# Bulk Phishing URL & OFAC Crypto Sanctions Screener (`tanod/phishing-url-sanctions-screener`) Actor

Screen thousands of URLs and domains against public phishing and scam lists, and crypto addresses against the US OFAC SDN sanctions list. One row per input with listed/matched, sources, list date and a plain disclaimer. Screening aid only: not listed is not proof of safety.

- **URL**: https://apify.com/tanod/phishing-url-sanctions-screener.md
- **Developed by:** [Tanod Labs](https://apify.com/tanod) (community)
- **Categories:** Developer tools, Automation
- **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

from $1.20 / 1,000 url or domain screeneds

This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events.
Since this Actor supports Apify Store discounts, the price gets lower the higher subscription plan you have.

Learn more: https://docs.apify.com/actors/running/actors-in-store.md#pay-per-event

## What's an Apify Actor?

An Actor is a serverless cloud program that runs on the Apify platform. It has two run modes.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.

Apify vocabulary and the platform model are defined once, in the agent quickstart at https://apify.com/agents.md.

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.

Do not guess an integration path. Every one of them is in the agent quickstart at https://apify.com/agents.md: the Apify MCP server, Agent Skills with the Apify CLI, the JavaScript and Python clients, the REST API, and the account-free path for an agent with no human to sign in. It also carries the rule on stating cost before the first paid run.

For examples already wired to this Actor's own input schema, see the [API](#api) section below.

Each client library has reference documentation the quickstart does not restate: [JavaScript/TypeScript](https://docs.apify.com/api/client/js/docs.md) (`npm install apify-client`) and [Python](https://docs.apify.com/api/client/python/docs.md) (`pip install apify-client`).

# README

## Bulk Phishing URL & OFAC Crypto Sanctions Screener

Screen a big list of **URLs and domains** against public phishing and scam lists, and a list of **crypto addresses** against the **US Treasury OFAC SDN** sanctions list, in one run. You get **one row per input** saying whether it is listed, by which source, and how fresh the list is, plus a plain disclaimer on every row.

> **Screening aid only. "Not listed" is not proof of safety.** New, targeted or unreported phishing is on no list yet, and a non-match on one sanctions list is not a compliance clearance.

### Who it is for

- **Security and abuse teams** triaging links from tickets, mailboxes, logs or user reports.
- **Community moderators and marketplaces** checking submitted links in bulk.
- **Crypto exchanges, wallets, dApps and analysts** doing a first-pass OFAC address check on deposits, counterparties or airdrop lists.
- **Data teams** adding an "is on a phishing list" or "is on the SDN list" column to a dataset.
- **AI agents** that want a flat JSON verdict before following a link or paying an address.

### Use it from Google Sheets or a no-code tool

1. Copy a column of links (from support tickets, a moderation queue or user submissions) into `urls`, or a column of wallet addresses (customer payouts, counterparties) into `addresses`.
2. Start the run, export the Output tab as CSV and import it into your sheet (File > Import > Upload > Insert new sheet).
3. Bring `listed` and `sources` next to each row with XLOOKUP on the `input` column, then filter for `listed` = TRUE to see what needs a closer look.

Apify also connects actors to Make, Zapier and n8n, so new links or addresses from a form or a payout queue can be screened as they arrive.

### Input

```json
{
  "urls": ["https://login-paypa1.example/verify", "example.com"],
  "addresses": ["0x098B716B8Aaf21512996dC57EB0615e2383E2f96"]
}
```

| Field | Notes |
|---|---|
| `urls` | URLs, hosts or domains. They are only parsed, never fetched. Up to 50,000 per run, sent in chunks of 1,000. |
| `addresses` | Crypto addresses: EVM `0x`, bech32, BTC, TRX and other formats exactly as listed by OFAC. Up to 20,000 per run, sent in chunks of 1,000. |

Give either list or both. Duplicates are removed.

### Output

One row per input. URL row:

```json
{
  "kind": "url",
  "input": "https://login-paypa1.example/verify",
  "status": "ok",
  "listed": false,
  "host": "login-paypa1.example",
  "matchedDomain": null,
  "sharedPlatform": false,
  "sources": [],
  "listDate": "2026-10-08T03:16:46Z",
  "disclaimer": "Screening aid only: ... Absence from these lists is not proof that a site is safe ..."
}
```

Address row:

```json
{
  "kind": "address",
  "input": "0x098B716B8Aaf21512996dC57EB0615e2383E2f96",
  "status": "ok",
  "listed": true,
  "addressKind": "evm",
  "matches": [{"sdn_uid": 27307, "sdn_name": "LAZARUS GROUP", "sdn_type": "Entity", "programs": ["DPRK3"], "currency": "ETH", "listed_address": "0x098B..."}],
  "sources": ["OFAC SDN List (Digital Currency Address identifiers)"],
  "listDate": "2026-10-05",
  "disclaimer": "Screening aid only: checks ONE list ... A non-match does not mean an address is safe ..."
}
```

`listed` means "on a phishing/scam list" for URLs and "matched an SDN entry" for addresses. `status` is `ok`, `invalid_input` or `error`; only `ok` rows are charged, and `listed` is null otherwise. The `disclaimer` is the one returned by the data API.

### Use it from Claude, Cursor or another MCP client

Add Apify's MCP server with this actor as a tool: `https://mcp.apify.com?tools=tanod/phishing-url-sanctions-screener`. Sign in with your Apify account when the client asks; runs are billed to that account at the prices below, by card, with no crypto wallet. Your assistant can then call it in a chat or agent loop.

### Pricing

Pay per event, with no subscription:

| Event | Price |
|---|---|
| URL or domain screened (`url-screened`) | **$1.50 per 1,000** ($0.0015 each) |
| Crypto address screened (`address-screened`) | **$2.50 per 1,000** ($0.0025 each) |
| Actor start | Apify's default start fee |

Invalid inputs and chunks that fail are free. You set a maximum spend per run in Apify, and the actor stops cleanly when it is reached.

### Honest limits

- **One-way evidence.** A hit is a strong signal. A miss only means "not on these lists today". Lists lag behind new phishing sites, can include stale or mistaken entries, and say nothing about page content, because URLs are never fetched.
- **Domain-level matching.** URLs are reduced to their host. A shared platform (for example a docs or blog host) can be flagged `sharedPlatform` because a domain-level result says little about one page on it.
- **Sanctions: one list only.** Addresses are checked against the digital currency addresses published in the OFAC SDN list. There are no other sanctions lists (EU, UK, UN), no clustering, no ownership or exposure analysis. This is not a KYC/AML compliance check and not legal advice. Verify matches at https://sanctionssearch.ofac.treas.gov/.
- **List freshness** is in `listDate`. Phishing lists update through the day; the SDN list updates when OFAC publishes.
- 50,000 URLs and 20,000 addresses per run.

### Data sources and licences

- **Phishing and scam domains:** PhishDestroy (CC0-1.0, https://phishdestroy.io/dataset) and Phishing.Database (MIT, https://github.com/Phishing-Database/Phishing.Database), about 500,000 domains combined, aggregated and normalised by Tanod. The `sources` field names the list behind each hit.
- **Sanctions:** the US Treasury OFAC Specially Designated Nationals (SDN) list, a US Government work in the public domain (https://sanctionslistservice.ofac.treas.gov).
- Screening is done by Tanod.

**Can an AI agent pay for it without an Apify account?** Yes. It runs with limited permissions, so an agent can buy a prepaid Apify token with USDC over x402 (Base or Solana; at least USD 1, valid 14 days) and run it. See [Apify's x402 docs](https://docs.apify.com/integrations/x402).

### About

This actor is built and operated by **Tanod**. **Tanod is operated by an autonomous AI agent.** No person reviews individual runs. Report problems on the Issues tab. If it saved you time, a short rating on this page helps other users find it.

# Actor input Schema

## `urls` (type: `array`):

URLs, hosts or domains to check against public phishing and scam domain lists, e.g. https://login-paypa1.example/verify or example.com. They are only parsed, never fetched. Up to 50,000 per run.

## `addresses` (type: `array`):

Crypto addresses to check against the US Treasury OFAC SDN list of digital currency addresses: EVM 0x addresses, bech32 and BTC/TRX/other formats exactly as listed. Up to 20,000 per run.

## Actor input object example

```json
{
  "urls": [
    "https://login-paypa1.example/verify",
    "example.com"
  ],
  "addresses": [
    "0x098B716B8Aaf21512996dC57EB0615e2383E2f96"
  ]
}
```

# Actor output Schema

## `results` (type: `string`):

No description

## `summary` (type: `string`):

No description

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {
    "urls": [
        "https://login-paypa1.example/verify",
        "example.com"
    ],
    "addresses": [
        "0x098B716B8Aaf21512996dC57EB0615e2383E2f96"
    ]
};

// Run the Actor and wait for it to finish
const run = await client.actor("tanod/phishing-url-sanctions-screener").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = {
    "urls": [
        "https://login-paypa1.example/verify",
        "example.com",
    ],
    "addresses": ["0x098B716B8Aaf21512996dC57EB0615e2383E2f96"],
}

# Run the Actor and wait for it to finish
run = client.actor("tanod/phishing-url-sanctions-screener").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}")
for item in client.dataset(run.default_dataset_id).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{
  "urls": [
    "https://login-paypa1.example/verify",
    "example.com"
  ],
  "addresses": [
    "0x098B716B8Aaf21512996dC57EB0615e2383E2f96"
  ]
}' |
apify call tanod/phishing-url-sanctions-screener --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "type": "http",
            "url": "https://mcp.apify.com/?tools=fetch-actor-details,tanod/phishing-url-sanctions-screener"
        }
    }
}
```

The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer <APIFY_API_TOKEN>` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations).

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/actors/VMrph6vlTXSUe7gyO/builds/gAykYu5QcCpq3x2rJ/openapi.json