Summary
| Rule | Account types | Status |
|---|---|---|
| Sanctions Check | Wallet (EOA) + counterparty | 🟢 Active |
| High-Risk Counterparty | Wallet (EOA) + counterparty | 🟢 Active |
| Risky Address Interaction | Wallet (EOA) / contract | 🟢 Active |
| Sanctions and Blacklist List Change | Any monitored address | 🟢 Active |
| Sanctioned Address Token Interaction | Wallet (EOA) + token / mint | 🟡 Building |
| Blacklisted Address Token Interaction | Wallet (EOA) + token / mint | 🟡 Building |
| Malicious Address Token Interaction | Wallet (EOA) + token / mint | 🟡 Building |
| Labelled Address Transaction | Wallet (EOA) | ⚪ Deprecated |
Status note. Sanctions Check, High-Risk Counterparty, Risky Address
Interaction, and Sanctions and Blacklist List Change are live — they screen
counterparties directly against the Range risk and sanctions APIs. The three
Address Token Interaction rules are 🟡 Building: the rule logic is
implemented, but they depend on per-block sanctioned / blacklisted / malicious
address lists being fed in by the enrichment pipeline, which isn’t wired up yet —
so they don’t emit alerts today.
Rules
🟢 Sanctions Check
🟢 Sanctions Check
Detects. A monitored wallet transacts with an OFAC-sanctioned or blacklisted
address.
| Trigger | A transfer where the counterparty is sanctioned or blacklisted, checked via the Range sanctions API. |
| Account types | Wallet (EOA) + counterparty |
| Status | Active |
🟢 High-Risk Counterparty
🟢 High-Risk Counterparty
Detects. A monitored wallet transacts with a counterparty whose Range risk
score exceeds a threshold.
| Trigger | A transfer (above an optional minimum USD) where the counterparty’s Range risk score ≥ the configured threshold. |
| Account types | Wallet (EOA) + counterparty |
| Status | Active |
🟢 Risky Address Interaction
🟢 Risky Address Interaction
Detects. A monitored address that carries a non-zero Range risk score has new
transactions.
| Trigger | A monitored address with a non-zero risk score is seen in new transactions, indicating possible association with malicious activity. (Scheduled.) |
| Account types | Wallet (EOA) / contract |
| Status | Active |
🟢 Sanctions and Blacklist List Change
🟢 Sanctions and Blacklist List Change
Detects. A monitored address is added to or removed from the OFAC sanctions
list or a stablecoin issuer blacklist.
| Trigger | A watched address newly appears on — or drops off — the OFAC list or a stablecoin issuer blacklist (USDT, USDC, etc.). Filter by list type and change type (added / removed). (Scheduled.) |
| Account types | Any monitored address (wallet / contract) |
| Status | Active |
🟡 Sanctioned Address Token Interaction
🟡 Sanctioned Address Token Interaction
Detects. A sanctioned address sends or receives a monitored token.
| Trigger | A sanctioned address sends, receives, or holds the configured token. |
| Account types | Wallet (EOA) + token / mint |
| Status | Building — implemented, but not yet emitting (see note above). |
🟡 Blacklisted Address Token Interaction
🟡 Blacklisted Address Token Interaction
Detects. An address on an issuer’s blocklist sends or receives a monitored
token.
| Trigger | A blocklisted address (issuer blocklists, e.g. Circle / Tether) interacts with the configured token. |
| Account types | Wallet (EOA) + token / mint |
| Status | Building — implemented, but not yet emitting (see note above). |
🟡 Malicious Address Token Interaction
🟡 Malicious Address Token Interaction
Detects. An address flagged for malicious activity (scams, exploits, wallet
drainers) sends or receives a monitored token.
| Trigger | A malicious-flagged address interacts with the configured token. |
| Account types | Wallet (EOA) + token / mint |
| Status | Building — implemented, but not yet emitting (see note above). |
Deprecated
⚪ Deprecated rules (migration context)
⚪ Deprecated rules (migration context)
Retired from a previous runner, kept for completeness:
- Labelled Address Transaction — transactions involving labelled addresses (superseded by the risk- and sanctions-based rules above).