The OFAC SDN list currently prints 369 email addresses across 210 entries. We counted them in the official SDN file as downloaded on 23 September 2026. Of those addresses, 114 sit on entries under OFAC's cyber-related programs. We then ran 23 of the cyber addresses, drawn from ten designations, through an email lookup. Fifteen returned at least one platform registration. Three led to a developer or avatar profile whose display name lines up with the sanctions entry.
This guide covers where OFAC prints an email address, how to search the SDN list for one, and what those addresses connect to today. Every person named below has been designated by Treasury, and most have also been charged in the United States. A designation is an administrative action and an indictment is an allegation. Nobody here has been convicted of the conduct described, and each defendant is presumed innocent.
Where the SDN list prints email addresses
An SDN entry is a single run of semicolon-separated identifiers: name, aliases, date of birth, nationality, then any email addresses, crypto wallets and document numbers OFAC chooses to publish. The first address is labeled Email Address and every further one alt. Email Address. The May 2024 LockBit designation is a clean example: KHOROSHEV, Dmitry Yuryevich, a.k.a. "LOCKBITSUPP", followed by Email Address [email protected] and alt. Email Address [email protected].
Entities get the same field. The May 2022 Blender.io entry lists two tuta.io addresses, and the July 2026 First VPN Service action prints [email protected] on the service's own entry. Company mailboxes also turn up on individuals' entries. The July 2025 Aeza Group action prints [email protected] on the entry for Arsenii Penzev, whom OFAC links to Aeza Group.
Emails are still the exception on cyber entries. In the list as downloaded on 23 September 2026, 365 entries carry a cyber program tag, and 39 of them list an email address. The rest publish names, aliases and wallets only. Gmail accounts for 52 of the 114 cyber addresses, yahoo.com has 20, and mail.ru and yandex.ru have 6 each. One cyber entry lists 11 addresses.
How to search the OFAC SDN list by email address
OFAC's free Sanctions List Search works, but not through the Name box. We tested it on 23 September 2026. Pasting [email protected] into Name returned nothing. The same address in the field labeled ID # / Digital Currency Address returned the Penzev entry. That field matched regardless of case and also matched fragments. aezagroup alone found the entry, and gmail.com returned 47 records.
For bulk work, download the file and search it locally. Addresses sit in the last (remarks) column of the legacy CSV:
curl -sO https://www.treasury.gov/ofac/downloads/sdn.csv
# every email field on the list (369 on 23 Sep 2026)
grep -o 'Email Address [^;"]*' sdn.csv | wc -l
# screen one address, case-insensitive
grep -i '[email protected]' sdn.csv | awk -F'"' '{print $1 $2}'The date an address appeared matters as much as the address itself, and the file does not record it. OFAC's recent-actions pages do. Changes appear as an old entry, the word "-to-", then the new one. Behzad Mesri, the Iranian national Treasury designated in March 2018 over the extortion of a US media company (reported as HBO), had no email on his entry for eight years. The 24 August 2026 update added seven Gmail addresses in one change. For a maintained, machine-readable mirror with change history, OpenSanctions does excellent work and is free for non-commercial use.
Why sanctions entries matter more than indictments
Recent US charging papers mostly hide mailboxes. The Khoroshev indictment prints no email address at all. The IntelBroker complaint refers to "West Email Account-1". Treasury publishes identifiers so banks and platforms can screen against them, so the SDN entry is often the only government document that prints a charged person's address verbatim. Investigators can then check each address against the open web without relying on leaked data. Mailbox reuse is also one of the most common ways hackers get caught.
What 23 sanctioned addresses connect to today
In September 2026 we ran every address printed on ten cyber-related entries through an email lookup that checks about 175 platforms for a registered account. The counts below are registrations found, so treat each one as a floor. A registration shows that a mailbox was used to open an account on a service. It does not show who uses that account today, and a zero does not prove an address was never used.
| Entry | Designated | Addresses printed | Addresses with registrations found | Registrations found |
|---|---|---|---|---|
| Khoroshev (LockBit) | 7 May 2024 | 2 | 1 | 2 |
| Kondratiev, "Bassterlord" (LockBit affiliate) | 20 Feb 2024 | 1 | 1 | 13 |
| Sungatov (LockBit affiliate) | 20 Feb 2024 | 4 | 1 | 7 |
| Zhuykov, "Defender" (Trickbot) | 7 Sep 2023 | 2 | 2 | 20 |
| Tsarev, "Mango" (Trickbot) | 7 Sep 2023 | 1 | 1 | 6 |
| Rudenskiy (Trickbot) | 7 Sep 2023 | 2 | 1 | 3 |
| Lifshits (Internet Research Agency) | 10 Sep 2020 | 2 | 1 | 4 |
| Mesri, "Skote Vahshat" | emails added 24 Aug 2026 | 7 | 5 | 18 |
| Penzev (linked to Aeza Group) | 1 Jul 2025 | 1 | 1 | 5 |
| First VPN Service | 13 Jul 2026 | 1 | 1 | 1 |
| Total | 23 | 15 | 79 |
We left out one TrickBot entry. The four addresses on Maksim Galochkin's entry have their own write-up.
The charging status differs by name. Indictments against Zhuykov, Tsarev and Rudenskiy in Ohio and Tennessee were unsealed the day they were designated. Indictments against Kondratiev and Sungatov were unsealed in February 2024, and against Khoroshev in May 2024. Lifshits was charged in Virginia in 2020, the same week Treasury sanctioned him as an Internet Research Agency employee who supported its cryptocurrency accounts. Mesri was indicted in New York in 2017. First VPN Service is a designated business, and Penzev was designated as an individual linked to Aeza Group. For First VPN Service, CyberScoop reported that European authorities arrested its unnamed administrator in a May 2026 sting.
Three patterns in the results
Everyday Gmail accounts carry names
The three most useful results all came from personal-looking Gmail addresses. Zhuykov's first listed address returned 14 registrations. It also resolves to a GitHub account whose display name is the first name on his entry. Rudenskiy's Gmail resolves to a GitHub account displaying his first name and surname, in the common "Rudensky" spelling. Kondratiev's single listed address returned 13 registrations, and its Gravatar profile shows a display name that echoes the "SINNER" aliases OFAC lists for him. None of this is proof of ownership. Display names are typed by whoever opens the account. As corroboration next to a government document, though, they are strong, and our attribution guide explains how to grade them.
Entries mix busy mailboxes with addresses that return nothing
Most multi-address entries split sharply. Sungatov's entry lists four addresses, and only the Yandex one returned registrations, seven of them. On Khoroshev's entry, the iCloud address returned no registrations, while the Yandex address returned two. Our LockBitSupp write-up covers the rest of that record. Mesri's seven Gmail addresses range from eight registrations found, including Figma, Dropbox and a freelancing marketplace, down to none found for the two leetspeak addresses. Sanctions entries do not say who used each mailbox. Mesri's list includes addresses built on personal names, and the entry does not explain its relationship to him. Eight of the 23 addresses returned no registrations. That is consistent with single-purpose accounts, but the entries never say what any address was used for, and a zero is only what our check found. Our piece on whether a burner email can be traced covers what to do with an address that returns nothing.
Company mailboxes look like offices
The Aeza address returned registrations with Microsoft, Yandex, Figma and Asana. That is the shape of a working back-office mailbox. It is named for the company, though OFAC lists it on Penzev's individual entry. First VPN Service's support address returned a single registration, on a document-publishing site. For compliance teams, that contrast is useful. A company mailbox published on a sanctions entry can appear on everyday SaaS tools, so vendor and customer screening should include email fields, not only names.
FAQ
Does the OFAC SDN list include email addresses?
Yes, for some entries. The list as downloaded on 23 September 2026 prints 369 addresses across 210 of its entries. They appear as Email Address and alt. Email Address in the entry text, next to aliases and wallet addresses.
How do I check whether an email address is on the SDN list?
Paste it into the ID # / Digital Currency Address field of OFAC's Sanctions List Search, not the Name field. For bulk checks, download sdn.csv and search the remarks column. OpenSanctions offers the same data as a searchable dataset.
Why do most cyber designations have no email address?
OFAC publishes what supports screening and what it chooses to release. Only 39 of 365 cyber-tagged entries carry one. The 2023 designation of Mikhail Matveev and the 2021 designation of Yaroslav Vasinskyi, for example, print none. Addresses can also be added years later, as Mesri's entry shows.
Does a registered account prove the sanctioned person uses it?
No. It shows the address was used to open an account on that service. Ownership needs corroboration, such as a matching display name, dates that fit the case, or a public-record link. Accounts can also be taken over or abandoned.
Run the check yourself
Sanctions entries are some of the few government documents that still print a charged person's mailbox. Pair the entry with a live lookup and you can see which addresses were everyday accounts and which return little or nothing. Run a free email search on OSINTsearch; paid plans add CSV, JSON or PDF export. Or start with our guide on how to see behind an email address.
