Documentation

Solana's On-Chain
Intelligence Platform

Trace wallet funding chains, expose coordinated cabal networks, and score on-chain threats across the Solana ecosystem.

1

What is Rico Maps?

Rico Maps is a forensic intelligence tool that analyzes Solana wallets and tokens to uncover hidden coordination between addresses. Paste any token contract or wallet and get a full network visualization of who funded whom, who sniped, and who's running together.

Cabal Detection

Finds wallets secretly coordinating by tracing shared funding sources across token holders.

Sniper & Bundle Detection

Identifies wallets that bought within the first block or used Jito bundles to front-run others.

Threat Scoring

Assigns 0-100 risk scores based on identity tags, behavior patterns, and wallet age.

2

How It Works

1

Enter Address

Paste any Solana token contract address or wallet address. Rico Maps automatically detects the type and routes to the appropriate analysis pipeline.

2

Analyze Holders

We fetch the top token holders and trace their funding sources using the Helius Wallet API. Each holder's earliest transactions are inspected for SOL transfers.

3

Detect Patterns

Our engine cross-references all funding sources to find shared funders, flags first-block snipers, identifies Jito bundle clusters, and computes threat scores.

4

Visualize

An interactive bubble map renders the full network with color-coded nodes and links. Click any node to inspect its wallet profile, portfolio, and risk breakdown.

3

Node Types & Colors

Each node in the visualization represents a wallet or token, color-coded by its role in the network.

Token

The token being analyzed. Center of the graph.

Holder

Clean token holders with no detected cabal connections.

Connected

Holders linked to one or more cabal funders.

Cabal Funder

Wallet that funded multiple token holders.

Sniper

Bought within the first 10 blocks of trading.

Bundled

Detected in a Jito bundle cluster transaction.

Funder

Funding source wallet traced via SOL transfers.

Target

Original wallet being traced in wallet mode.

4

Features

Risk Heatmap

Toggle heatmap mode to recolor all nodes by threat level. Critical wallets glow red, safe wallets stay green. Instantly spot the highest-risk areas in any network.

Wallet Profiles

Click any node for a full breakdown: portfolio holdings, funding source, recent activity, identity tags, and a threat score with contributing factors.

Cross-Token Deep Scan

Discover what other tokens cabal wallets hold in common. Surface coordinated activity that spans multiple token launches.

Real-Time Polling

Live holder balance tracking with incremental updates. Watch positions change in real time as the chart auto-refreshes.

Trending Discovery

Browse trending and featured Solana tokens with market cap, price, and volume data. One click to scan any token.

Embed Integration

Embed Rico Maps visualizations on your own site via a simple iframe. Customize view style, dimensions, and target address.

5

Threat Scoring

Every wallet is assigned a threat score from 0 to 100 based on multiple behavioral and identity signals. The score determines the wallet's risk level and visualization color in heatmap mode.

Safe
0-14
Low
15-29
Medium
30-49
High
50-69
Critical
70-100

Contributing Factors

Identity tags (scammer / rugger / hacker via Helius)+40
Cabal funder status (funded 2+ holders)+25
Sniper detection (first 10 blocks)+20
Bundle membership (Jito bundle cluster)+15
Fresh wallet (created < 7 days ago)+10
6

API Access

Programmatic access to Rico Maps analysis via REST API. Requires an API key set via the RICO_API_KEYS environment variable.

POST/api/v1/analyzeProgrammatic cabal analysis
GET/api/v1/statusHealth check
Example Request
curl -X POST https://ricomaps.fun/api/v1/analyze \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "mint": "So11111111111111111111111111111111111111112",
    "topHolders": 30
  }'
Example Response
{
  "status": "ok",
  "data": {
    "nodes": 47,
    "links": 62,
    "cabalFunders": 3,
    "snipers": 5,
    "bundled": 2,
    "avgThreatScore": 34.2,
    "topThreats": [
      { "wallet": "7xK...mN2", "score": 85, "tags": ["cabal-funder", "fresh"] }
    ]
  }
}
7

Embed on Your Site

Code Generator

Generate an iframe embed code for any Solana address. Drop it into your site, dashboard, or app.

<iframe
  src="https://ricomaps.fun/embed?address=&view=forensic"
  width="100%"
  height="500px"
  frameborder="0"
  allow="accelerometer; gyroscope"
  style="border-radius: 8px;"
></iframe>

URL Parameters

ParameterDescriptionDefault
addressSolana wallet or token mint addressrequired
viewVisualization style: forensic or bubbleforensic
hideWatermarkHide the "Powered by RicoMaps" badgefalse

Example Embeds

Token Analysis (forensic view):

<iframe src="https://ricomaps.fun/embed?address=TOKEN_MINT&view=forensic" width="100%" height="500"></iframe>

Wallet Trace (bubble view):

<iframe src="https://ricomaps.fun/embed?address=WALLET_ADDRESS&view=bubble" width="100%" height="600"></iframe>
8

Data Sources & Methodology

Helius Wallet API

Funded-by tracing, batch identity lookups (5,100+ tagged accounts including known scammers, exchanges, and market makers), and portfolio data.

Helius RPC (Gatekeeper)

Token account queries, transaction history, on-chain data fetching, and enhanced transaction parsing.

DexScreener

Token metadata, trending tokens, price feeds, market cap data, and chart information for discovery.

Methodology

We use the Helius Wallet API to trace funding sources for each token holder, then cross-reference all holders to find shared funders. First-block buyers are flagged as snipers via transaction timestamp analysis. Jito bundle detection identifies wallets that transacted in the same bundle slot. Identity enrichment from 5,100+ tagged accounts flags known scammers, exchanges, and market makers. All signals are combined into a weighted threat score.

9

Limitations

Rico Maps is a forensic intelligence tool, not a crystal ball. Here's what to keep in mind.

We analyze the top 30 holders by default. Smaller holders are not traced.
We trace the first 3 funders per holder. Deep multi-hop funding chains may be missed.
CEX withdrawals (Binance, Coinbase, etc.) and legitimate shared services can cause false positives.
Multi-hop obfuscation (A -> B -> C -> Holder) is partially traced but not guaranteed at depth.
DEX-routed funding (through Jupiter, Raydium) is flagged but the original source may be hidden.
Threat scores are heuristic-based. A high score means elevated risk, not confirmed malice.
Bundle detection relies on transaction slot proximity. Some edge cases may be missed.