"A TON of Privacy" formally called ATOP ... is a tool for conducting OSINT investigations on TON NFTs.

Navigation

Verified details

These details have been verified by PyPI
Maintainers
Avatar for aaarghhh from gravatar.com aaarghhh

Unverified details

These details have not been verified by PyPI
Project links
Meta

Project description

A TON of privacy v0.2.24

ATOP - A tool for investigating TON network and its NFT.

"A TON of Privacy" formally called ATOP ... is a tool for conducting OSINT investigations on TON (Telegram ๐Ÿ™ƒ) NFTs.

The TON network is increasingly integrated with the Telegram ecosystem, via NFT. Telegram allows people to purchase numbers, domains and nicknames through cryptocurrency.

ATOP aims to give visibility into the addresses and details of the holders of these assets. Using this tool you will be able to retrieve:

  • Address of the owner
  • Scam status
  • Balance
  • Other related NFT

ATOP supports:

  • TON DNS
  • TON NICKNAME
  • TON PHONE NUMBERS (+888)

INSTALLATION

1. Git clone the repository.

$ git clone https://github.com/aaarghhh/a_TON_of_privacy.git
$ cd a_TON_of_privacy

Install dependencies using pip and the file requirements.

$ pip install -r requirements.txt

2. Via pipx

$ pipx install atop

USAGE

If atop was installed as a global package (pipx):

$ a-ton-of-privacy --target "+888 12345678"

If atop was installed cloning the repository, from the root directory of the repository:

cd src/
# python -m atop.atop --target @whatiamlookingfor

It retrieves information about a:

  • Telephone numbers
$ python3 /src/atop/atop.py --target "+888 12345678"
  • Nickname
$ python3 /src/atop/atop.py --target @telegram_nickname
  • Domain
$ python3 /src/atop/atop.py --target atop.ton

The OUTPUT will contain information about the owner of the asset.

Welcome in the realm of.....

 โ–„โ–„โ–„         โ–„โ–„โ–„โ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–“ โ–’โ–ˆโ–ˆโ–ˆโ–ˆโ–ˆ   โ–ˆโ–ˆโ–ˆโ–„    โ–ˆ     โ–’โ–ˆโ–ˆโ–ˆโ–ˆโ–ˆ    โ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–’   
โ–’โ–ˆโ–ˆโ–ˆโ–ˆโ–„       โ–“  โ–ˆโ–ˆโ–’ โ–“โ–’โ–’โ–ˆโ–ˆโ–’  โ–ˆโ–ˆโ–’ โ–ˆโ–ˆ โ–€โ–ˆ   โ–ˆ    โ–’โ–ˆโ–ˆโ–’  โ–ˆโ–ˆโ–’โ–“โ–ˆโ–ˆ   โ–’    
โ–’โ–ˆโ–ˆ  โ–€โ–ˆโ–„     โ–’ โ–“โ–ˆโ–ˆโ–‘ โ–’โ–‘โ–’โ–ˆโ–ˆโ–‘  โ–ˆโ–ˆโ–’โ–“โ–ˆโ–ˆ  โ–€โ–ˆ โ–ˆโ–ˆโ–’   โ–’โ–ˆโ–ˆโ–‘  โ–ˆโ–ˆโ–’โ–’โ–ˆโ–ˆโ–ˆโ–ˆ โ–‘    
โ–‘โ–ˆโ–ˆโ–„โ–„โ–„โ–„โ–ˆโ–ˆ    โ–‘ โ–“โ–ˆโ–ˆโ–“ โ–‘ โ–’โ–ˆโ–ˆ   โ–ˆโ–ˆโ–‘โ–“โ–ˆโ–ˆโ–’  โ–โ–Œโ–ˆโ–ˆโ–’   โ–’โ–ˆโ–ˆ   โ–ˆโ–ˆโ–‘โ–‘โ–“โ–ˆโ–’  โ–‘    
 โ–“โ–ˆ   โ–“โ–ˆโ–ˆโ–’     โ–’โ–ˆโ–ˆโ–’ โ–‘ โ–‘ โ–ˆโ–ˆโ–ˆโ–ˆโ–“โ–’โ–‘โ–’โ–ˆโ–ˆโ–‘   โ–“โ–ˆโ–ˆโ–‘   โ–‘ โ–ˆโ–ˆโ–ˆโ–ˆโ–“โ–’โ–‘โ–‘โ–’โ–ˆโ–‘       
 โ–’โ–’   โ–“โ–’โ–ˆโ–‘     โ–’ โ–‘โ–‘   โ–‘ โ–’โ–‘โ–’โ–‘โ–’โ–‘ โ–‘ โ–’โ–‘   โ–’ โ–’    โ–‘ โ–’โ–‘โ–’โ–‘โ–’โ–‘  โ–’ โ–‘       
  โ–’   โ–’โ–’ โ–‘       โ–‘      โ–‘ โ–’ โ–’โ–‘ โ–‘ โ–‘โ–‘   โ–‘ โ–’โ–‘     โ–‘ โ–’ โ–’โ–‘  โ–‘         
  โ–‘   โ–’        โ–‘      โ–‘ โ–‘ โ–‘ โ–’     โ–‘   โ–‘ โ–‘    โ–‘ โ–‘ โ–‘ โ–’   โ–‘ โ–‘       
      โ–‘  โ–‘                โ–‘ โ–‘           โ–‘        โ–‘ โ–‘             
                                                                 
 โ–ˆโ–ˆโ–“โ–ˆโ–ˆโ–ˆ   โ–ˆโ–ˆโ–€โ–ˆโ–ˆโ–ˆ   โ–ˆโ–ˆโ–“ โ–ˆโ–ˆโ–’   โ–ˆโ–“ โ–„โ–„โ–„       โ–„โ–ˆโ–ˆโ–ˆโ–ˆโ–„โ–“โ–ˆโ–ˆ   โ–ˆโ–ˆโ–“        
โ–“โ–ˆโ–ˆโ–‘  โ–ˆโ–ˆโ–’โ–“โ–ˆโ–ˆ โ–’ โ–ˆโ–ˆโ–’โ–“โ–ˆโ–ˆโ–’โ–“โ–ˆโ–ˆโ–‘   โ–ˆโ–’โ–’โ–ˆโ–ˆโ–ˆโ–ˆโ–„    โ–’โ–ˆโ–ˆโ–€ โ–€โ–ˆ โ–’โ–ˆโ–ˆ  โ–ˆโ–ˆโ–’        
โ–“โ–ˆโ–ˆโ–‘ โ–ˆโ–ˆโ–“โ–’โ–“โ–ˆโ–ˆ โ–‘โ–„โ–ˆ โ–’โ–’โ–ˆโ–ˆโ–’ โ–“โ–ˆโ–ˆ  โ–ˆโ–’โ–‘โ–’โ–ˆโ–ˆ  โ–€โ–ˆโ–„  โ–’โ–“โ–ˆ    โ–„ โ–’โ–ˆโ–ˆ โ–ˆโ–ˆโ–‘        
โ–’โ–ˆโ–ˆโ–„โ–ˆโ–“โ–’ โ–’โ–’โ–ˆโ–ˆโ–€โ–€โ–ˆโ–„  โ–‘โ–ˆโ–ˆโ–‘  โ–’โ–ˆโ–ˆ โ–ˆโ–‘โ–‘โ–‘โ–ˆโ–ˆโ–„โ–„โ–„โ–„โ–ˆโ–ˆ โ–’โ–“โ–“โ–„ โ–„โ–ˆโ–ˆโ–’โ–‘ โ–โ–ˆโ–ˆโ–“โ–‘        
โ–’โ–ˆโ–ˆโ–’ โ–‘  โ–‘โ–‘โ–ˆโ–ˆโ–“ โ–’โ–ˆโ–ˆโ–’โ–‘โ–ˆโ–ˆโ–‘   โ–’โ–€โ–ˆโ–‘   โ–“โ–ˆ   โ–“โ–ˆโ–ˆโ–’โ–’ โ–“โ–ˆโ–ˆโ–ˆโ–€ โ–‘โ–‘ โ–ˆโ–ˆโ–’โ–“โ–‘        
โ–’โ–“โ–’โ–‘ โ–‘  โ–‘โ–‘ โ–’โ–“ โ–‘โ–’โ–“โ–‘โ–‘โ–“     โ–‘ โ–โ–‘   โ–’โ–’   โ–“โ–’โ–ˆโ–‘โ–‘ โ–‘โ–’ โ–’  โ–‘ โ–ˆโ–ˆโ–’โ–’โ–’         
โ–‘โ–’ โ–‘       โ–‘โ–’ โ–‘ โ–’โ–‘ โ–’ โ–‘   โ–‘ โ–‘โ–‘    โ–’   โ–’โ–’ โ–‘  โ–‘  โ–’  โ–“โ–ˆโ–ˆ โ–‘โ–’โ–‘         
โ–‘โ–‘         โ–‘โ–‘   โ–‘  โ–’ โ–‘     โ–‘โ–‘    โ–‘   โ–’   โ–‘       โ–’ โ–’ โ–‘โ–‘          
            โ–‘      โ–‘        โ–‘        โ–‘  โ–‘โ–‘ โ–‘     โ–‘ โ–‘             
                           โ–‘             โ–‘       โ–‘ โ–‘             
v 0.2.25

 [!] START CRAWLING.... NUMBER: +888XXXXXXXXXXXX

 [+]  Details for number: +8880XXXXXXXXXXXXXXXXX
  โ”œ  Owner address:  0:c8351922XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
  โ”œ  Is scam:  False
  โ”œ  Last activity:  2023-XXXXXXXXXXXXx
  โ”œ  Balance:  0.9XXXXXXXXXX
  โ””  ------------------------------------

 [+]  NFTs found: 2
  โ”œ  Address: EQCJXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
  |  Name: +888 XXXXXX, Kind: CollectionItem
  |  Collection: Anonymous Telegram Numbers
  |  Url: https://nft.fragment.com/number/XXXXX.webp
  |
  โ”œ  Address: EQCnIG-ZXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
  |  Name: +888 XXXXXXX, Kind: CollectionItem
  |  Collection: Anonymous Telegram Numbers
  |  Url: https://nft.fragment.com/number/XXXXXX.webp
  โ””  ------------------------------------

Process finished with exit code 0

FLAGS

  • The flag -c supports pivots and in depth analysis, ATM it helps to correlate TON domains to ENS domains, simply pivoting on the second-level domain.
[+]  Details for domain ENS domain: xxxxxx.eth
  โ”œ  Owner address:  0xd8xxxxxxxxxxxxxxxxxxxxxxx
  โ”œ  Registration:  2020-xxxxxxxxxxxxxxxx
  โ”œ  Expiry:  2034-xxxxxxxxxxxxxxxxxxxxxx
  โ””  ------------------------------------

  • The flag -t enable a TOR SOCK5 proxy for each connection.

  • The flag -s is silent so it doesn't print any result on stdout.

  • The flag -p will enable the pivot from TON NFT to TELEGRAM account, this is a new feature that requires a fine tune in order to avoid bad OPSEC mistake. PLEASE READ THE NEXT CHAPTER CAREFULLY

  • The flag -l it's a flag that let to create a session string. The session string is a string that could be used to authenticate to Telegram avoiding the use of SQLLITE, this string could be used in .env file in order to investigate on +888 TON numbers.

 [!] Please enter your API ID: 123232132131
 [!] Please enter your API Hash: 12321312321321321321321
 [!] Please enter your phone number: +112312312312 ( sock puppet account BEWARE!! )
Please enter your phone (or bot token): >? +112312312312 ( sock puppet account BEWARE!! )
Please enter the code you received: >? 12345
Warning: Password input may be echoed.
Please enter your password: xxxxxxxx
  • The parameter --picpath, if -p enabled, can contain a path where Telegram profile pics will be stored. Each file will be renamed as Telegram_id[.]extension.

TELEGRAM PIVOTING

For using this new feature you need to be sure that you properly โ€ผ๏ธ setup a clean dedicated sock puppet โ€ผ๏ธ.
You can follow different guide on how to create them with a disposable number. The sockpuppet need to be hardened as much is possible.

UNDER PRIVACY SETTINGS ON YOUR TELEGRAM CLIENT

Use this setting in order to hardening your Telegram account.

Phone number -> Nobody
Last Seen / Online -> Nobody 
Profile Pics -> Nobody
Bio -> Nobody
Forwarded Message -> Nobody
Calls -> Nobody
Group & Channel -> Nobody

After the sock puppet creation, You'll need API HASH and API KEY. Telegram 'API_ID' and 'API_HASH', which you can get by creating a developers account using this link: https://my.telegram.org/.
Place these values in a .env file in the directory where you launch or set environment variable for the session, along with the phone number of your Telegram account:

API_ID=123456
API_HASH=aaaaaaaavvvvvvbbbbbbbbb1223
PHONE_NUMBER=+11234XXXXXX
SESSION_STRING=aabababababbababab123123...

If your Telegram account was properly created and your file .env was installed in the directory where you launch the tool, a new SQLlite containing your Telegram session information will be created. If you'll use SESSION_STRING, the SQLlite file will be ignored and the authentication phase will skipped.

CREDITS

Special thanks to Bellingcat Group for creating this project Telegram Phone Number Checker, it helped me to realize that this method could be used on TON network too.

Project details

Verified details

These details have been verified by PyPI
Maintainers
Avatar for aaarghhh from gravatar.com aaarghhh

Unverified details

These details have not been verified by PyPI
Project links
Meta

Release history Release notifications | RSS feed

This version

0.2.25

0.2.24

0.2.23

0.2.2

0.2.1

0.1.11

0.1.10

0.1.9

0.1.8.post1

0.1.8

0.1.7

0.1.5

0.0.2.post8

0.0.2.post7

Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Source Distribution

atop-0.2.25.tar.gz (20.9 kB view details)

Uploaded Source

Built Distribution

atop-0.2.25-py3-none-any.whl (18.3 kB view details)

Uploaded Python 3

File details

Details for the file atop-0.2.25.tar.gz.

File metadata

  • Download URL: atop-0.2.25.tar.gz
  • Upload date:
  • Size: 20.9 kB
  • Tags: Source
  • Uploaded using Trusted Publishing? No
  • Uploaded via: twine/4.0.2 CPython/3.11.5

File hashes

Hashes for atop-0.2.25.tar.gz
Algorithm Hash digest
SHA256 df07d697e2e59870f2e60192364139531f1b8e8477461027b835736d3a7b1593
MD5 2d987701ca71f61bd5fd1df1baa03878
BLAKE2b-256 c9b100baf405af7a35ce7f711f8aa91d7d413bd733d6557767870bb3ebcd940e

See more details on using hashes here.

File details

Details for the file atop-0.2.25-py3-none-any.whl.

File metadata

  • Download URL: atop-0.2.25-py3-none-any.whl
  • Upload date:
  • Size: 18.3 kB
  • Tags: Python 3
  • Uploaded using Trusted Publishing? No
  • Uploaded via: twine/4.0.2 CPython/3.11.5

File hashes

Hashes for atop-0.2.25-py3-none-any.whl
Algorithm Hash digest
SHA256 25436b5f18e48f1390b47ee74b8e6b9247758fb7c147f92eb19694198b6327da
MD5 9ee08a6c1b06ddd9c73931ebbb7da000
BLAKE2b-256 6a2077a76fed0f949413be9ed70556f1eec5361fef3e59ff47c8bd0b4ad3b234

See more details on using hashes here.

Supported by

AWS AWS Cloud computing and Security Sponsor Datadog Datadog Monitoring Fastly Fastly CDN Google Google Download Analytics Microsoft Microsoft PSF Sponsor Pingdom Pingdom Monitoring Sentry Sentry Error logging StatusPage StatusPage Status page