search

MetaMask / eth-phishing-detect

Utility for detecting phishing domains targeting Web3 users
Other
1.1k stars 955 forks source link

The detector should check if the TLD is valid before blocking the site #6453

Closed trn1ty closed 1 year ago

trn1ty commented 2 years ago

There's no anticipating the use of non-ICANN top level domains and there's no practical use for blocking domains that aren't actually on the Internet. The detector should check to make sure the top level domain of the site being accessed is real, and if not, return { type: 'extranet', result: false }.

This would fix #6452, the filer of which is using metamask.localhost for testing.

This would also fix issues with Unstoppable Domains such as #6309.

There are issues with this approach; the TLD resource could lag behind the ICANN list or phishing could occur in unforeseen non-Internet environments with users that expected the detector to work well there too.

Gr8Reset commented 2 years ago

Thanks. (Metamate.crypto)

trn1ty commented 1 year ago

@AlexHerman1 why close this? I don't think this feature has been implemented.