Traced_

Forensic registrant-cluster attestation — cluster a scam operator's domain portfolio by shared WHOIS selectors, and surface the cover-name slip that leaks the real identity.

Zero dependencies. SHA-256 input fingerprinting for chain-of-custody. Pure, deterministic analysis.

What it does

Feed it a registrations file — one WHOIS record per line, TAB-separated:

domain <TAB> registrant_name <TAB> email <TAB> phone <TAB> registrar <TAB> create_date

It:

1. Clusters the portfolio by shared selectors (email / phone) via union-find, then bridges clusters that share a registrant name (the cover identity).
2. Detects the cover slip — a record whose registrant name diverges from its cluster's cover name = the real-identity lead.
3. Tags findings PROVEN / LEAD / PENDING — the calibration gates are the rigor.
4. Fingerprints the exact input (SHA-256) and accounts for every line.
5. Prints a report — or --json.

Run

cargo run --release                        # built-in demo
cargo run --release -- registrations.tsv
cargo run --release -- --json registrations.tsv

Standard

Findings separate PROVEN (anchored to a public, reproducible source) from LEAD / PENDING (recoverable only via legal process, or a strong lead not yet confirmed). A registrant name is a lead, never a verified legal identity.

The data makes the accusation. We just point.

License

Apache-2.0.