Screening Addresses Against OFAC Sanctions
tactic
Core idea
An address may be on a sanctions list. Searching the address in double quotes on Google often returns sanctions-list entries directly, and explorers may show an OFAC block label. A sanctioned counterparty is a strong attribution signal, for example linking an address to a state actor.
When to use
When assessing the risk of an address or trying to attribute it, especially if you see large or repeated transfers to one destination.
Example
A developer’s address sent 17 ETH repeatedly to one address. Googling that address in quotes returned a sanctions-list entry dated 16 October 2019 tying it to North Korea, which the protocol could have found before hiring him.
Related
The OxMoon Developer Attribution, Google Dorking for Attribution, Never Trust a Single Source of Attribution