← Back to methodology index

Address poisoning

poisoning

Address poisoning is a Leeri screening rule for TRON that detects the following: Dust transfers from lookalike addresses crafted to resemble a real payee this wallet has genuinely paid before.

What it detects

Dust transfers from lookalike addresses crafted to resemble a real payee this wallet has genuinely paid before.

When it fires

An incoming near-zero-value transfer's sender address shares enough trailing characters with a genuine past recipient to plausibly be mistaken for it if copied from transaction history.

What it means

The address is the target of an address-poisoning attack: someone sent it dust from lookalikes of its real payees, hoping a later payment is copied from history to the wrong address. It says nothing about the source of the address's own funds and is a warning for the address owner, not a risk signal.

What to do

No compliance action is usually needed. If you are in contact with the owner, warn them never to copy a recipient from transaction history.

Chains

Wallet security warning for the address owner · not scored from ruleset v11