Summary
| Rule | Account types | Status |
|---|---|---|
| Sanctions Check | Wallet (EOA) + counterparty | 🟢 Active |
| High-Risk Counterparty | Wallet (EOA) + counterparty | 🟢 Active |
| Risky Address Interaction | Wallet (EOA) / contract | 🟢 Active |
| Sanctions and Blacklist List Change | Any monitored address | 🟢 Active |
| Sanctioned Address Token Interaction | Wallet (EOA) + token / mint | 🟡 Building |
| Blacklisted Address Token Interaction | Wallet (EOA) + token / mint | 🟡 Building |
| Malicious Address Token Interaction | Wallet (EOA) + token / mint | 🟡 Building |
| Labelled Address Transaction | Wallet (EOA) | ⚪ Deprecated |
Status note. Sanctions Check, High-Risk Counterparty, Risky Address
Interaction, and Sanctions and Blacklist List Change are live, they screen
counterparties directly against the Range risk and sanctions APIs. The three
Address Token Interaction rules are 🟡 Building: the rule logic is
implemented, but they depend on per-block sanctioned / blacklisted / malicious
address lists being fed in by the enrichment pipeline, which isn’t wired up yet,
so they don’t emit alerts today.
Rules
🟢 Sanctions Check
🟢 Sanctions Check
Detects. A monitored wallet transacts with an OFAC-sanctioned or blacklisted
address.
| Trigger | A transfer where the counterparty is sanctioned or blacklisted, checked via the Range sanctions API. |
| Account types | Wallet (EOA) + counterparty |
| Status | Active |
🟢 High-Risk Counterparty
🟢 High-Risk Counterparty
Detects. A monitored wallet transacts with a counterparty whose Range risk
score exceeds a threshold.
| Trigger | A transfer (above an optional minimum USD) where the counterparty’s Range risk score ≥ the configured threshold. |
| Account types | Wallet (EOA) + counterparty |
| Status | Active |
🟢 Risky Address Interaction
🟢 Risky Address Interaction
Detects. A monitored address that carries a non-zero Range risk score has new
transactions.
| Trigger | A monitored address with a non-zero risk score is seen in new transactions, indicating possible association with malicious activity. (Scheduled.) |
| Account types | Wallet (EOA) / contract |
| Status | Active |
🟢 Sanctions and Blacklist List Change
🟢 Sanctions and Blacklist List Change
Detects. A monitored address is added to or removed from the OFAC sanctions
list or a stablecoin issuer blacklist.
| Trigger | A watched address newly appears on — or drops off — the OFAC list or a stablecoin issuer blacklist (USDT, USDC, etc.). Filter by list type and change type (added / removed). (Scheduled.) |
| Account types | Any monitored address (wallet / contract) |
| Status | Active |
🟡 Sanctioned Address Token Interaction
🟡 Sanctioned Address Token Interaction
Detects. A sanctioned address sends or receives a monitored token.
| Trigger | A sanctioned address sends, receives, or holds the configured token. |
| Account types | Wallet (EOA) + token / mint |
| Status | Building — implemented, but not yet emitting (see note above). |
🟡 Blacklisted Address Token Interaction
🟡 Blacklisted Address Token Interaction
Detects. An address on an issuer’s blocklist sends or receives a monitored
token.
| Trigger | A blocklisted address (issuer blocklists, e.g. Circle / Tether) interacts with the configured token. |
| Account types | Wallet (EOA) + token / mint |
| Status | Building — implemented, but not yet emitting (see note above). |
🟡 Malicious Address Token Interaction
🟡 Malicious Address Token Interaction
Detects. An address flagged for malicious activity (scams, exploits, wallet
drainers) sends or receives a monitored token.
| Trigger | A malicious-flagged address interacts with the configured token. |
| Account types | Wallet (EOA) + token / mint |
| Status | Building — implemented, but not yet emitting (see note above). |
Deprecated
⚪ Deprecated rules (migration context)
⚪ Deprecated rules (migration context)
Retired from a previous runner, kept for completeness:
- Labelled Address Transaction: transactions involving labelled addresses (superseded by the risk- and sanctions-based rules above).