perinnoab / dirtyhash Goto Github PK

View Code? Open in Web Editor NEW

18.0 1.0 4.0 748 KB

Open source project to help the Web3 community fight frauds and scams.

Home Page: https://dirtyhash.com

Dockerfile 0.40% Makefile 0.64% JavaScript 2.60% TypeScript 95.96% Shell 0.39%

bitcoin etherium machinelearning security web3 cryptocurrency solana

dirtyhash's Introduction

DirtyHash

DirtyHash is a security project to defend against Web3 and Crypto frauds, phishing, ransomware, blackmailers and money laundering. With this you can analyze suspicious entities (wallet addresses, smart contracts, web3 and regular domains, NFTs, social media handles, bank accounts, etc.) to detect frauds and scams. You can report any scams and also share them with the community.

Read the launch post here. Risk scoring of Wallets by Machine Learning is described here.

Setup

Clone the project and set up the machine (in the following instructions a Ubuntu server is assumed). You can easily install node and npm using nvm.

sudo apt-get install nodejs npm
sudo npm install pm2 -g
sudo apt-get install git-all
git clone https://github.com/PerinnoAB/DirtyHash.git

For the DirtyHash server, set up the environment variable GOOGLE_APPLICATION_CREDENTIALS to the path of the Firebase service-account-file.json, where the database is maintained.

e.g.

export GOOGLE_APPLICATION_CREDENTIALS="sa.json"
export PORT=8080
export LOG_DIR=logs
export ML_SERVER="http://10.128.0.10:8081"
export VT_URL='VT_URL'
export VT_API_KEY='VT_API_KEY'
export LOG_FORMAT=":remote-addr :remote-user [:date[clf]] :method :url HTTP/:http-version :status :res[content-length] - :response-time ms"
export SENDGRID_API_KEY = 'SENDGRID_API_KEY'
export SENDGRID_TEMPLATE_ID = 'SENDGRID_TEMPLATE_ID'
export REPORT_EMAIL = 'EMAIL_TO_RECEIVE_REPORT'

Installation

npm install --legacy-peer-deps
npm install --force

Running the app in dev environment

npm run dev

Running the app in prod environment

npm run start

or with pm2

pm2 start npm --name dh-server -- start
pm2 save

pm2 restart with updating env variables

pm2 restart all --update-env

pm2 config

pm2 install pm2-logrotate
pm2 set pm2-logrotate:max_size 1G
pm2 set pm2-logrotate:compress true
pm2 set pm2-logrotate:retain 7
pm2 set pm2-logrotate:rotateModule false
pm2 set pm2-logrotate:rotateInterval '0 0 1 * *'

License

Apache License 2.0

dirtyhash's People

Contributors

Stargazers

Watchers

Forkers

muazan1 sanjumsanthosh boredduckp gorilik324

dirtyhash's Issues

Save the results for addresses for which ML algo has been run once.

IF someone again search for same address, as ML results are saved it, ML prediction wont be run again.

Import Etherscan exchange whitelist

run ML in parallel when while the address in being searched in thr BL/WL db.

to save time to content.

Non-existant addresses have high risk

Example https://dirtyhash.com/search/0xd91748d9c193b4b91687fe6e20e57b0bd7329595

I tested this input by fuzzing

Emails: sign up for after-the-fact notification

New email signup:

You can add as many address as you would like to get notifications about.

Then if any of those addresses is interacting with another address that is (or becomes!) risky they are notified by email.

This can be especially useful because maybe the address is not risky now, but then I send money to it, and other things happen and then DirtyHash flags the address.

Any browser extension/lookup could not have prevented me from this problem beforehand... but it could at least tell me afterwards.

Clearly separate reasoning from factual basis

The report could better separate the conclusions section from the factual basis.

For example, a template could be used for the conclusion section:

SCORE: XXX%

CAVEAT: DirtyHash makes this assessment based on the information below.

EXPLANATION: This is influenced mostly by REASON 1 and REASON 2.

And a template could be used for each information section. This will allow others to independently verify each piece of information and also to apply their own analysis of the data to make their own decisions.

For example EVERY input could use this same format:

NAME / DESCRIPTION: Number and timing of transactions

DATA: 738 transactions were recorded over Ethereum Mainnet and Polygon, also the timing of each transaction was considered

SOURCE: Collected as of 2022-10-03 20:33Z using our private indexing node. You can access this data publicly on Etherscan (LINK)

LIMITATIONS: Our node only checks Ethereum-format addresses on Ethereum Mainnet, Polygon and Optimism networks.

RELIABLIITY: Addresses with over 1,000 transactions may fail to be collected properly at this time.

Also it should be noted which fields are optional or requried.

If the issuer is well known, this reputation would be used in the report.