Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Block 33 scam URLs #11402

Merged
merged 2 commits into from Feb 3, 2023
Merged

Block 33 scam URLs #11402

merged 2 commits into from Feb 3, 2023

Conversation

dubstard
Copy link
Contributor

@dubstard dubstard commented Feb 3, 2023

    "airdropanswap.com",
    "confirminfo-coinbase.com",
    "free-adidas.com",
    "me-updatezyproment.com",
    "pancakeswap.co",
    "sushlswap.in.net",
    "sushlswap.online",
    "sushlswap.pro",
    "sushlswap.world",
    "trustwallet.com.web9879.web07.bero-webspace.de",
    "uniswap-exchange.in",
    "uniswap-exchange.uk",
    "uniswap-v3-positions.mintingconnect.io",
    "uniswap.clemensotto.xyz",
    "uniswap.validvent.xyz",
    "uniswapx.us",
    "uniswapx.us.com",
    "uniswapx.us.org",
    "wallet-metemask.com",
    "wallet.exodus.com.bahrainileaks.com",
    "wallet.exodus.com.blessmarked.net",
    "wallet.exodus.com.digitaldesignvalley.com",
    "wallet.exodus.com.gloveintegratedshipping.com",
    "wallet.exodus.com.greatlinecourier.com",
    "wallet.exodus.com.iptv22.shop",
    "wallet.exodus.com.kodersoft.com",
    "wallet.exodus.com.logostreak.com",
    "wallet.exodus.com.myproperty.co.ke",
    "wallet.exodus.com.skilldomeconsultancy.com",
    "wallet.exodus.com.theipohub.com",
    "wallet.exodus.com.winchancee.store",
    "wallet.exodus.com.winchancevb.store",
    "withdrawal-coinbase.me-updatezyproment.com",

```
    "airdropanswap.com",
    "confirminfo-coinbase.com",
    "free-adidas.com",
    "me-updatezyproment.com",
    "pancakeswap.co",
    "sushlswap.in.net",
    "sushlswap.online",
    "sushlswap.pro",
    "sushlswap.world",
    "trustwallet.com.web9879.web07.bero-webspace.de",
    "uniswap-exchange.in",
    "uniswap-exchange.uk",
    "uniswap-v3-positions.mintingconnect.io",
    "uniswap.clemensotto.xyz",
    "uniswap.validvent.xyz",
    "uniswapx.us",
    "uniswapx.us.com",
    "uniswapx.us.org",
    "wallet-metemask.com",
    "wallet.exodus.com.bahrainileaks.com",
    "wallet.exodus.com.blessmarked.net",
    "wallet.exodus.com.digitaldesignvalley.com",
    "wallet.exodus.com.gloveintegratedshipping.com",
    "wallet.exodus.com.greatlinecourier.com",
    "wallet.exodus.com.iptv22.shop",
    "wallet.exodus.com.kodersoft.com",
    "wallet.exodus.com.logostreak.com",
    "wallet.exodus.com.myproperty.co.ke",
    "wallet.exodus.com.skilldomeconsultancy.com",
    "wallet.exodus.com.theipohub.com",
    "wallet.exodus.com.winchancee.store",
    "wallet.exodus.com.winchancevb.store",
    "withdrawal-coinbase.me-updatezyproment.com",
```
Copy link
Collaborator

@AlexHerman1 AlexHerman1 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM.

@AlexHerman1 AlexHerman1 merged commit 41d29af into MetaMask:main Feb 3, 2023
@cleot
Copy link

cleot commented Sep 5, 2023

Please remove

"uniswap.clemensotto.xyz",
"uniswap.validvent.xyz",

both were domains which were linked to the Cloudflare Page hosted under "uniswap.pages.dev".

This has never been malicious or a phishing attempt. Why would I host something like that connected to my own legal name or that of my company?

I just used it to test the deployment of the Uniswap UI with Cloudflare Pages.
Source: https://github.com/cleot/uniswap-interface-cloudflare-pages

I never realized that could be a problem since it is open source.
However, to avoid more false abuse complaints I deleted everything.

On Sunday, I received a abuse complaint through Cloudflare.

"
The phishing site is fraudulently impersonating Universal Navigation Inc. (DBA “Uniswap Labs”) and its website. It is a phishing attack designed to deceive users into providing sensitive information and/or making unauthorized payments.

We kindly request the immediate removal of this phishing site and ensure the user refrains from engaging in a phishing scheme in the future.

Authority to Act: We, Doppel, confirm that the information provided in this notice is accurate and, under penalty of perjury, assert that we are authorized to act on behalf of Universal Navigation Inc. (DBA “Uniswap Labs”) as their authorized representative.

We have forwarded this complaint to your hosting provider. We have restricted access to the phishing-related content until it has been removed.

"

Following this message, Cloudflare nuked my whole Account affecting 20+ domains (personal and several small businesses I support).

I got in contact with the CEO of Doppel and he supported me by contacting Cloudflare to unsuspend my account.

Today, I finally got unsuspended by Cloudflare.

However, all domains need to be readded manually and all DNS records are lost at this time.
Cloudflare Pages are also still not available again.

Thanks,
Clemens

409H added a commit that referenced this pull request Sep 5, 2023
* Update config.json

```

* dupe `mee6-app.com`

dupe `mee6-app.com`

* remove FPs

    "uniswap.clemensotto.xyz",
    "uniswap.validvent.xyz",

see here
#11402 (comment)

* Remove duplicates

---------

Co-authored-by: HARRY DENLEY <HARRY.DENLEY@OUTLOOK.COM>
sime pushed a commit to sime/eth-phishing-detect that referenced this pull request Jan 6, 2024
* Update config.json

```

* dupe `mee6-app.com`

dupe `mee6-app.com`

* remove FPs

    "uniswap.clemensotto.xyz",
    "uniswap.validvent.xyz",

see here
MetaMask#11402 (comment)

* Remove duplicates

---------

Co-authored-by: HARRY DENLEY <HARRY.DENLEY@OUTLOOK.COM>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

4 participants