alex778/aml-checker repository overview

⁠AML Checker (Docker image, no API keys)

Minimal AML checker for BTC / ETH / TRON addresses using public lists:

• OFAC SDN (sdn.xml)
• Tornado Cash (derived from OFAC entries)
• Public scam/blacklist lists (MEW darklist + CryptoScamDB GitHub dataset)
• Extra public sources (bulk, no API keys):
  • Threatview malicious BTC feed
  • OFAC sanctioned digital-currency address lists (0xB10C nightly lists branch)
  • ScamSniffer EVM scam address list

This image is CLI-only (headless).

⁠Quick start

Run a check:

docker run --rm alex778/aml-checker:latest 0x0000000000000000000000000000000000000000

⁠Update lists (download)

docker run --rm alex778/aml-checker:latest --update 0x0000000000000000000000000000000000000000

⁠Persist lists/cache on disk (recommended)

Mount data/ so lists are reused across runs (saves time and avoids re-downloading):

mkdir -p ./data
docker run --rm \
  -v "$PWD/data:/app/data" \
  alex778/aml-checker:latest --update 0x0000000000000000000000000000000000000000

After the first run, next runs are much faster because lists are read from ./data/lists/.

Lists on disk:

• data/lists/ofac_sdn_xml.xml
• data/lists/mew_eth_darklist.json
• data/lists/cryptoscamdb_addresses.yaml
• data/lists/cryptoscamdb_uris.yaml
• data/lists/scamsniffer_addresses.json
• data/lists/threatview_malicious_btc.txt
• data/lists/ofac_sanctioned_xbt.txt
• data/lists/ofac_sanctioned_eth.txt
• data/lists/ofac_sanctioned_trx.txt

SQLite cache/metadata:

• data/cache.sqlite3

Default behavior:

• If a list file already exists, it is used from disk and not re-downloaded.
• If a list file is missing, the container will try to download it.
• Very small / placeholder cached files are treated as missing and re-downloaded automatically.

⁠Add your own addresses (custom blacklist)

Create ./data/custom_blacklist.txt (mounted into /app/data/custom_blacklist.txt).

Format per line:

# address|label|reference(optional)
1B1Vov1LTLGLcVG3ycPQhQLe81V67FZpMZ|chainabuse se*tortion|https://chainabuse.com/

⁠Add extra public sources (arbitrary URLs)

Provide AML_EXTRA_SOURCES_JSON (download + cache + best-effort scan for BTC/ETH/TRON addresses):

docker run --rm \
  -e AML_EXTRA_SOURCES_JSON='[
    {"name":"my_extra_1","url":"https://raw.githubusercontent.com/org/repo/main/list.txt","kind":"txt","min_size_bytes":1000}
  ]' \
  -v "$PWD/data:/app/data" \
  alex778/aml-checker:latest --update 0x0000000000000000000000000000000000000000

⁠Force re-download (ignore cached files)

docker run --rm \
  -v "$PWD/data:/app/data" \
  alex778/aml-checker:latest --update --force-update 0x0000000000000000000000000000000000000000

⁠SSL / corporate proxy (optional)

If list downloads fail with a certificate error (TLS interception), you can:

• Provide your CA bundle (recommended): AML_CA_BUNDLE=/path/to/corp-ca.pem
• Disable TLS verification (not recommended): AML_SSL_NO_VERIFY=1

Example:

docker run --rm \
  -e AML_SSL_NO_VERIFY=1 \
  -v "$PWD/data:/app/data" \
  alex778/aml-checker:latest --update 0x0000000000000000000000000000000000000000