US Treasury OFAC, Recent Actions

https://ofac.treasury.gov/recent-actions

Office of Foreign Assets Control sanctions designations, primary source for sanctioning ransomware-cashout networks, bulletproof-host operators, and state-actor-affiliated infrastructure (added 2026-05-08). 2026-05-08 audit: WebFetch returned 5 dated designations May 1-7 2026. | 2026-06-20 full audit (v2.62): live=Y, drill=Y. FETCH → bridge: python3 tools/fetch_source.py url https://ofac.treasury.gov/recent-actions (listing of /recent-actions/YYYYMMDD entries) then bridge url https://ofac.treasury.gov/recent-actions/YYYYMMDD for the designation body. AVOID: Do NOT WebFetch, ofac.treasury.gov 503s the routine UA on both listing and detail. Use the bridge (browser UA) for both; it returns full HTML.. | 2026-07-05 admiralty audit: A, first-party government sanctions authority publishing its own designations, the primary/definitive source for its own actions. Fetch only via bridge (WebFetch 503s). No status change. | 2026-07-14 intel run: bridge fetch of sb0559 + recent-actions/20260713, contributed the 1VPNS/cryptor-seller sanctions update entry. | 2026-09-29: recipe confirmed healthy (`url --direct`/`extract` on /recent-actions, 10 dated actions per page, newest same-day; ?page=N paginates). The health check's 'irrelevant' flag is a vocabulary false positive on a whole-of-sanctions listing (content_scope general-news). For cyber-only discovery use the site filter https://ofac.treasury.gov/recent-actions?search_api_fulltext=cyber&ra_year=<YYYY> (2026 so far: Feb 24, Mar 13, Apr 23, Jul 13, Aug 24), then drill /recent-actions/YYYYMMDD with extract. (2026-09-29T2134Z-audit)