Screening Addresses Against OFAC Sanctions
tactic
Core idea
An address may be on a sanctions list. Searching the address in double quotes on Google often returns sanctions-list entries directly, and explorers may show an OFAC block label. A sanctioned counterparty is a strong attribution signal, for example linking an address to a state actor.
When to use
When assessing the risk of an address or trying to attribute it, especially if you see large or repeated transfers to one destination.
Example
A developer’s address sent 17 ETH repeatedly to one address. Googling that address in quotes returned a sanctions-list entry dated 16 October 2019 tying it to North Korea, which the protocol could have found before hiring him.
Related
Google Dorking for Attribution · Never Trust a Single Source of Attribution
Last updated on