Blockchain Analysis

POST

https://app.rillis.io/api/v1/analysis-crypto/risk-wallet/send

This endpoint performs an in-depth risk analysis of a blockchain wallet based on its address and network. The response includes:

Address Metadata: network, asset type, address subtype, and block-level details.

Risk Scoring: overall risk level (LOW, MEDIUM, HIGH) and numerical score (CSCORE) derived from exposure to sanctioned entities, darknet, OTC patterns, and other illicit behaviors.

Risk Indicators: detailed list of triggered conditions (e.g., high-value transactions, proximity to risky addresses) grouped by category.

Entity Profiling: identifies associated owner (if known), cluster membership (related addresses), and behavioral tags (e.g., darknet market, drugs trade).

Transaction Analysis: stats on volume, frequency, USD-equivalent inflows/outflows, first/last transaction details, and current balance.

Request

Body Params application/json

Examples

Responses

🟢200Created

application/json

Body

🟠400Bad Request

🟠401Unauthorized

Request Example

Shell

JavaScript

Java

Swift

curl --location --request POST 'https://app.rillis.io/api/v1/analysis-crypto/risk-wallet/send' \
--header 'Content-Type: application/json' \
--data-raw '{
    "client_id":"1MpwlwE11dHixJpB8Ksy0sfVON1019EbqRb0+LvSRAU=",
    "client_secret":"ee592d0c880795f14308084088381150f0862a1dce12cf9cea60345ca3671083c708363cc4296a3451afb097b38079fb5b1019a9cf7048a91e7bf2d781eb28bf",
    "network":"BITCOIN",
    "address":"35M4Ar89gBjeoa9CvGEfModV6FFimhVxaX",
    "force_search": true
}'

Response Example

200 - Success

{
    "external_id": "0a5953e6-3a51-4f4a-b742-20f8c2b04fa5",
    "beneficiaryId": null,
    "userId": "64204dd759290a9403fef44e",
    "ownerId": null,
    "asset": "BTC",
    "network": "BITCOIN",
    "address": "35M4Ar89gBjeoa9CvGEfModV6FFimhVxaX",
    "alias": null,
    "attemptIdentifier": null,
    "assetAmount": 0,
    "usdAmount": 0,
    "externalId": "76d73110655c22e31630dbd191661c3a07cebc7646918bf8f9332bf7b265f2ed",
    "status": "completed",
    "addressIdentification": {
        "customAddresses": [],
        "chainalysisIdentifications": []
    },
    "alerts": [],
    "risk_level": "HIGH",
    "sanctioned_categories": [],
    "analyzed_at": 1760725598488,
    "createdAt": "2025-10-24T15:04:54.093Z",
    "response_provider": {
        "report_info_section": {
            "version": "3.4",
            "address": "35M4Ar89gBjeoa9CvGEfModV6FFimhVxaX",
            "report_id": "76d73110655c22e31630dbd191661c3a07cebc7646918bf8f9332bf7b265f2ed",
            "address_type": "BTC",
            "address_subtype": "P2SH",
            "asset": "BTC",
            "precision": 8,
            "report_type": "standard",
            "report_time": "2025-10-17T18:26:36.590Z",
            "report_block_height": 919541,
            "address_used": true,
            "is_cluster": true,
            "early_access": false
        },
        "cscore_section": {
            "cscore": 99,
            "risk_level": "HIGH",
            "cscore_info": [
                {
                    "name": "Address directly related to drugs trade",
                    "group_name": "Drugs trade",
                    "impact": 15,
                    "type": 1,
                    "id": 22,
                    "custom_risk_level": "HIGH"
                },
                {
                    "name": "Address with part of incoming transactions in close proximity to addresses related to drugs trade",
                    "group_name": "Drugs trade",
                    "impact": 15,
                    "type": 1,
                    "id": 49,
                    "custom_risk_level": "MEDIUM"
                },
                {
                    "name": "Address with significant part of outgoing transactions in close proximity to addresses related to drugs trade",
                    "group_name": "Drugs trade",
                    "impact": 15,
                    "type": 1,
                    "id": 50,
                    "custom_risk_level": "HIGH"
                },
                {
                    "name": "Address directly related to darknet market",
                    "group_name": "Darknet market related",
                    "impact": 12,
                    "type": 1,
                    "id": 21,
                    "custom_risk_level": "HIGH"
                },
                {
                    "name": "Address with part of incoming transactions in close proximity to addresses related to darknet markets",
                    "group_name": "Darknet market related",
                    "impact": 12,
                    "type": 1,
                    "id": 147,
                    "custom_risk_level": "MEDIUM"
                },
                {
                    "name": "Address with significant part of outgoing transactions in close proximity to addresses related to darknet markets",
                    "group_name": "Darknet market related",
                    "impact": 12,
                    "type": 1,
                    "id": 239,
                    "custom_risk_level": "HIGH"
                },
                {
                    "name": "Address found on deep web",
                    "group_name": "Deep web",
                    "impact": 4,
                    "type": 1,
                    "id": 56,
                    "custom_risk_level": "MEDIUM"
                },
                {
                    "name": "Address with part of incoming transactions in close proximity to addresses found on deep web",
                    "group_name": "Deep web",
                    "impact": 4,
                    "type": 1,
                    "id": 53,
                    "custom_risk_level": "LOW"
                },
                {
                    "name": "Address with significant part of outgoing transactions in close proximity to addresses found on deep web",
                    "group_name": "Deep web",
                    "impact": 4,
                    "type": 1,
                    "id": 54,
                    "custom_risk_level": "MEDIUM"
                },
                {
                    "name": "Address related to subject appearing in sanctions lists",
                    "group_name": "Sanctioned subject",
                    "impact": 69,
                    "type": 1,
                    "id": 308,
                    "custom_risk_level": "HIGH"
                }
            ]
        },
        "profile_section": {
            "owner": {
                "id": 6259,
                "uuid": "e7633892-f2f2-11ec-96e2-288023913720",
                "name": "Hydra Market",
                "url": "http://hydraruzxpnew4af.onion/"
            },
            "cluster_info": [
                {
                    "name": "CLUSTER",
                    "value": "YES",
                    "description": "There are a total of 6 630 953 addresses belonging to same owner"
                }
            ],
            "identified_profiles": [
                {
                    "profile_name": "Sanctioned subject",
                    "profile_type": "OWNER"
                },
                {
                    "profile_name": "Darknet market",
                    "profile_type": "OWNER"
                },
                {
                    "profile_name": "Drugs trade",
                    "profile_type": "OWNER"
                },
                {
                    "profile_name": "Deep web",
                    "profile_type": "OWNER"
                }
            ],
            "darknet_info": [
                {
                    "value": "4",
                    "description": "Address with part of incoming transactions in close proximity to addresses related to darknet markets"
                },
                {
                    "value": "4",
                    "description": "Address with part of incoming transactions in close proximity to addresses found on deep web"
                },
                {
                    "value": "87",
                    "description": "Address with significant part of outgoing transactions in close proximity to addresses related to darknet markets"
                },
                {
                    "value": "87",
                    "description": "Address with significant part of outgoing transactions in close proximity to addresses found on deep web"
                }
            ]
        },
        "financial_analysis_section": {
            "transactions": {
                "avg_tx_fee": 33572,
                "avg_tx_size": 11482,
                "days_without_tx": 929,
                "receive_peak": 2,
                "sum_tx_fee": 772148,
                "tx_count": 47,
                "transfers_count": 47,
                "days_since_start": 1375,
                "cc_turnover": 2597675,
                "usd_turnover": 2773.36
            },
            "cc_balance": 68639,
            "usd_balance": 73.28,
            "usd_balance_without_tokens": 73.28,
            "usd_exchange_rate": 106763,
            "first_input": {
                "block_time": "2022-01-11T10:24:22.000Z",
                "tx_hash": "deb6d86019756c5d997e29d16c1966bff20a4f4587862672eaf3ac3da34671f6",
                "amount": 73572,
                "usd_value": 30.82,
                "block_height": 718136,
                "activated": false
            },
            "first_output": {
                "block_time": "2022-01-15T12:38:05.000Z",
                "tx_hash": "4821ac4ef2a21c81a3b947d660207e5bdb7757ae84a2730957488a8523bd6b95",
                "amount": 73572,
                "usd_value": 31.61,
                "block_height": 718802,
                "activated": false
            },
            "last_input": {
                "block_time": "2023-04-02T17:21:51.000Z",
                "tx_hash": "cc2cbf06b0bc77cb09e6462229f2869e6c805c34298865a27e170722d6a91e11",
                "amount": 68639,
                "usd_value": 21.14,
                "block_height": 797208,
                "activated": false
            },
            "last_output": {
                "block_time": "2022-04-02T17:21:51.000Z",
                "tx_hash": "cf64e0b632ff64d45224e5f507ac01bd8883e2b9bf50b5956025eef2f81c5270",
                "amount": 57257,
                "usd_value": 26.55,
                "block_height": 730131,
                "activated": false
            },
            "total_input": {
                "total_cc_inflow": 1333157,
                "avg_cc_inflow": 55548,
                "min_cc_inflow": 28091,
                "max_cc_inflow": 107200,
                "receive_count": 24,
                "receive_transaction_count": 24,
                "total_usd_inflow": 1423.32,
                "avg_usd_inflow": 59.3,
                "min_usd_inflow": 29.99,
                "max_usd_inflow": 114.45
            },
            "total_output": {
                "total_cc_outflow": 1264518,
                "avg_cc_outflow": 54979,
                "min_cc_outflow": 28091,
                "max_cc_outflow": 107200,
                "sent_count": 23,
                "sent_transaction_count": 23,
                "total_usd_outflow": 1350.04,
                "avg_usd_outflow": 58.7,
                "min_usd_outflow": 29.99,
                "max_usd_outflow": 114.45
            }
        },
        "custom_cscore_group_by_group_name": {
            "Drugs trade": [
                {
                    "name": "Address directly related to drugs trade",
                    "group_name": "Drugs trade",
                    "impact": 15,
                    "type": 1,
                    "id": 22,
                    "custom_risk_level": "HIGH"
                },
                {
                    "name": "Address with part of incoming transactions in close proximity to addresses related to drugs trade",
                    "group_name": "Drugs trade",
                    "impact": 15,
                    "type": 1,
                    "id": 49,
                    "custom_risk_level": "MEDIUM"
                },
                {
                    "name": "Address with significant part of outgoing transactions in close proximity to addresses related to drugs trade",
                    "group_name": "Drugs trade",
                    "impact": 15,
                    "type": 1,
                    "id": 50,
                    "custom_risk_level": "HIGH"
                }
            ],
            "Darknet market related": [
                {
                    "name": "Address directly related to darknet market",
                    "group_name": "Darknet market related",
                    "impact": 12,
                    "type": 1,
                    "id": 21,
                    "custom_risk_level": "HIGH"
                },
                {
                    "name": "Address with part of incoming transactions in close proximity to addresses related to darknet markets",
                    "group_name": "Darknet market related",
                    "impact": 12,
                    "type": 1,
                    "id": 147,
                    "custom_risk_level": "MEDIUM"
                },
                {
                    "name": "Address with significant part of outgoing transactions in close proximity to addresses related to darknet markets",
                    "group_name": "Darknet market related",
                    "impact": 12,
                    "type": 1,
                    "id": 239,
                    "custom_risk_level": "HIGH"
                }
            ],
            "Deep web": [
                {
                    "name": "Address found on deep web",
                    "group_name": "Deep web",
                    "impact": 4,
                    "type": 1,
                    "id": 56,
                    "custom_risk_level": "MEDIUM"
                },
                {
                    "name": "Address with part of incoming transactions in close proximity to addresses found on deep web",
                    "group_name": "Deep web",
                    "impact": 4,
                    "type": 1,
                    "id": 53,
                    "custom_risk_level": "LOW"
                },
                {
                    "name": "Address with significant part of outgoing transactions in close proximity to addresses found on deep web",
                    "group_name": "Deep web",
                    "impact": 4,
                    "type": 1,
                    "id": 54,
                    "custom_risk_level": "MEDIUM"
                }
            ],
            "Sanctioned subject": [
                {
                    "name": "Address related to subject appearing in sanctions lists",
                    "group_name": "Sanctioned subject",
                    "impact": 69,
                    "type": 1,
                    "id": 308,
                    "custom_risk_level": "HIGH"
                }
            ]
        }
    },
    "id": "68fb95965c3093b83e0767a7"
}

Modified at 2025-10-24 19:16:17

Blacklist Matching Logic

Individuals Analysis