Data Points

₿ Cryptocurrency Address

Blockchain wallet address for receiving or sending crypto assets.

Financial

Sources

17 no-auth

Disciplines

that use it

Mission domains

reach

Workbench

open →

native tool

🔧 Native workbench

Open Cryptocurrency Address workbench →Advanced search →Link analysis →

🔎 Live indicators (IoC view)

CRYPTO indicators →IoC dashboard →Search crypto →

🔗 Analyst pivots

Transaction →Sanctions →Cluster →

🔌 Sources that yield Cryptocurrency Address (19)

Source	Category	Auth	Format
Arkham Intelligence Entity attribution & flow analysis.	Crypto Attribution	NONE	`html`	home↗ api↗
Blockchair API Multi-chain explorer & analytics API.	Blockchain Explorer	NONE	`json`	home↗ api↗
Blockstream Esplora Bitcoin explorer REST API.	Blockchain Explorer	NONE	`json`	home↗ api↗
Breadcrumbs Free visual crypto tracing.	Crypto Investigation	NONE	`html`	home↗ api↗
Chainabuse Community scam/abuse address reporting (TRM).	Crypto Fraud	NONE	`html`	home↗ api↗
Chainabuse reports Community scam/abuse address reporting (TRM Labs).	Crypto Fraud	NONE	`html`	home↗ api↗
CryptoScamDB Known scam/phishing crypto addresses & domains.	Crypto Fraud	NONE	`json`	home↗ api↗
CryptoScamDB addresses Known scam / phishing crypto addresses.	Crypto Fraud	NONE	`json`	home↗ api↗
GraphSense TagPacks Open attribution tags for blockchain addresses.	Crypto Attribution	NONE	`text`	home↗ api↗
mempool.space API Bitcoin transaction/address analytics API.	Blockchain Explorer	NONE	`json`	home↗ api↗
MetaSleuth (Blocksec) Fund-flow tracing & labelling.	Crypto Investigation	NONE	`html`	home↗ api↗
MistTrack AML risk scoring & tracing (SlowMist).	Crypto Investigation	NONE	`html`	home↗ api↗
OFAC Sanctioned Crypto Addresses (0xB10C) Machine-readable OFAC-designated wallet lists per chain.	Crypto Sanctions	NONE	`text`	home↗ api↗
OXT / WalletExplorer Bitcoin wallet clustering & attribution.	Crypto Attribution	NONE	`html`	home↗ api↗
Ransomwhere export Crowd-sourced ransomware payment wallets + family attribution.	Ransom Payments	NONE	`json`	home↗ api↗
Ransomwhere payments Crowdsourced ransomware payment address tracking.	Ransom Payments	NONE	`json`	home↗ api↗
ScamSniffer scam addresses Community-reported scam wallet addresses.	Crypto Fraud	NONE	`json`	home↗ api↗
BitcoinAbuse / Chainabuse Reported abusive BTC addresses (extortion, ransom).	Crypto Fraud	KEY	`csv`	home↗ api↗
Etherscan API Ethereum explorer + address labels.	Blockchain Explorer	KEY	`json`	home↗ api↗

🧭 Disciplines

CRYPTINT (19) →SANCINT (1) →

🎯 Mission Domains

Financial Crime (17) →Anti-Money Laundering (8) →Fraud & Identity (6) →Ransomware (2) →Sanctions Evasion (1) →

🔍 Lookup

🔄 Live Datasets & APIs (10 key-free · ingestible)

Dataset / API	Format	Endpoint
Blockchair API	`json`	https://api.blockchair.com/	collect
Blockstream Esplora	`json`	https://blockstream.info/api/	collect
CryptoScamDB	`json`	https://api.cryptoscamdb.org/v1/addresses	collect
CryptoScamDB addresses	`json`	https://api.cryptoscamdb.org/v1/addresses	collect
GraphSense TagPacks	`text`	https://raw.githubusercontent.com/graphsense/graphsense-tagp	collect
mempool.space API	`json`	https://mempool.space/api/	collect
OFAC Sanctioned Crypto Addresses (0xB10C)	`text`	https://raw.githubusercontent.com/0xB10C/ofac-sanctioned-dig	collect
Ransomwhere export	`json`	https://api.ransomwhe.re/export	collect
Ransomwhere payments	`json`	https://api.ransomwhe.re/export	collect
ScamSniffer scam addresses	`json`	https://raw.githubusercontent.com/scamsniffer/scam-database/	collect

Run Auto-Collect Datasets Hub Import

📜 Playbook — Cryptocurrency Address exploitation

Direction — frame the requirement for Cryptocurrency Address: what decision does this support, by when?
Collection — pull the 19 mapped sources (17 free) and the native workbench (open); capture provenance and observe OPSEC.
Processing — normalize, de-duplicate and enrich the collected data.
Analysis — correlate against local holdings; apply ACH; assign confidence.
Dissemination — open a case, draft a report, share via STIX/MISP.
Feedback — set an alert rule / watchlist to monitor for change.

⚡ AI Skills & Automation

🤖 Copilot brief ⚡ AI Skills Resolve Enrich Auto-Collect Hunt Report Export

Automate unattended via the cron pipeline (collect → ingest → resolve → enrich → score → alert).

🗃 Data Management

+ Case + Campaign Watchlist Tag Save search Whitelist Export STIX/MISP Report

🧩 Advanced Capabilities

Link Analysis Pivot Explorer Timeline Threat Hunting Analytics Detection Rules Blockchain OSINT Pivot Passive DNS TAXII 2.1 MISP Feed Create Alert Rule NetFlow Coverage & Gaps

✨ Enrichment pathways

Enrichment Runner →Resolve locally →Enrichment → local →Integrations →

🎫 Cryptocurrency Address

A cryptocurrency address is a public identifier (derived from a public key or script) that receives and sends funds on a blockchain. It is a pseudonymous financial fingerprint used to trace illicit flows, cluster wallets to a single actor, and screen against sanctions and scam databases.

Format: BTC: legacy 1..., P2SH 3..., bech32 bc1... (base58/bech32); ETH/EVM: 0x + 40 hex (EIP-55 checksum); TRON T...; XMR 95-char; each with its own checksum

📡 How it is collected

Blockchain explorer scraping
Ransom notes and extortion demands
Darknet market and scam pages
Exchange deposit/withdrawal records
Donation/tip jar disclosures
Malware config and wallet drainers

📚 Enrichment & validation sources

Blockchair →Etherscan →Blockchain.com Explorer →OFAC SDN crypto list →Chainabuse →Bitcoinabuse / Chainalysis free reports →Arkham Intelligence →BlockCypher →Breadcrumbs →

🔗 Pivot to

Transaction Hash →counterparty addresses →exchange / deposit cluster →dp_company (VASP) →ENS / domain →actor wallet cluster →Email Address →

🧩 Analysis & hunting techniques

Address checksum/format validation
Common-input-ownership clustering
Change-address heuristics
Sanctions and scam-list screening
Exchange attribution / entity tagging
Peel-chain and mixer detection
Cross-chain bridge tracing
Dusting-attack detection

🔧 Tools

Blockchair
Etherscan
Breadcrumbs
Arkham
GraphSense
OXT / Samourai tools
Chainalysis (commercial)
bitcoinlib (Python)

⚡ Workbench actions

Validate address format
Screen against OFAC/scam lists
Cluster co-spending wallets
Trace transaction graph
Attribute to exchange/VASP
Monitor for new activity
Export flow graph

📊 Dashboard KPIs

Total received/sent balanceTransaction countSanctions/abuse hit flagCluster size (linked addresses)Days since last activity

📂 Open

Crypto address data point →Blockchain explorer →Sanctions →Link analysis →Correlate →IOC workbench →

Workstation · Copilot · AI Skills · Automation · Playbooks · Lookups · Docs · Reports

🤖 AI Copilot

Cron: 0 * * * * php /home/zaptf0zdggll/public_html/threats/cron.php

📜 Playbook

Open Response Playbook