eth-phishing-detect

What the list is for

This repository holds a list of malicious domains that target Web3 users. The stated purpose is to block websites that try to trick people who use cryptocurrency wallets, and the README points to a third party search tool run by ChainPatrol for checking why a given domain was blocked. The list is not a piece of running software on its own so much as a curated data set plus a small set of library functions for editing it. MetaMask consumes the list inside its wallet to warn users before they interact with a known bad site. The project is explicit that the policy behind the list keeps changing as new threats appear, but a few rules are fixed. The maintainers say they will move quickly to block sites that impersonate established services and sites that collect user signing keys, especially cryptocurrency keys, and send them back to a home server. Those two behaviors are the clearest lines in the blocking policy. The README also notes that other grounds for blocking exist and the team does its best to keep users safe even when a case does not fit the named rules. For a data set of this kind, the human review process matters as much as the format.

How blocking decisions are made

The blocking policy described in the README centers on two concrete harms. The first is impersonation: a site that copies the look and behavior of a known and established service in order to fool visitors. The second is key harvesting, where the interface collects user signing keys, particularly cryptocurrency private material, and transmits it to a remote server. Both are treated as quick block cases. The documentation is honest that the ideal policy is still evolving, so the listed rules are the stable core rather than the whole story. There is also a safeguard against false positives. The repo keeps a set of domain lists pulled from various sources under test/resources, with one host per line in plaintext files. These reference lists exist to reduce the risk of accidentally blocking a legitimate domain. If you must block something that appears on one of those safe lists, the README tells you to add a bypass inside test/test-lists.ts. That layering of a blocklist against a set of allow references is what keeps the main list from overreaching and hurting normal users who visit common sites. The source lives in the metamask-eth-phishing-detect repository on GitHub and is implemented in TypeScript, with the license recorded as NOASSERTION in the project metadata.

Maintaining the list

The project gives contributors two ways to change the list: a command line interface and library functions. The README shows yarn commands such as add:blocklist and add:allowlist, plus JavaScript helpers like addDomains and removeDomains that take a config object and a list of hosts. The same pattern works for taking entries out, with remove:blocklist and remove:allowlist mirroring the add commands. Keeping the file tidy is the stated reason for using the CLI or library rather than hand editing JSON, since the tooling preserves the structure the detector expects. Auditing is supported through git history: the README shows a git log command with the -S flag scoped to a domain and the src/config.json path, which pulls every pull request that touched that host. That makes it possible to review why a block or removal happened and who proposed it. Updating the reference safe lists uses yarn update:lists, and that step needs a CoinMarketCap Pro API key because it fetches external data. The README ends by noting the phishing detector has moved to the MetaMask core repository, so new work now happens there. The source lives in the metamask-eth-phishing-detect repository on GitHub and is implemented in TypeScript, with the license recorded as NOASSERTION in the project metadata.

Editorial conclusion

The list is maintained in TypeScript and the repository notes the detector code now lives in the MetaMask core package under the phishing-controller path.