Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Block 161 scams #13701

Merged
merged 3 commits into from Oct 2, 2023
Merged

Block 161 scams #13701

merged 3 commits into from Oct 2, 2023

Conversation

dubstard
Copy link
Contributor

@dubstard dubstard commented Oct 1, 2023

Fake airdrops, fake mint sites, phishing and wallet drainers

    "1inch-claim.org",
    "1inch-rewards.com",
    "2f-coinbase.com",
    "2fa-colnbase.support",
    "accessdapps.firebaseapp.com",
    "airdrop-claim.fun",
    "airdrops-blur.io",
    "airdrops-claim.com",
    "amlbot.social",
    "amlcheckbot.online",
    "amlchecknow.online",
    "apesxmaxs.online",
    "app-balance.finance",
    "appsweb-servers.online",
    "autodebugmodulerpcfix.dev",
    "balacer-v2.com",
    "balacer-v3.org",
    "balancer.one",
    "balencer.org",
    "binance-claim.email",
    "binancetowallet.com",
    "binancetowallet.vip",
    "bitkvb.web.app",
    "blockchein-wallet.com",
    "blu-art.fun",
    "blur.v3.nom.co",
    "bnb-decentralized.com",
    "brinksglobalplantinumservices.com",
    "bscdrop.com",
    "btcbonus.net",
    "capitalcraft.exchange",
    "cashzofferz.com",
    "chaindex.pages.dev",
    "chaingpt-stake.net",
    "chainlink-drops.com",
    "claim-requests-web3.network",
    "claimcake.com",
    "claimings-web3-bridge.link",
    "claimrbh.com",
    "coinlinksys.com",
    "corporategoldlimited.com",
    "crypto-wallet-btc.com",
    "cryptoairdrop.click",
    "daomaker.connect-defi.com",
    "dapp-connects.web.app",
    "dappsecuredrectify.com",
    "dappsolution.app",
    "dappswalletlink.xyz",
    "decentralisedcryptowithdrwl.com",
    "defilama.expert",
    "dfxbridge.com",
    "empirewealthllc.com",
    "firstgfonline.com",
    "fxoption-int.com",
    "gadgetshomey.xyz.cashzofferz.com",
    "geminibtc.org",
    "givebitcoin.net",
    "givebtc.net",
    "go-login-paycor.com",
    "goldminedigitalworld.com",
    "goldsbit.com",
    "heloooaoaoaoooaoa.xyz",
    "host-4-block-chaln0dfg.web.app",
    "hungrykidsfoundation.org",
    "hvmtl-forged.com",
    "kalgatetechnology.com.ng",
    "layerai.live",
    "layerswap-exchange.eu",
    "layerswap-exchange.online",
    "layerswap-exchange.pw",
    "layerswap-exchange.website",
    "maindashboard.online",
    "metamask-update.info",
    "metamask.sly.io.globaleducator.co.in",
    "metamask10.pro",
    "metamaskpresale.info",
    "metamaskrecovry.com",
    "metamasks.cyou",
    "moonbeam-netvvork.com",
    "nftkey.art",
    "nicerfoundation.org.ng",
    "othersideairdrop.com",
    "pancakeswap-finance.store",
    "pancakeswap.mov",
    "ppktrs.su",
    "projectauthverify.xyz",
    "pudgy-huddle.com",
    "rarible-claims.com",
    "receive-shib.com",
    "reward-cyber.web.app",
    "reward4vote.com",
    "ripple-airdrop.online",
    "rockatpool.online",
    "securesmarter.store",
    "shibasocialclub.org",
    "spacecoins.biz",
    "spookyfi.website",
    "stogoldenex.com",
    "sync-dapps.pages.dev",
    "syncdefixons.line.pm",
    "task-on.xyz",
    "taskon-airdrop.space",
    "taskon-airdrop.website",
    "taskon-coin.online",
    "taskon-coin.website",
    "taskon-gifts.fun",
    "taskon-gifts.website",
    "taskon.pw",
    "terawit.net",
    "thegemroyale.com",
    "thepositivia.com",
    "ton-reward.com",
    "truecoinbase.com",
    "trumpnft.site",
    "unionunlimited.com",
    "uniquefxtradez.com",
    "unisvvaps-app.top",
    "unisvvaps.top",
    "uniswap-wallet-secure01b.com",
    "unlswapp.org",
    "v2-balancer.org",
    "venom-drop.space",
    "verify-coinbaseidentity.info",
    "verify-portfoliometamask.ddnss.eu",
    "vesselsconnect.com",
    "voucher-id493495.web.app",
    "web-connectrn.gq",
    "web3-connectxt.gq",
    "web3-trustwallet.xyz",
    "web3ss.gq",
    "webappjf.gq",
    "win-treasure.com",
    "xn--coinbase-o8a.com",
    "xrp-claim.web.app",

Fake web broswer updates (RacoonStealer ClearFake)

    "afriagrimagazine.com",
    "carolinacapitalre.com",
    "codemi.co.id",
    "digitopcs.com",
    "emsintoniacomasaude.com.br",
    "eximiousglobal.com",
    "falconaviation.ae",
    "gallasgroup.it",
    "hubexperts.ch",
    "inspiredconsumer.com",
    "isienvironmental.com",
    "jivacite.com",
    "kekgroup.net",
    "knoxvillebreastcenter.com",
    "myrmp.org",
    "ojhggnfbcy62.com",
    "planners.com.co",
    "secondunit.al",
    "servim.ch",
    "skaizengroup.eu",
    "skutersite.pl",
    "srhfoundation.ca",
    "summar.com",
    "themorsel.in",
    "tscollective.com",
    "turnthetiderx.org",
    "volquetesbosch.com.ar",
    "wazfnynow.com",

Contains data from #13693 + more

block
```
 "1inch-claim.org",
    "1inch-rewards.com",
    "2f-coinbase.com",
    "2fa-colnbase.support",
    "accessdapps.firebaseapp.com",
    "airdrop-claim.fun",
    "airdrops-blur.io",
    "airdrops-claim.com",
    "amlbot.social",
    "amlcheckbot.online",
    "amlchecknow.online",
    "apesxmaxs.online",
    "app-balance.finance",
    "appsweb-servers.online",
    "autodebugmodulerpcfix.dev",
    "balacer-v2.com",
    "balacer-v3.org",
    "balancer.one",
    "balencer.org",
    "binance-claim.email",
    "binancetowallet.com",
    "binancetowallet.vip",
    "bitkvb.web.app",
    "blockchein-wallet.com",
    "blu-art.fun",
    "blur.v3.nom.co",
    "bnb-decentralized.com",
    "brinksglobalplantinumservices.com",
    "bscdrop.com",
    "btcbonus.net",
    "capitalcraft.exchange",
    "cashzofferz.com",
    "chaindex.pages.dev",
    "chaingpt-stake.net",
    "chainlink-drops.com",
    "claim-requests-web3.network",
    "claimcake.com",
    "claimings-web3-bridge.link",
    "claimrbh.com",
    "coinlinksys.com",
    "corporategoldlimited.com",
    "crypto-wallet-btc.com",
    "cryptoairdrop.click",
    "daomaker.connect-defi.com",
    "dapp-connects.web.app",
    "dappsecuredrectify.com",
    "dappsolution.app",
    "dappswalletlink.xyz",
    "decentralisedcryptowithdrwl.com",
    "defilama.expert",
    "dfxbridge.com",
    "empirewealthllc.com",
    "firstgfonline.com",
    "fxoption-int.com",
    "gadgetshomey.xyz.cashzofferz.com",
    "geminibtc.org",
    "givebitcoin.net",
    "givebtc.net",
    "go-login-paycor.com",
    "goldminedigitalworld.com",
    "goldsbit.com",
    "heloooaoaoaoooaoa.xyz",
    "host-4-block-chaln0dfg.web.app",
    "hungrykidsfoundation.org",
    "hvmtl-forged.com",
    "kalgatetechnology.com.ng",
    "layerai.live",
    "layerswap-exchange.eu",
    "layerswap-exchange.online",
    "layerswap-exchange.pw",
    "layerswap-exchange.website",
    "maindashboard.online",
    "metamask-update.info",
    "metamask.sly.io.globaleducator.co.in",
    "metamask10.pro",
    "metamaskpresale.info",
    "metamaskrecovry.com",
    "metamasks.cyou",
    "moonbeam-netvvork.com",
    "nftkey.art",
    "nicerfoundation.org.ng",
    "othersideairdrop.com",
    "pancakeswap-finance.store",
    "pancakeswap.mov",
    "ppktrs.su",
    "projectauthverify.xyz",
    "pudgy-huddle.com",
    "rarible-claims.com",
    "receive-shib.com",
    "reward-cyber.web.app",
    "reward4vote.com",
    "ripple-airdrop.online",
    "rockatpool.online",
    "securesmarter.store",
    "shibasocialclub.org",
    "spacecoins.biz",
    "spookyfi.website",
    "stogoldenex.com",
    "sync-dapps.pages.dev",
    "syncdefixons.line.pm",
    "task-on.xyz",
    "taskon-airdrop.space",
    "taskon-airdrop.website",
    "taskon-coin.online",
    "taskon-coin.website",
    "taskon-gifts.fun",
    "taskon-gifts.website",
    "taskon.pw",
    "terawit.net",
    "thegemroyale.com",
    "thepositivia.com",
    "ton-reward.com",
    "truecoinbase.com",
    "trumpnft.site",
    "unionunlimited.com",
    "uniquefxtradez.com",
    "unisvvaps-app.top",
    "unisvvaps.top",
    "uniswap-wallet-secure01b.com",
    "unlswapp.org",
    "v2-balancer.org",
    "venom-drop.space",
    "verify-coinbaseidentity.info",
    "verify-portfoliometamask.ddnss.eu",
    "vesselsconnect.com",
    "voucher-id493495.web.app",
    "web-connectrn.gq",
    "web3-connectxt.gq",
    "web3-trustwallet.xyz",
    "web3ss.gq",
    "webappjf.gq",
    "win-treasure.com",
    "xn--coinbase-o8a.com",
    "xrp-claim.web.app",
```

Contains data from #13693 + more
…m' in 'blacklist'.

'gadgetshomey.xyz.cashzofferz.com' already covered by 'cashzofferz.com' in 'blacklist'.
@dubstard dubstard changed the title Block scams Block 133 scams Oct 1, 2023
racoonstealer fake browser updaters
```
    "afriagrimagazine.com",
    "carolinacapitalre.com",
    "codemi.co.id",
    "digitopcs.com",
    "emsintoniacomasaude.com.br",
    "eximiousglobal.com",
    "falconaviation.ae",
    "gallasgroup.it",
    "hubexperts.ch",
    "inspiredconsumer.com",
    "isienvironmental.com",
    "jivacite.com",
    "kekgroup.net",
    "knoxvillebreastcenter.com",
    "myrmp.org",
    "ojhggnfbcy62.com",
    "planners.com.co",
    "secondunit.al",
    "servim.ch",
    "skaizengroup.eu",
    "skutersite.pl",
    "srhfoundation.ca",
    "summar.com",
    "themorsel.in",
    "tscollective.com",
    "turnthetiderx.org",
    "volquetesbosch.com.ar",
    "wazfnynow.com",
```
@dubstard dubstard changed the title Block 133 scams Block 161 scams Oct 1, 2023
Copy link
Collaborator

@AlexHerman1 AlexHerman1 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM.

@AlexHerman1 AlexHerman1 merged commit 6210047 into MetaMask:main Oct 2, 2023
5 checks passed
@dubstard
Copy link
Contributor Author

dubstard commented Oct 2, 2023

thanks

@deshvin deshvin added the blocklist addition Issue or PR requesting addition of a domain to the blocklist label Oct 3, 2023
sime pushed a commit to sime/eth-phishing-detect that referenced this pull request Jan 6, 2024
* Block scams

block
```
 "1inch-claim.org",
    "1inch-rewards.com",
    "2f-coinbase.com",
    "2fa-colnbase.support",
    "accessdapps.firebaseapp.com",
    "airdrop-claim.fun",
    "airdrops-blur.io",
    "airdrops-claim.com",
    "amlbot.social",
    "amlcheckbot.online",
    "amlchecknow.online",
    "apesxmaxs.online",
    "app-balance.finance",
    "appsweb-servers.online",
    "autodebugmodulerpcfix.dev",
    "balacer-v2.com",
    "balacer-v3.org",
    "balancer.one",
    "balencer.org",
    "binance-claim.email",
    "binancetowallet.com",
    "binancetowallet.vip",
    "bitkvb.web.app",
    "blockchein-wallet.com",
    "blu-art.fun",
    "blur.v3.nom.co",
    "bnb-decentralized.com",
    "brinksglobalplantinumservices.com",
    "bscdrop.com",
    "btcbonus.net",
    "capitalcraft.exchange",
    "cashzofferz.com",
    "chaindex.pages.dev",
    "chaingpt-stake.net",
    "chainlink-drops.com",
    "claim-requests-web3.network",
    "claimcake.com",
    "claimings-web3-bridge.link",
    "claimrbh.com",
    "coinlinksys.com",
    "corporategoldlimited.com",
    "crypto-wallet-btc.com",
    "cryptoairdrop.click",
    "daomaker.connect-defi.com",
    "dapp-connects.web.app",
    "dappsecuredrectify.com",
    "dappsolution.app",
    "dappswalletlink.xyz",
    "decentralisedcryptowithdrwl.com",
    "defilama.expert",
    "dfxbridge.com",
    "empirewealthllc.com",
    "firstgfonline.com",
    "fxoption-int.com",
    "gadgetshomey.xyz.cashzofferz.com",
    "geminibtc.org",
    "givebitcoin.net",
    "givebtc.net",
    "go-login-paycor.com",
    "goldminedigitalworld.com",
    "goldsbit.com",
    "heloooaoaoaoooaoa.xyz",
    "host-4-block-chaln0dfg.web.app",
    "hungrykidsfoundation.org",
    "hvmtl-forged.com",
    "kalgatetechnology.com.ng",
    "layerai.live",
    "layerswap-exchange.eu",
    "layerswap-exchange.online",
    "layerswap-exchange.pw",
    "layerswap-exchange.website",
    "maindashboard.online",
    "metamask-update.info",
    "metamask.sly.io.globaleducator.co.in",
    "metamask10.pro",
    "metamaskpresale.info",
    "metamaskrecovry.com",
    "metamasks.cyou",
    "moonbeam-netvvork.com",
    "nftkey.art",
    "nicerfoundation.org.ng",
    "othersideairdrop.com",
    "pancakeswap-finance.store",
    "pancakeswap.mov",
    "ppktrs.su",
    "projectauthverify.xyz",
    "pudgy-huddle.com",
    "rarible-claims.com",
    "receive-shib.com",
    "reward-cyber.web.app",
    "reward4vote.com",
    "ripple-airdrop.online",
    "rockatpool.online",
    "securesmarter.store",
    "shibasocialclub.org",
    "spacecoins.biz",
    "spookyfi.website",
    "stogoldenex.com",
    "sync-dapps.pages.dev",
    "syncdefixons.line.pm",
    "task-on.xyz",
    "taskon-airdrop.space",
    "taskon-airdrop.website",
    "taskon-coin.online",
    "taskon-coin.website",
    "taskon-gifts.fun",
    "taskon-gifts.website",
    "taskon.pw",
    "terawit.net",
    "thegemroyale.com",
    "thepositivia.com",
    "ton-reward.com",
    "truecoinbase.com",
    "trumpnft.site",
    "unionunlimited.com",
    "uniquefxtradez.com",
    "unisvvaps-app.top",
    "unisvvaps.top",
    "uniswap-wallet-secure01b.com",
    "unlswapp.org",
    "v2-balancer.org",
    "venom-drop.space",
    "verify-coinbaseidentity.info",
    "verify-portfoliometamask.ddnss.eu",
    "vesselsconnect.com",
    "voucher-id493495.web.app",
    "web-connectrn.gq",
    "web3-connectxt.gq",
    "web3-trustwallet.xyz",
    "web3ss.gq",
    "webappjf.gq",
    "win-treasure.com",
    "xn--coinbase-o8a.com",
    "xrp-claim.web.app",
```

Contains data from MetaMask#13693 + more

* 'gadgetshomey.xyz.cashzofferz.com' already covered by 'cashzofferz.com' in 'blacklist'.

'gadgetshomey.xyz.cashzofferz.com' already covered by 'cashzofferz.com' in 'blacklist'.

* racoonstealer fake browser updaters

racoonstealer fake browser updaters
```
    "afriagrimagazine.com",
    "carolinacapitalre.com",
    "codemi.co.id",
    "digitopcs.com",
    "emsintoniacomasaude.com.br",
    "eximiousglobal.com",
    "falconaviation.ae",
    "gallasgroup.it",
    "hubexperts.ch",
    "inspiredconsumer.com",
    "isienvironmental.com",
    "jivacite.com",
    "kekgroup.net",
    "knoxvillebreastcenter.com",
    "myrmp.org",
    "ojhggnfbcy62.com",
    "planners.com.co",
    "secondunit.al",
    "servim.ch",
    "skaizengroup.eu",
    "skutersite.pl",
    "srhfoundation.ca",
    "summar.com",
    "themorsel.in",
    "tscollective.com",
    "turnthetiderx.org",
    "volquetesbosch.com.ar",
    "wazfnynow.com",
```
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
blocklist addition Issue or PR requesting addition of a domain to the blocklist
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

3 participants