Sanctions are an interesting thing because I think a lot of people doing business on the web don't know to what extent they are responsible to follow them.

When I worked in internet infrastructure, we actively monitored and blocked sanctioned countries from using the service. I don't think a lot of companies do, e.g. AFAIK Amazon for AWS is supposed to. (I may be wrong and I'd love if someone with more knowledge would share.)