Antinalysis - free tool to check the dirtyness of bitcoin address

[witcher_sense]

The title pretty much speaks for itself: there is a free tool called Antinalysis, with which you can check with which entities (e.g. exchanges, mixers, blacklists, etc.) your own or someone else's bitcoin address is associated. The list of all known entities, along with the example of how the service performs its search, can be found here.

What I personally liked about this servise is that:

1) It's free to use. However, for bulk checks one needs to purchase API token. You also can donate with XMR if you wish.
2) It claims to respect user's privacy. Lookup history wipes after 72 hours, but one also has an option to specify for how long the data should be kept in their database.
3) No trackers on their website: https://themarkup.org/blacklight?url=antinalysis.org
4) I like the vision of the team (Incognito Team) that created this tool: https://antinalysis.org/about

[1714953380]

1714953380

[o_e_l_e_o]

This tool has been around in various incarnations for a while now. The Tor link is here: http://pdcdvggsz5vhzbtxqn2rh27qovzga4pnrygya4ossewu64dqh2tvhsyd.onion/

I would suggest that you do not use this service for your own addresses though. When they were previously shut down, every address which had been looked up was sent to law enforcement agencies for investigation:

AMLBot also sent all addresses that had used Antinalysis, which were stored in the Crystal blockchain database, to U.K. law enforcement authorities. AMLBot noted that some addresses that had used the Antinalysis tool were previously not linked to the darknet or any illicit activities.

It added: “It can be assumed that criminals used these addresses for illegal actions … These addresses were added to the tracking database and transferred to the most prominent players in the market to [sic] a more effective fight against money laundering.”

It is also impossible to verify their claims that they delete your search records from their database. If you are absolutely hell bent on looking up one of your addresses, then you should do it via Tor and you should do it in among a whole bunch of other random addresses you don't care about.

[witcher_sense]

This tool has been around in various incarnations for a while now. The Tor link is here: http://pdcdvggsz5vhzbtxqn2rh27qovzga4pnrygya4ossewu64dqh2tvhsyd.onion/

Yeah, they created a clearnet portal for better accessibility, basically, it is just a proxy to their .onion domain, which can only be accessed through Tor. Perhaps, I personally would have never known of their existence hadn't they decided to step out of the shadows. I haven't seen anyone mentioning this tool on this forum. So, I am not alone.

I would suggest that you do not use this service for your own addresses though. When they were previously shut down, every address which had been looked up was sent to law enforcement agencies for investigation:

AMLBot also sent all addresses that had used Antinalysis, which were stored in the Crystal blockchain database, to U.K. law enforcement authorities. AMLBot noted that some addresses that had used the Antinalysis tool were previously not linked to the darknet or any illicit activities.

It added: “It can be assumed that criminals used these addresses for illegal actions … These addresses were added to the tracking database and transferred to the most prominent players in the market to [sic] a more effective fight against money laundering.”

In this sense, the said tool should be treated the same as any other blockchain explorer which may or may not collect data about people visiting it. They were using a third-party company's services to gain access to a blockchain surveillance database, but the third-party company decided Antianalysis were doing something illegal and handed over all the information they had to law enforcement. At least, it is clear now that AMLBot is not safe to use since they collect and sell information to whoever asks.

It is also impossible to verify their claims that they delete your search records from their database. If you are absolutely hell bent on looking up one of your addresses, then you should do it via Tor and you should do it in among a whole bunch of other random addresses you don't care about.

It is impossible to verify their claims, but what could their incentives be to keep the record of random bitcoin addresses? Could they sell such information?

[NeuroticFish]

without percentage/confidence rate so i question the accuracy.

This was my feeling too after checking a few addresses. It seems more it tries hard to add certain "good" and "bad" coins to the mix (sometimes from extremely old hack or unknown services) so it looks balanced and give mixed-to-good feeling no matter what.
I mean, how they know an address is from an exchange and not from a web wallet when they tell "unknown exchange"? Or how they know it's a ransomware when they tell "unknown ransomware"?

P.S. The captcha is annoying, some character is almost transparent and people with bad screen would have hard time.

Indeed. I had to refresh the page a few times until the numbers are well readable..

[davis196]

I have pretty much the same concerns as all the forum members,who tried this service before me:
1.I guess that the FBI has created this service,in order to gather more data about BTC addresses.However,I might be wrong.
2.There's no way to prove that they don't track you,so I would not use such service again.
3.I don't trust the accuracy of this tool.The final data might be a bunch of made up gibberish.
4.Who is going to use this tool?I guess that 99% of the Bitcoiners simply don't care about a BTC address being "dirty" or "clean".

[o_e_l_e_o]

It is impossible to verify their claims, but what could their incentives be to keep the record of random bitcoin addresses? Could they sell such information?

A list of addresses which are owned by people who are specifically interested in maintaining privacy, plus maybe having IP addresses to match? Blockchain analysis companies would love such data.

I mean, how they know an address is from an exchange and not from a web wallet when they tell "unknown exchange"? Or how they know it's a ransomware when they tell "unknown ransomware"?

All it does is look at every deposit to an address, and follow those coins back until they hit a match against one of their categories. If you withdraw from an exchange, for example, and your coins come from an address which is not yet known to belong to that exchange (since exchanges use new addresses all the time), then it will just keep going back in time until it does hit a match.

If you do have concerns with the history of your coins, then rather than looking them up on such service better to just mix or coinjoin them and be done with it.

[NeuroticFish]

I mean, how they know an address is from an exchange and not from a web wallet when they tell "unknown exchange"? Or how they know it's a ransomware when they tell "unknown ransomware"?

All it does is look at every deposit to an address, and follow those coins back until they hit a match against one of their categories. If you withdraw from an exchange, for example, and your coins come from an address which is not yet known to belong to that exchange (since exchanges use new addresses all the time), then it will just keep going back in time until it does hit a match.

I guess that it's something like that, but since they don't know which centralized exchange it is, it may be very well any other centralized service following the same pattern. Like a centralized custodian web wallet provider.

If you do have concerns with the history of your coins, then rather than looking them up on such service better to just mix or coinjoin them and be done with it.

That's true, although some are still afraid of mixers and how will <insert CEX here> react when they send those coins there.

It is impossible to verify their claims, but what could their incentives be to keep the record of random bitcoin addresses? Could they sell such information?

They may rely on people's predisposition to guilt and stupid actions ("the guilty always returns to the crime scene" - no matter whether this is actually true or not), assuming that people will visit them more for checking their own funds are OK than out of curiosity on random addresses/funds. But this is just a wild guess

[dkbit98]

The title pretty much speaks for itself: there is a free tool called Antinalysis, with which you can check with which entities (e.g. exchanges, mixers, blacklists, etc.) your own or someone else's bitcoin address is associated. The list of all known entities, along with the example of how the service performs its search, can be found here.

This tool can be useful sometimes, and having .onion domain is good, but I doubt it is accurate enough, except for well known addresses that are publicly blacklisted like ofac list and others.
I tried testing with one address used in fake giveaway scam and Antinalysis result showed connection with exchanges kraken, binance and unknown miner.
This could be said for most bitcoins that are circulating today, they are all connected with some exchange and unknown miners.
I would not trust any website like this, and it could mean that you could be targeting your address as suspicious just by entering it in this website.

[pooya87]

I honestly don't see how such a tool is useful at all for regular users.
For starters it is a bad trend that has been going on saying there is such a thing as "dirty bitcoins". If anything we should fight such services instead of advertising them.
Besides as Leo mentioned these tools are more like honeypots created to gather information not to help users. They are building a database of bitcoiners, their addresses and IPs. This could be used to further deanonymize users when combined with other information such as the spy nodes that track IPs and transactions on bitcoin network.

[witcher_sense]

I honestly don't see how such a tool is useful at all for regular users.

Unlike bitcoin maximalists, who are advocating for bitcoin fungibility, or staunch supporters of privacy, freedom, and self-sovereignty, AML compliant centralized services don't care about all these things because their revenue depends on how well they are flirting with regulators. And for a regular user, who already has given up his privacy by undergoing a full process of identity verification on a centralized exchange, it does make sense to check his bitcoin address for AML risk before depositing on the given exchange to avoid or minimize chances of getting blocked or frozen. For those users who haven't yet undergone KYC, it is even more useful since it can protect them from being asked by an exchange to give up their privacy.

For starters it is a bad trend that has been going on saying there is such a thing as "dirty bitcoins". If anything we should fight such services instead of advertising them.

Seriously, what do you mean by "fight?" How are we supposed to fight them without even mentioning them or discussing them? I agree with you: one bitcoin always equals another bitcoin, and the traceability of bitcoin transactions shouldn't in any way affect its other important monetary characteristics that make it better money. The thing is that despite the alignment of our views regarding the fungibility of bitcoin, the problem remains; you can't solve it just by never talking about it. You also can't solve it by silencing others.

Besides as Leo mentioned these tools are more like honeypots created to gather information not to help users. They are building a database of bitcoiners, their addresses and IPs. This could be used to further deanonymize users when combined with other information such as the spy nodes that track IPs and transactions on bitcoin network.

This service may well be a honeypot to collect user data. We can't verify it is not. But it is always better to have a free alternative to paid services that are definitely known to have been collecting and sharing data with authorities.

[o_e_l_e_o]

So out of interest, I put in Binance's hot wallet address - 1NDyJtNTjmwk5xPNhjgAMu4HDHigtobu1s

It stands to reason that anyone who withdraws coins from Binance, and therefore from this address, will receive coins which have the exact same "taint" as coins currently in this address. The breakdown is as follows:

• 50% exchanges - other Binance addresses, presumably their cold wallets
• 25% unknown miner - presumably Binance pool
• 25% ofac sanctions blacklist

I did the same with one of Bittrex's current hot wallet addresses - 1MTwuZHvpmfu3Mupff8Ysomwuqm7rVaUgQ

Much larger spread in this case, most coming from other exchanges and a couple of mining pools, but also a significant minority coming from known scams, known hacks, and two different blacklists.

This raises two points. Obviously whatever mechanism this site is using to assign "taint" is different to what exchanges are using, otherwise these "tainted" coins wouldn't have ended up in exchange's hot wallets in the first place. And secondly, just because your coins came from a centralized exchange does not mean they are clean or free from taint, and another exchange might very well still discriminate against you and your coins.

it does make sense to check his bitcoin address for AML risk before depositing on the given exchange to avoid or minimize chances of getting blocked or frozen

This is not directed at you, but rather in general, but I have never understood this mentality of "We must bend over backwards and give up every shred of privacy to make sure these exchanges will continue to serve us", whereas any rational person would just say "Well, don't use exchanges which will steal your coins".

[bitmover]

• 50% exchanges - other Binance addresses, presumably their cold wallets
• 25% unknown miner - presumably Binance pool
• 25% ofac sanctions blacklist

I got similar results in signature campaign addresses from random forum members, just to test.

I believe those "sanctions blacklist' could possibly include legit casinos and mixer services. They are not necessarily scams.

I believe in future we all need to be more careful about our addresses and from which addresses we are going to spend our bitcoins, specially if we use centralized exchanges.

[pooya87]

Seriously, what do you mean by "fight?" How are we supposed to fight them without even mentioning them or discussing them?

For starters you hit them where it hurts, their revenue. Start campaigns against centralized exchanges that are forcing this ridiculous trend of "blocking accounts of because of taint" thing to either get them to stop doing it (hence cutting off the taint service revenue) or creating the incentive for other exchanges to be created that don't use taint-service to attract the first exchange's customers hence hitting both service's revenues.

It has happened multiple times in the past, the most recent case is Binance. It didn't become a big exchange because it was a good one! It became big because the 2 big altcoin exchanges at the time (Bittrex and Poloniex) were both having a lot of problems and were intensely enforcing KYC among other scams they pulled. So people needed an alternative and Binance capitalized on that by not doing the same things (at first).

But it is always better to have a free alternative to paid services that are definitely known to have been collecting and sharing data with authorities.

The question I like to ponder about is why would a business that is offering some service to earn money offers it for free...

[dkbit98]

• 25% ofac sanctions blacklist

Could this be one of the reasons why Binance has recently been kissing asses of regulators more than usual, they are even going one step further to comply with something that nobody asked them to do?
I would like to hear more from developers of Antinalysis website so they can clarify better how they are making their reports and what's tolerable percentage of mistakes.
It's not a big surprise when we know that many scammers used Binance exchange for washing their coins from hacks and fake giveaways.[/list]

[o_e_l_e_o]

I got similar results in signature campaign addresses from random forum members, just to test.

Given that this service has previously provided lists of addresses to blockchain analysis companies and government agencies as I linked to above, then perhaps this isn't a super helpful thing to be doing.

I believe those "sanctions blacklist' could possibly include legit casinos and mixer services. They are not necessarily scams.

Doesn't really matter. If coins from exchanges are one these blacklists, and other exchanges are enforcing these blacklists, then it means your so called "clean" coins withdrawn from centralized exchanges can in fact still be "tainted".

The question I like to ponder about is why would a business that is offering some service to earn money offers it for free...

As the saying goes - "If you are getting something for free, then you are the product."

It's not a big surprise when we know that many scammers used Binance exchange for washing their coins from hacks and fake giveaways.

Absolutely, which is just yet more proof that "taint" is completely meaningless. People on this forum regularly tell people to stick to big exchanges like Binance and never to use peer to peer trading, coinjoins, mixers, etc. for fear of receiving tainted coins, and yet, Binance regularly accepts coins related to illicit activities and then sends those same coins out to other users. And as this service shows, just because the coin was deposited to Binance doesn't mean that any other exchange won't still class those coins as tainted.

[buwaytress]

Nice post OP and o_e_l_e_o for pointing out it's not actually a new script, just another iteration... is it as close enough version of AMLBot as well? The latter is something I've been following for a while, but my impressions of it in 2020 was that it wasn't good enough -- though skimming through it now I see it's truly grown to cover a lot of chains.

[witcher_sense]

As the saying goes - "If you are getting something for free, then you are the product."

Right. However, if you are paying for something, that in no way guarantees you are not being used or seen as a product. After all, the idea of having an additional source of income by secretly selling all your data may seem very tempting to them.

For starters you hit them where it hurts, their revenue. Start campaigns against centralized exchanges that are forcing this ridiculous trend of "blocking accounts of because of taint" thing to either get them to stop doing it (hence cutting off the taint service revenue) or creating the incentive for other exchanges to be created that don't use taint-service to attract the first exchange's customers hence hitting both service's revenues.

Our interests do not coincide with the interests of centralized exchanges, so it is useless to convince them of something. "It is difficult to get a man to understand something when his salary depends upon his not understanding it." As users who understand and respect the core principles of Bitcoin, we want to build a circular bitcoin economy in which the stupid, ineffective, obsolete laws of fiat currencies don't work or are ignored. This economy is open for everyone to join, with whatever coins they have. Exchanges, on the other hand, try to build their own version of the economy - a closed, isolated economy, which would be open only to those with documents and bank accounts. This type of bitcoin economy would allow only "clean" coins transfers between "trusted" third-party services that are KYC/AML compliant and loyal to regulators.

So, instead of fighting exchanges and trying to get them to understand the principles we are fighting for, we should be building an independent economy that will never touch the fiat world again. The tools like Antinalysis and others can be useful for those who, for some reason, aren't yet ready for a circular bitcoin economy but who, at the same time, want to be kind of protected from harsh laws of the fiat world that may lock them up inside isolated system of KYCed.

[SFR10]

I haven't seen anyone mentioning this tool on this forum.

There's already a thread about their services, but it's under a different name: [2021-14-08] Elliptic discovers site that checks how "clean" digital coins are
^{- Back then, you had to pay roughly $3 for a single lookup!}

is it as close enough version of AMLBot as well?

I got a significantly different result on each of these services ^{[not sure which one is more accurate since they're no longer using AMLBot's API]}.

[PrimeNumber7]

4) I like the vision of the team (Incognito Team) that created this tool: https://antinalysis.org/about

It appears they are claiming their tool is for individual users, but I see no reason why an individual user would ever want to use this kind of tool (other than entertainment purposes).

In general, it should not be a surprise to you if you have coin that is associated with criminal activity (or from an exchange or a miner).

Obviously whatever mechanism this site is using to assign "taint" is different to what exchanges are using, otherwise these "tainted" coins wouldn't have ended up in exchange's hot wallets in the first place.

This is not necessarily true.

A potential criminal could deposit their coin today, and tomorrow, it could be alledged that the particular coin deposited was associated with criminal activity. Binance could accept the deposit because they would have no way of knowing about the alleged theft, while a chain analysis company, looking at the transaction months (or later) after the fact might know about the alleged theft.

[o_e_l_e_o]

A potential criminal could deposit their coin today, and tomorrow, it could be alledged that the particular coin deposited was associated with criminal activity. Binance could accept the deposit because they would have no way of knowing about the alleged theft, while a chain analysis company, looking at the transaction months (or later) after the fact might know about the alleged theft.

That is maybe true for the odd deposit here or there, but the two addresses I checked above have somewhere approaching 25% of their funds coming from known hacks, known scams, on blacklists, known darknet markets, etc. These are addresses which have processed tens or even hundreds of thousands of bitcoin. This pattern is repeated across a number of other exchange addresses I pulled from https://www.walletexplorer.com/

There is obviously a long standing pattern of exchanges being very inconsistent as to what they consider tainted and what they consider clean, and every exchange will have their own metrics. This means that coins you think are clean may still be treated as tainted by some exchanges but not others, and coins you withdraw from some exchanges may not be clean in the eyes of other exchanges.

As I've said many times, taint is completely arbitrary and completely meaningless, and we should, as a community, stop supporting centralized exchanges which enforce this complete nonsense.