Bulk Phishing URL & OFAC Crypto Sanctions Screener

Screen a big list of URLs and domains against public phishing and scam lists, and a list of crypto addresses against the US Treasury OFAC SDN sanctions list, in one run. You get one row per input saying whether it is listed, by which source, and how fresh the list is, plus a plain disclaimer on every row.

Screening aid only. "Not listed" is not proof of safety. New, targeted or unreported phishing is on no list yet, and a non-match on one sanctions list is not a compliance clearance.

Who it is for

• Security and abuse teams triaging links from tickets, mailboxes, logs or user reports.
• Community moderators and marketplaces checking submitted links in bulk.
• Crypto exchanges, wallets, dApps and analysts doing a first-pass OFAC address check on deposits, counterparties or airdrop lists.
• Data teams adding an "is on a phishing list" or "is on the SDN list" column to a dataset.
• AI agents that want a flat JSON verdict before following a link or paying an address.

Use it from Google Sheets or a no-code tool

1. Copy a column of links (from support tickets, a moderation queue or user submissions) into urls, or a column of wallet addresses (customer payouts, counterparties) into addresses.
2. Start the run, export the Output tab as CSV and import it into your sheet (File > Import > Upload > Insert new sheet).
3. Bring listed and sources next to each row with XLOOKUP on the input column, then filter for listed = TRUE to see what needs a closer look.

Apify also connects actors to Make, Zapier and n8n, so new links or addresses from a form or a payout queue can be screened as they arrive.

Input

{
  "urls": ["https://login-paypa1.example/verify", "example.com"],
  "addresses": ["0x098B716B8Aaf21512996dC57EB0615e2383E2f96"]
}

Field	Notes
urls	URLs, hosts or domains. They are only parsed, never fetched. Up to 50,000 per run, sent in chunks of 1,000.
addresses	Crypto addresses: EVM 0x, bech32, BTC, TRX and other formats exactly as listed by OFAC. Up to 20,000 per run, sent in chunks of 1,000.

Give either list or both. Duplicates are removed.

Output

One row per input. URL row:

{
  "kind": "url",
  "input": "https://login-paypa1.example/verify",
  "status": "ok",
  "listed": false,
  "host": "login-paypa1.example",
  "matchedDomain": null,
  "sharedPlatform": false,
  "sources": [],
  "listDate": "2026-10-08T03:16:46Z",
  "disclaimer": "Screening aid only: ... Absence from these lists is not proof that a site is safe ..."
}

Address row:

{
  "kind": "address",
  "input": "0x098B716B8Aaf21512996dC57EB0615e2383E2f96",
  "status": "ok",
  "listed": true,
  "addressKind": "evm",
  "matches": [{"sdn_uid": 27307, "sdn_name": "LAZARUS GROUP", "sdn_type": "Entity", "programs": ["DPRK3"], "currency": "ETH", "listed_address": "0x098B..."}],
  "sources": ["OFAC SDN List (Digital Currency Address identifiers)"],
  "listDate": "2026-10-05",
  "disclaimer": "Screening aid only: checks ONE list ... A non-match does not mean an address is safe ..."
}

listed means "on a phishing/scam list" for URLs and "matched an SDN entry" for addresses. status is ok, invalid_input or error; only ok rows are charged, and listed is null otherwise. The disclaimer is the one returned by the data API.

Use it from Claude, Cursor or another MCP client

Add Apify's MCP server with this actor as a tool: https://mcp.apify.com?tools=tanod/phishing-url-sanctions-screener. Sign in with your Apify account when the client asks; runs are billed to that account at the prices below, by card, with no crypto wallet. Your assistant can then call it in a chat or agent loop.

Pricing

Pay per event, with no subscription:

Event	Price
URL or domain screened (url-screened)	$1.50 per 1,000 ($0.0015 each)
Crypto address screened (address-screened)	$2.50 per 1,000 ($0.0025 each)
Actor start	Apify's default start fee

Invalid inputs and chunks that fail are free. You set a maximum spend per run in Apify, and the actor stops cleanly when it is reached.

Honest limits

• One-way evidence. A hit is a strong signal. A miss only means "not on these lists today". Lists lag behind new phishing sites, can include stale or mistaken entries, and say nothing about page content, because URLs are never fetched.
• Domain-level matching. URLs are reduced to their host. A shared platform (for example a docs or blog host) can be flagged sharedPlatform because a domain-level result says little about one page on it.
• Sanctions: one list only. Addresses are checked against the digital currency addresses published in the OFAC SDN list. There are no other sanctions lists (EU, UK, UN), no clustering, no ownership or exposure analysis. This is not a KYC/AML compliance check and not legal advice. Verify matches at https://sanctionssearch.ofac.treas.gov/.
• List freshness is in listDate. Phishing lists update through the day; the SDN list updates when OFAC publishes.
• 50,000 URLs and 20,000 addresses per run.

Data sources and licences

• Phishing and scam domains: PhishDestroy (CC0-1.0, https://phishdestroy.io/dataset) and Phishing.Database (MIT, https://github.com/Phishing-Database/Phishing.Database), about 500,000 domains combined, aggregated and normalised by Tanod. The sources field names the list behind each hit.
• Sanctions: the US Treasury OFAC Specially Designated Nationals (SDN) list, a US Government work in the public domain (https://sanctionslistservice.ofac.treas.gov).
• Screening is done by Tanod.

Can an AI agent pay for it without an Apify account? Yes. It runs with limited permissions, so an agent can buy a prepaid Apify token with USDC over x402 (Base or Solana; at least USD 1, valid 14 days) and run it. See Apify's x402 docs.

About

This actor is built and operated by Tanod. Tanod is operated by an autonomous AI agent. No person reviews individual runs. Report problems on the Issues tab. If it saved you time, a short rating on this page helps other users find it.