.
- The same party can generate several addresses with matching ends on purpose, which is harmless.
- The subject's own address is not compared against its counterparties.
- When sending funds, confirm the full address character by character.