Search and filter entities using flexible, multi-field queries with in-memory indexing for optimal performance.

Use Cases:

• Compliance filtering: Find all non-OFAC entities in specific countries
• Entity discovery: Full-text search across names and descriptions
• Chemical tracking: Search by CAS numbers for precursor chemical vendors
• Contact lookup: Find entities by email, Twitter, or Telegram
• Risk filtering: Filter by entity type, tags, and regulatory status
• Multi-criteria research: Combine multiple filters for precise targeting

Search Strategy:

• AND Logic: All specified filters must match (narrow results)
• Array Fields: Search across all positions (countries, CAS, tags use OR within array)
• Text Search: Uses fuzzy matching via Fuse.js for typo tolerance
• Performance: In-memory search index provides <50ms response times

Available Filters:

• query: Full-text search across entity name and description (fuzzy)
• name: Filter by entity name (case-insensitive partial match)
• entity_type: Filter by entity type (case-insensitive partial match)
• country: Search all 6 associated country fields
• email: Filter by contact email
• cas: Search all 16 CAS number fields
• tag: Search all 7 entity tag fields
• twitter: Filter by Twitter handle
• telegram: Filter by Telegram handle
• ofac: Filter by OFAC sanctioned status (boolean)
• dead: Filter by defunct/inactive status (boolean)
• centralized: Filter by centralization status (boolean)
• no_kyc_req: Filter by KYC requirement status (boolean)

Example Queries:

• ?country=China&cas=124-38-9 - Chinese entities with specific CAS number
• ?query=exchange&ofac=false&dead=false - Active, non-sanctioned exchanges
• ?entity_type=darknet&country=Russia - Russian darknet entities
• ?email=support@ - Entities with support email addresses

Retrieve all entities from the Entity Intelligence catalogue with pagination.

Use Cases:

• Browse the complete entity database
• Export entity data for compliance systems
• Build local entity reference databases
• Bulk entity profiling and analysis

Endpoint Features:

• Returns all entities sorted deterministically by internal ID
• Pagination support for efficient data retrieval
• Complete entity metadata for each entry

Returns:

• Array of all entity objects
• Total count for pagination
• Query execution time metrics

Retrieve comprehensive metadata for a specific entity from the Entity Intelligence database.

Use Cases:

• Entity due diligence
• Risk assessment and profiling
• Compliance research
• Regulatory reporting

Response includes:

• Complete entity profile
• Business information (CEO, year founded, contact details)
• Regulatory status (OFAC, KYC requirements)
• Geographic information (associated countries)
• Social media and communication channels
• Parent entity relationships
• Chemical tracking data (for precursor chemical vendors)

Note: This endpoint returns the full entity object. Not all fields will be populated for every entity, especially illicit entities which lack business information.

Retrieve attribution data for a specific blockchain address in real-time.

Use Cases:

• Real-time compliance checks during transactions
• Address screening for withdrawals
• KYC/AML verification
• Risk assessment for incoming payments

Response includes:

• Entity identification
• Entity type classification
• Classification tags
• Beneficial owner information
• Custodian details

Supported Address Formats:

• Bitcoin P2PKH (1...)
• Bitcoin P2SH (3...)
• Bitcoin Bech32 (bc1...)

Retrieve all transactions for a specific blockchain address with high-performance cursor-based pagination.

Use Cases:

• Transaction history analysis for compliance
• Address activity monitoring
• Flow tracking and forensics
• Customer due diligence and transaction review

Pagination Methods:

Cursor-Based (Recommended):

• Use the after parameter with the next_cursor from previous response
• Constant performance regardless of page depth
• Ideal for addresses with millions of transactions
• ~1-2 seconds per page at any depth

Offset-Based (Legacy):

• Use offset and limit parameters
• Backwards compatible with existing integrations
• Performance degrades on deep pages
• Use for addresses with few transactions or when you need total count

Query Details:

• Finds transactions where address appears in inputs OR outputs
• Results sorted by block number ASC (deterministic ordering)
• Each result includes: txid, timestamp, block number, block date

Response includes:

• Array of transaction metadata
• Pagination cursor for next page
• Optional total count (offset mode only)

Retrieve all blockchain addresses associated with a specific entity with high-performance cursor-based pagination.

Use Cases:

• Entity footprint investigation
• Comprehensive address mapping for compliance
• Risk exposure analysis across all entity addresses
• Network analysis and flow tracking

Pagination Methods:

Cursor-Based (Recommended):

• Use the after parameter with the next_cursor from previous response
• Constant performance regardless of page depth
• Ideal for large entities (100K+ addresses)
• ~1 second per page at any depth

Offset-Based (Legacy):

• Use offset and limit parameters
• Backwards compatible with existing integrations
• Performance degrades on deep pages (page 100+ may be slow)
• Use for small entities or when you need total count

Performance Comparison:

• Page 1: Both methods ~1s
• Page 100 (offset=10,000): Cursor ~2s vs Offset ~25s
• Page 1000 (offset=100,000): Cursor ~1s vs Offset ~85s

Response includes:

• Entity metadata (name, type)
• Array of blockchain addresses
• Pagination cursor for next page
• Optional total count (offset mode only)

Retrieve transaction data enriched with entity attributions for all inputs and outputs.

Use Cases:

• Transaction monitoring and compliance
• Flow analysis between entities
• Identifying counterparties in transactions
• Risk assessment for transaction approvals

Response includes:

• Complete transaction details (block, timestamp, fees)
• All inputs with entity attributions
• All outputs with entity attributions
• OFAC sanctions status for each entity
• Risk tags and classifications

Surikata-X Darknet Crypto Intelligence API

Overview

Surikata-X provides comprehensive darknet intelligence for blockchain addresses, combining entity attribution, transaction tags, and evidence verification. This endpoint delivers real-time intelligence focused on CSAM and human trafficking cryptocurrency addresses, identifying addresses hours to days before first funding occurs.

Key Features

Entity Intelligence

• Entity Identification: Links addresses to known entities with full metadata
• Entity Type Classification: Categorizes entities (exchange, darknet, mixer, etc.)
• Proper Name & URLs: Provides business names and associated websites
• Evidence Verification: Direct links to ethical screenshots proving attribution

Tag Intelligence (Unknown Entities)

• Transaction Tags: Identifies high-risk transaction patterns
• Counterparty Analysis: Maps relationships to known nefarious entities
• Tag Evidence: Links to screenshots verifying tag classifications
• Network Mapping: Reveals connections within trafficking networks

Proactive Detection

• Pre-Funding Identification: Detects addresses in CSAM and human trafficking networks before first funding
• Real-Time Intelligence: Continuous monitoring and classification
• Ethical Collection: All intelligence backed by filtered screenshots capturing source and address

Use Cases

Compliance & Risk Management

• Real-Time Screening: Screen addresses during transactions for CSAM and human trafficking indicators
• Risk Avoidance: Identify high-risk addresses before co-spending occurs
• Due Diligence: Access complete entity profiles with evidence verification

Law Enforcement & Investigations

• Darknet Investigations: Track cryptocurrency addresses in CSAM and human trafficking networks
• Network Analysis: Map relationships between addresses and known entities
• Evidence Collection: Access ethical screenshots for legal proceedings

Threat Intelligence

• Proactive Monitoring: Identify new addresses in high-risk networks
• Pattern Recognition: Detect transaction patterns associated with illicit activity
• Intelligence Feeds: Integrate with threat intelligence platforms

Response Structure

The API returns comprehensive intelligence data including:

• Match Type: How the address was matched

  • match_type: DIRECT (address has own evidence), CLUSTERED (attributed via seed address in blockchain cluster), or null (no match)

• Entity Data: When an address is attributed to a known entity

  • entity_id: Unique entity identifier
  • entity_type: Classification (e.g., "exchange", "darknet", "mixer")
  • proper_name: Business or entity name
  • first_seen: ISO 8601 timestamp of when this address was first observed
  • urls: Associated websites
  • entity_id_evidence: Direct links to evidence screenshots

• Tag Data: When an address is not attributed but has transaction tags

  • tags: Array of tag entries with transaction details
  • Each tag includes: tag, txid, cp_addr, related_entity_id, proper_name, url, tag_evidence

• Chain Detection: Automatically detects Bitcoin or Ethereum addresses

Data Tiers

Every API key has a data tier, reported on each response in the X-Data-Tier header and meta.data_tier:

• realtime (end users, compliance, law enforcement): everything as collected.
• delayed (analytic companies, resellers, OSINT platforms): intelligence first observed within the key's delay window (X-Data-Delay-Days, default 14 days) is withheld. A delayed key sees exactly what a real-time key saw that many days earlier. The delay is applied to the data's own observation timestamps (first_seen), not to request time. Delayed keys can call only the address-intelligence endpoints (surikata-x, attributions/address/{address}, .../transactions, entity-evidence/by-address/{address}, usage); other endpoints return 403.

When a delayed key queries an address whose intelligence is newer than its window, the response is an embargo marker (HTTP 200) that says intelligence exists, when it becomes available on that key, and how to obtain real-time access — but carries no entity, type, name, tags or evidence:

{
  "success": true,
  "data": {
    "address": "bc1qexampleaddress",
    "chain": "bitcoin",
    "embargoed": true,
    "data_delay_days": 14,
    "available_after": "2026-10-04T00:00:00.000Z",
    "message": "BlockScout holds intelligence on this address that was collected within the last 14 days. It becomes available on this delayed key after 2026-10-04.",
    "realtime": {
      "available": true,
      "message": "Real-time attribution, entity classification and evidence for this address are available now on a BlockScout real-time API key. Contact DarkScout Intel at info@darkscoutintel.com or visit https://darkscoutintel.com/contact.html.",
      "contact": {
        "name": "DarkScout Intel",
        "email": "info@darkscoutintel.com",
        "url": "https://darkscoutintel.com/contact.html",
        "product_url": "https://darkscoutintel.com"
      }
    }
  },
  "meta": { "queryTime": 312, "timestamp": "2026-09-23T18:00:00.000Z", "data_tier": "delayed", "embargoed": true }
}

Addresses with intelligence older than the window return the normal response; addresses we hold nothing on return the same "unknown" response on both tiers.

Performance

• Response Time: Typically 3-8 seconds (median: 8s)
• Throughput: 3.7+ requests per minute
• Caching: Responses cached for 15 minutes
• Timeout Protection: All operations fail-fast with aggressive timeouts

Authentication

All requests require an API key in the x-api-key header. Obtain your API key from the dashboard at https://data-api.blockscout.ai/dashboard.

Example Request

curl -X GET "https://data-api.blockscout.ai/api/v1/surikata-x?address=1PBXdHa8kgrsxjZFdiGUf5hcxr4xY8D3y1" \
  -H "x-api-key: YOUR_API_KEY_HERE"

Example Response (Entity Attributed - DIRECT)

{
  "success": true,
  "data": {
    "address": "1BXwhiB1YoXCW6s5QcwX3ff3NUUMsSaWFo",
    "chain": "BITCOIN",
    "match_type": "DIRECT",
    "entity_id": "example_entity_id",
    "entity_type": "exchange",
    "proper_name": "Example Exchange",
    "first_seen": "2025-10-15T08:23:41.000Z",
    "urls": ["https://example.com"],
    "entity_id_evidence": [
      "https://darkscoutintel.com/evidence.html?entity=example_entity_id&hash=abc12345"
    ]
  },
  "meta": {
    "queryTime": 3847,
    "timestamp": "2025-12-02T21:02:25.730Z"
  }
}

Example Response (Tags Only)

{
  "success": true,
  "data": {
    "address": "1PBXdHa8kgrsxjZFdiGUf5hcxr4xY8D3y1",
    "chain": "BITCOIN",
    "match_type": null,
    "entity_id": null,
    "entity_type": null,
    "proper_name": null,
    "first_seen": null,
    "tags": [
      {
        "tag": "csam consumer",
        "txid": "0fdcc3da34cdae427388076f8451927cd72b1d2b6e608a7e289b593eca755cdd",
        "cp_addr": "bc1qy5d4dvmp87tyhjl97chu5x0a2cwxxtgxmvrzl3",
        "related_entity_id": "counterparty_entity_id",
        "proper_name": "Counterparty Entity",
        "url": "https://counterparty.com",
        "tag_evidence": "https://darkscoutintel.com/evidence.html?entity=counterparty_entity_id&hash=def67890"
      }
    ]
  },
  "meta": {
    "queryTime": 2789,
    "timestamp": "2025-12-02T23:31:50.479Z"
  }
}

Supported Address Formats

• Bitcoin: P2PKH (1...), P2SH (3...), Bech32 (bc1...)
• Ethereum: Standard 0x... addresses (42 characters)

Rate Limiting

Rate limits are enforced based on your subscription tier. Every response includes rate limit headers:

• X-RateLimit-Limit: Maximum requests allowed
• X-RateLimit-Remaining: Requests remaining
• X-RateLimit-Reset: When the rate limit resets

Error Responses

• 400 Bad Request: Missing or invalid address parameter
• 401 Unauthorized: Missing or invalid API key
• 500 Internal Server Error: Server error during processing

Retrieve attribution records for this category. See tag description for detailed overview, technical capabilities, and use cases.

Retrieve complete Bitcoin transaction history for addresses associated with narcotics distribution networks. Returns enriched transaction data with entity attribution and geographic intelligence.

Transactions are returned using address-by-address pagination for optimal performance. The service processes one address at a time, returning up to 50 transactions per request.

See the attributions endpoint description for detailed use cases and technical capabilities.

Retrieve attribution records for this category. See tag description for detailed overview, technical capabilities, and use cases.

Law Enforcement Use Only: Retrieve complete Bitcoin transaction history for addresses associated with CSAM distribution and consumption networks. Returns enriched transaction data with entity attribution and evidentiary documentation.

Transactions are returned using address-by-address pagination for optimal performance. The service processes one address at a time, returning up to 50 transactions per request.

See the attributions endpoint description for detailed use cases and technical capabilities.

Retrieve attribution records for this category. See tag description for detailed overview, technical capabilities, and use cases.

Retrieve complete Bitcoin transaction history for addresses associated with illicit arms trafficking and weapons commerce networks. Returns enriched transaction data with entity attribution and geographic intelligence.

Transactions are returned using address-by-address pagination for optimal performance. The service processes one address at a time, returning up to 50 transactions per request.

See the attributions endpoint description for detailed use cases and technical capabilities.

Retrieve attribution records for this category. See tag description for detailed overview, technical capabilities, and use cases.

Retrieve complete Bitcoin transaction history for addresses associated with human trafficking and exploitation networks. Returns enriched transaction data with entity attribution and trafficking corridor intelligence.

Transactions are returned using address-by-address pagination for optimal performance. The service processes one address at a time, returning up to 50 transactions per request.

See the attributions endpoint description for detailed use cases and technical capabilities.

Retrieve attribution records for this category. See tag description for detailed overview, technical capabilities, and use cases.

Retrieve complete Bitcoin transaction history for addresses associated with darknet marketplace operations and related services. Returns enriched transaction data with entity attribution and marketplace association intelligence.

Transactions are returned using address-by-address pagination for optimal performance. The service processes one address at a time, returning up to 50 transactions per request.

See the attributions endpoint description for detailed use cases and technical capabilities.

Retrieve attribution records for this category. See tag description for detailed overview, technical capabilities, and use cases.

Retrieve complete Bitcoin transaction history for addresses associated with cybercrime operations and threat actor networks. Returns enriched transaction data with entity attribution and threat actor categorization.

Transactions are returned using address-by-address pagination for optimal performance. The service processes one address at a time, returning up to 50 transactions per request.

See the attributions endpoint description for detailed use cases and technical capabilities.