Behavioural sybil clusters
get_lookalike_clustersDetect coordinated wallet clusters that buy with matched size and timing to simulate organic demand despite no transfer or funding links. Reveals hidden coordination in distributed-looking supply.
Instructions
Clusters of wallets around one token that behave as a single actor — buys sized and timed alike so demand looks organic — even when no transfer or funding trail connects them. That behavioural inference is what separates it from get_wallet_links, which only reports proven links. Use it when supply looks distributed across many small wallets and the insider graph comes back clean; corroborate with get_fee_fingerprint on Solana. Not for proven transfer or funding links (get_wallet_links) or launch-window coordination (get_launch_bundles). Arguments: address and chain; on an EVM chain this call costs 5 API units instead of 1, because the trace runs against paid indexers.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| chain | No | Chain the token is deployed on: solana (default), ethereum, base, robinhood. Required for any 0x address, because the same contract address can exist on several EVM chains. Omit it for Solana. An unsupported value is rejected before any request is spent; EVM chains need a key on an All-Chains plan. | solana |
| address | Yes | The token's own contract address, exactly as an explorer shows it. Solana: the base58 mint, 32-44 characters (e.g. 6p6xgHyF7AeE6TZkSmFsko444wqoP15icUSqi2jfGiPN). EVM: 0x followed by 40 hex characters, case-insensitive (e.g. 0x6982508145454ce325ddbe47a25d4ec3d2311933). Never a pool, pair, wallet or deployer address — those come back as not found. Set `chain` to match the address: a 0x address alone cannot say which EVM chain it lives on, and a Solana mint sent with an EVM chain is rejected. |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| risk | No | Verdict for the token with label and severity. | |
| bands | No | Wallet clusters banded by how strongly they look like one operator. | |
| stats | No | Totals across the bands: wallets clustered and the supply they hold. | |
| token | No | The address that was scanned (on get_token_scan, the full token metadata object instead). | |
| poweredBy | No | Always "DeFade.org". | |
| timestamp | No | ISO time the response was assembled. | |
| computedAt | No | When this was computed; fromCache says whether it was served from a stored result. |