We publish our methodology in full. In a market full of scam-clone "AML bots", transparency is the only honest argument for trust.
⚡ Basic check — sanctions (OFAC, Chainalysis, TRM), USDT/USDC issuer freezes, open blacklists, our labels of hackers, drainers and mixers, TronScan flags (TRON) and the address's direct links (our link analysis, steps 1–2 below). Free: 3 a day in the Telegram bot and on the site when signed in, 1 a day on the site without sign-in. The basic check does not assess where the money came from.
🔎 Extended check — everything in Basic + the MistTrack 0–100 risk score and where the money came from: links 2–3 transfers back (scams, sanctioned exchanges, mixers), paths to risky sources, incoming and outgoing separately. It costs 1 credit: the «🔎 Extended» button under the report (and automatically once today's free basic checks are used).
🔍 Full check — everything in Extended + the MistTrack address profile: owner, named counterparties, exchanges, DEXs and mixers, incidents, first funding. Every user gets 1 free full check a month (the «🔍 Full» button in the bot, the dashboard or the mini-app), then 2 credits. Your balance is counted in credits: a check is an action, a credit is a unit of balance. What's included and what it costs.
If the address appears on at least one of the lists below, the final score is 100/100 and the verdict is ● — regardless of anything else:
| Source | What it is |
|---|---|
| OFAC SDN | The official US sanctions list, 15 assets from BTC to Solana (refreshed at least daily) |
| Chainalysis Sanctions Oracle | US (OFAC) / EU / UN sanctions list, read directly from the on-chain Chainalysis oracle on EVM chains — independent of our own OFAC list |
| TRM Labs Sanctions | Independent sanctions screening |
| Tether blacklist (USDT) | Read directly from the USDT contracts on Ethereum and TRON: the issuer has already frozen the address |
| Circle blacklist (USDC) | From native USDC contracts on Ethereum, Polygon, Base, Arbitrum, Optimism, Avalanche |
| USDT0 block list (Plasma) | From the USDT0 contract (isBlocked function) |
| SPL account freezes (Solana) | Frozen state of USDC/USDT token accounts via public RPC |
| Open blacklists (ransomware/scam) | Ransomwhere (Cable, 2024, CC BY 4.0 licence), ScamSniffer and the MyEtherWallet darklist — 14,000+ ransomware, scam-drainer and phishing addresses; refreshed daily |
| Israel, NBCTF | Government seizure and forfeiture orders against crypto wallets in terror-financing cases — 750+ addresses (mostly USDT on TRON); refreshed weekly |
An issuer blacklist hit is not "a service's opinion" — it's an on-chain freeze that has already happened. We make these checks with direct calls to public blockchain nodes — anyone can reproduce them.
If there are no hard signals, in the basic check the final score is our AMLConsensus link analysis (EVM, TRON, BTC, Solana): 0–100 based on the address's counterparties — mixers, darknet markets, scams and phishing, drainers, hacks, stolen funds, extortion, risky exchanges, and "contamination" through chains of intermediaries.
In the full check (1 free a month, then from your balance; also in the full audit and the dossier) the MistTrack (SlowMist) assessment is added, and the stricter of the two scores — ours or MistTrack's — becomes the final one.
Every check on EVM chains and TRON also uses the GoPlus Security malicious address database (theft, phishing, money laundering, mixers; part of the data comes from SlowMist and BlockSec). It is a soft signal: a GoPlus label raises the score, but a red sanctions verdict is set only by the primary sources in step 1.
We show the risk categories as a list — you see why the score is what it is, not just a number.
How connection categories affect risk (the closer and larger the exposure, the stronger the effect):
| Address connection category | Risk level |
|---|---|
| Sanctions, issuer freeze, stolen funds (exploits/hacks), CSAM/terrorism | ● critical — automatically 100/100 |
| Mixers and anonymizers, ransomware, scam and phishing | ● high |
| Gambling, unlicensed and risky exchanges, darknet services | ● medium |
| P2P/OTC with mixed history, new/unverified venues | ● moderate |
| Licensed exchanges, DEXes, ordinary user wallets | ● low / neutral |
Additionally, the extended report shows a source-of-funds breakdown: which venues the address dealt with and what share of the flow came from risky sources (● clean % · ● risky %).
An AML check reveals direct and indirect links between an address and sources of funds — each source is tagged with an indicator. We use the industry-standard three-tier classification (the same categories the largest analytics systems score on).
● Danger — highest risk. A match in these categories yields the maximum risk level:
Sanctions (OFAC/EU/UN) Terrorism financing Child exploitation (CSAM) Dark market Dark service Mixer Ransom Stolen coins Scam Fraudulent exchange Illegal service Gambling (unlicensed) Enforcement action
● Suspicious sources — medium risk:
Crypto ATM Unlicensed exchange Unlicensed P2P Liquidity pools (DeFi)
● Trusted sources — low risk:
Licensed exchange Licensed P2P Mining Marketplace Payment provider Seized assets Verified wallet Airdrop / other
The report shows not just the final score but which indicators fired for the address — you see what the verdict is built on, not an abstract percentage.
We cover the full industry-standard set of categories (the same standard the major analytics systems use: sanctions, mixers, darknet, scam, stolen coins, gambling, ATM, liquidity pools, P2P, etc.), but we don't rely on a single database:
If graph analysis is unavailable (source limit, outage, unsupported chain — e.g. the new Plasma) while sanctions lists and blacklists are clean, the report is marked "limited data" and the check is not charged. We don't paint an invented score.
| Score | Verdict | P2P recommendation |
|---|---|---|
| 0–29 | ● Low risk | Safe to accept |
| 30–69 | ● Medium risk | Ask for a different wallet (e.g. a direct exchange withdrawal) |
| 70–100 | ● High risk | Refuse the deal |
Thresholds are conservative, calibrated against automatic freeze practices of the exchanges P2P traders actually use (MEXC, BingX, HTX, Gate, KuCoin, Bitget, CoinEx, Bybit). Every platform's own threshold is unpublished.
AML