Sanctions Risk Check — OSINT Vendor & Domain Screening
When you onboard a vendor, sign a reseller agreement, or accept a counterparty in a high-risk geography, the surface of regulatory risk is larger than a sanctions list lookup. Our Sanctions Risk Check blends targeted OSINT, technical infrastructure discovery and entity-link analysis to give you a fast, defensible risk decision — with clear evidence you can rely on for procurement, legal, or compliance records.
Why a sanctions risk check is essential (and different from a name match)
Simple name- or list-based screening misses the two things that cause most surprises:
Hidden affiliations and ownership structures
Sanctioned individuals or entities can operate via affiliates, trading names, or shell companies that don’t match lexical filters.
Infrastructure & operational exposure
Mail servers, hosting providers, subdomains and third-party integrations can reveal cross-border control, sanction-risk hosting jurisdictions, or previously unknown technical ties.We combine people-mapping, domain reconnaissance and technical telemetry with standard lists (OFAC, UN, EU, UK, and national lists depending on scope) to deliver an evidence-first assessment — not just a “no match” checkbox.
Who needs this service
Procurement teams evaluating third-party suppliers or manufacturers.
Compliance officers performing pre-contract KYC/AML and sanctions checks.
Legal teams preparing vendor clauses and audit evidence.
M&A and investment teams screening targets or counterparties.
Financial institutions and fintechs conducting enhanced due diligence.
If your organization must demonstrate defensible sanctions screening for an audit, or you need to stop a risky supplier before a contract signature, this service fits.
What we check
Each standard Sanctions Risk Check (one target) includes:
Domain & Infrastructure discovery
- Primary domain enumeration (main domain + common TLD variants).
- Subdomain enumeration and identification of active services (www, api, mail, admin panels).
- Mail server discovery (MX records), SPF/DKIM/DMARC inspection and hosting footprint (IP, ASN, region).
- TLS/certificate transparency and historical WHOIS analysis.
People & entity linkage
Search for key people (directors, founders, major shareholders, beneficial owners, C-suite) and known aliases.
Cross-linking of personnel to corporate entities, email domains, social profiles and related businesses.
Identification of potential PEPs (politically exposed persons) and known-risk individuals.
Sanctions & adverse data correlation
Sanctions & adverse data correlation
Adverse media and public records search (regulatory actions, litigation flags, credible news).
Leaked credentials / paste site scans for the target domain and related emails.
Technical and operational risk indicators
- Hosting country risk mapping and third-party service exposure (CDNs, payment processors, analytics scripts).
- Detection of anonymized hosting, bulletproof providers, or infrastructure known for sanction circumvention.
- Indicators of shell-company usage (frequent domain churn, privacy-protected WHOIS, inconsistent filings).
Deliverables & evidence
- Executive Risk Summary (one page): clear risk rating (Low / Medium / High) and a recommended decision (proceed / proceed-with-mitigation / hold).
- Detailed Analyst Report (10–25 pages): findings, timelines, screenshots, packet evidence where applicable, DNS & TLS history, and provenance metadata (URL + timestamp + capture).
- People & Entity Graph (visual): showing links between persons, domains and corporate entities.
- IOC & Technical Appendix: list of subdomains, MX records, IPs, ASNs and supporting raw data (CSV).
- Remediation & Contract Controls Template: suggested AML/sanctions clauses and monitoring recommendations.
Typical timeline & response SLAs
Delivery time: standard delivery within 5 business days from receipt of required scoping information.
Rush option: 48–72 hour turnaround available for an additional fee (contact sales).
Follow-up: 10 business days of analyst support included for clarifications and rapid updates from your remediation actions.
How we work — defensible, audited OSINT process
Scoping & authorization: you provide the target identifiers (company name, domains, key person names); we agree on jurisdictions and lists to use.
Collection & discovery: automated enumeration (domain/subdomain, TLS, MX) combined with manual OSINT focused on ownership and people links.
Validation: cross-source validation, duplicate elimination and confidence scoring. We capture screenshots and archive sources for auditability.
Analysis & reporting: analyst synthesizes links, assigns risk rating and compiles a remediation checklist.
Handover & support: report delivered in encrypted form; we brief your team and help craft contract clause language if required.
We record provenance for every claim (URL, timestamp, archived snapshot), so your legal or audit teams can rely on the findings.
Limitations & legal safeguards
This is an OSINT-based assessment: we do not perform intrusive testing, unauthorized access or deceptive collection.
We check public sources and client-authorized channels only. For deep financial or jurisdictional verification (e.g., registry retrievals requiring paid local searches), we will propose add-ons.
A “Low risk” result reduces—but does not remove—all risk. Sanctions lists and exposures can change; consider periodic re-checks for high-value suppliers.
Pricing — Sanctions Risk Check (flat fee)
Price: €2,000 (one-off, per target) — includes the full deliverable set listed above and up to 10 business days analyst support after delivery.
What’s included in the €2,000 price:
Complete domain & infrastructure enumeration (subdomains, MX, IP/ASN, hosting).
People & entity linkage and adverse media search.
Sanctions list correlation (OFAC, EU, UN, UK and agreed national lists).
Full Analyst Report, Executive Summary, People Graph and Technical Appendix.
Evidence provenance (archival screenshots / hashes).
10 business days post-delivery analyst support and clarification.
Optional add-ons (priced separately):
Multi-target batch discount (ask for rates when ordering 5+ checks).
Deep-dive local registry retrievals and legal opinion (per jurisdiction).
Continuous monitoring subscription (alerts on new exposures / € per month).
Rush 48–72 hour delivery (surcharge).
How to purchase: Request a scoping call → Receive invoice → Provide target details → Report delivered to secure channel.
Use cases & examples (anonymized)
Pre-contract vetting: procurement avoided a supplier with undisclosed affiliate ties to a sanctioned individual — contract paused.
PE/M&A screening: a target with complex shell ownership required additional escrow and warranty clauses after our report.
Fintech onboarding: a payment partner’s mail servers routed through a high-risk ASN; client required reconfiguration before going live.
Each outcome saved the customer time and potential regulatory exposure.
Integration & operational options
One-off report (standard €2,000) for procurement decisions.
Batch screening for vendor lists — request pricing for 10+ targets.
Continuous monitoring: subscribe to real-time alerts and weekly briefs for critical suppliers.
GRC / SIEM integration: output feeds (CSV / webhook) for vendor risk platforms or SIEM ingestion (STIX/TAXII on request).
Frequently asked questions (FAQ)
Q: What does a sanctions risk check include?
A: We combine domain/subdomain discovery, mail-server inspection, people & entity mapping, sanctions-list correlation and adverse media searches, then deliver an analyst report with provenance and recommended actions.
Q: How quickly will I get results?
A: Standard delivery is 5 business days after scoping. Rush 48–72 hour turnaround is available via add-on.
Q: Do you run official OFAC/EU queries?
A: Yes — our checks include matches against OFAC, EU, UN and UK lists where applicable. We also correlate related entities and aliases that list-only checks can miss.
Q: Is the work legal and ethical?
A: Absolutely — all collection is OSINT-only. We do not engage in hacking, credential stuffing, or deceptive collection methods. We document legal constraints in the scoping phase.
Q: Can you monitor suppliers continuously?
A: Yes — we offer continuous monitoring subscriptions with configurable alerting thresholds and dashboard access.
Contact Us Now and We Will Help
Tell us about your OSINT needs — vendor checks, threat monitoring, or investigations. Submit project details and contact info; our analyst team will respond with a tailored proposal and next steps.
