Risk Data Sources

Range’s risk scoring engine aggregates data from multiple independent sources. This page describes the feeds behind risk scoring methodology.

---

​

Sanctions and compliance lists

Range ingests designations from official government and authority publications. Coverage is network-agnostic for published crypto addresses, so an address listed by a sanctioning body is screened regardless of which chain you query. The UN Security Council Consolidated List is not in the table because it publishes no crypto addresses (checked September 2026), so there is nothing to match an address against. A UN designation is screened only through a list above that implements it, such as OFAC, the UK, or the EU, and is reported under that list’s signal ID. The signal ID is how a hit is reported: the signal value in Address Risk (v2), a risk_categories entry in Address Risk Score (v1), and the signal_id of a sanctions entry in Sanctions & Blacklist Check. Two broader signals are not tied to a single list: sanctioned, for an address on a government sanctions list, and compliance-risk, for an address posing regulatory or compliance risk. List Signals & Behaviours returns the full catalog. Sanctions and related designations are used by:

• Address Risk (v2), attribution and exposure signals
• Address Risk Score (v1), incorporated into the numeric score
• Sanctions & Blacklist Check, direct screening against every list above and issuer blacklists, one entry per list the address is on
• Payment Risk Assessment, attributed address checks

Many packages designate entities rather than publishing every wallet those entities operate. Range also attributes related addresses from entity footprints and onchain relationships. Inferred associations are distinguished from direct list hits so you can treat them differently in policy and review. The Sanctions & Blacklist Check reports this as basis: direct or basis: indirect on each list entry.

---

​

Token issuer blacklists

Range monitors onchain blacklist events emitted by token issuer contracts (stablecoins, tokenized gold and cbBTC). When an issuer blacklists an address, it is blocked from transferring their tokens. Address Risk (v2) and Address Risk Score (v1) report these addresses as the blacklisted signal. Freezes (blacklist), releases (unblacklist) and burns of a frozen balance (destroyedblackfunds) are tracked, providing current status and event history back to each token’s launch. See Supported Tokens for the complete coverage matrix.

---

​

Onchain indexing

Range operates its own indexing infrastructure across supported networks. Counterparty graphs, volume context, and behavioral signals used by Address Risk (v2) are built from Range’s own parsing of blocks and transactions, not from a third-party reseller feed sitting between confirmation and score.

---

​

Threat intelligence

Range maintains a curated attribution dataset from multiple intelligence sources:

​

Attribution labels

Attributed addresses typically include:

• name_tag, human-readable label
• entity, known organization or cluster
• category, type of activity (e.g. hack_funds, scam, phishing)

Blank attribution fields usually mean confidential sources that cannot be disclosed, or ML-flagged addresses without traditional labels.

---

​

Machine learning models

Range’s ML models extend coverage beyond traditional list matching by identifying previously undetected threats through behavioral analysis: payment patterns, timing, and counterparty interactions. Addresses flagged by these models are incorporated into risk scoring alongside traditionally attributed addresses.

---

​

Verified non-malicious addresses

Range maintains verified infrastructure attributions to reduce false positives, including:

• System programs, core blockchain infrastructure (e.g. Solana Token Program, System Program)
• Major exchanges, verified exchange deposit and operational wallets
• Verified protocols, established DeFi protocol and program addresses

On Address Risk (v1), these addresses receive the minimum score. On Address Risk (v2), they are treated as known-good attribution so volume alone does not inflate severity. See Understanding Risk Scores.

---

​

Data freshness

Once a designation is in Range’s attribution set, related addresses across supported networks can be reflected in subsequent screens without waiting for a separate per-chain republication.

---

​

Coverage requests

If you have intelligence about malicious addresses or need coverage for specific threat categories, contact us. We continuously expand data sources based on customer needs and emerging threats.