pezkuwichain/phishing
1
Fork 0
mirror of https://github.com/pezkuwichain/phishing.git synced 2026-10-20 18:56:29 +00:00
Code Releases Activity
Files
1578ee490a3c81645a366efd001d50db0501368e
phishing/README.md
T
SatoshiQaziMuhammed 767a92904d Sync the lists with polkadot-js/phishing every day, and publish them with checks (#4) 
* feat: sync the lists with polkadot-js/phishing daily, and check them before publishing

The lists had not moved since January 2026, the site that serves them was
copied by hand, and the rebrand had turned five real phishing domains into
pezkuwichain.* names, unblocking them.

- scripts/syncUpstream.mjs and sync-upstream.yml take upstream's lists every
  day, lay pezkuwi/overlay.json over them, and commit to master. A day out of
  bounds (too many sites unblocked or added, scam addresses dropped, one of our
  domains blocked, one of our entries lost) writes nothing and opens an issue.
- pezkuwi/overlay.json holds our own entries with their reasons: the five
  pezkuwichain.* names stay blocked on purpose, and our domains are protected.
- scripts/lists.mjs holds the rules; scripts/lists.test.mjs tests them and the
  sync end to end; scripts/checkLists.mjs checks the committed files, including
  that they are what sortAll writes. lists.yml runs all three.
- pezkuwi/host/ is what phishing.pezkuwichain.io runs: it pulls master hourly
  and refuses a rewritten history, a blocked own domain, a shrink over 2%, or
  shards that disagree, with a sandbox test of each refusal.
- sortAll strips a trailing dot. Upstream's 817 "scam.xyz." entries were filed
  under an empty top-level domain in all/all.json, where checkIfDenied never
  looks; 816 repeated a listed name, and prenads.xyz was blocked nowhere else.
- sortAll uses Node's own directory functions instead of @pezkuwi/dev, so the
  sync and the checks run without installing the build toolchain.
- The auto-approve, auto-merge and crosscheck workflows, and the IPFS job,
  depended on tokens and secrets this repository does not have; removed. The
  remaining workflows are pinned to commits, with no default permissions and
  a timeout on every job.

* chore(lists): first sync with polkadot-js/phishing

Written by scripts/syncUpstream.mjs from upstream bf5e7c6:
658 sites added; nodelinkapp.xyz, org.in and terra-claim.com unblocked by
upstream; the five polkadot-js domains the rebrand had renamed blocked again;
816 duplicate "scam.xyz." entries folded into their names and the stray
all/all.json gone. 54,051 blocked sites, 279 scam addresses.

* fix(lists): commit the .build shard, and refuse a shard git ignores

.gitignore held "build/", which also matched all/build/all.json, the shard of
the .build top-level domain. Every sort wrote it and no commit held it, so the
eight .build scam sites were never published; upstream has the same gap. The
directory is excluded from the ignore rule, the shard is committed, and
checkLists.mjs now fails on any shard git would ignore (with the old rule
restored it does).

Also clears the repository's lint on lists.test.mjs: imports sorted, and
node:test's describe and it calls marked void.

* test(lists): await describe and it, as the repository's lint requires

no-floating-promises requires the promises node:test's describe and it return
to be handled, and no-void forbids handling them with void. Awaited, the 25
cases run as before.
2026-09-13 17:34:51 +04:00

54 lines
3.6 KiB
Markdown
Raw Blame History

# @pezkuwi/phishing
A curated list of potentially less-than-honest sites inclusive of a simple JS utility function to check any host against this list.
## How the lists are kept
These lists are Pezkuwi's copy of [polkadot-js/phishing](https://github.com/polkadot-js/phishing): they follow upstream, with a few entries of our own.
- **Daily sync.** [`sync-upstream.yml`](.github/workflows/sync-upstream.yml) takes upstream's lists every day, lays [`pezkuwi/overlay.json`](pezkuwi/overlay.json) over them, and commits the result to `master`. On a day out of bounds it writes nothing and opens an issue instead: more than 25 sites unblocked or 5000 added, more than 10 scam addresses dropped, one of our own domains blocked, or one of our entries lost ([`scripts/lists.mjs`](scripts/lists.mjs)).
- **Our entries.** `overlay.json` holds the sites we block that upstream does not (`deny`), upstream entries we deliberately do not block (`undeny`), and our own domains, which no entry may ever block (`protect`). Each entry records why and since when. Change our entries there, not in `all.json`, which every sync rewrites from upstream.
- **Publishing.** phishing.pezkuwichain.io pulls `master` every hour and checks the lists again before it serves them ([`pezkuwi/host/`](pezkuwi/host/)).
- **Checks.** [`lists.yml`](.github/workflows/lists.yml) runs the rules' tests and [`scripts/checkLists.mjs`](scripts/checkLists.mjs) on every change. Neither needs the build toolchain.
### Additions
Report a new site or scam address to [polkadot-js/phishing](https://github.com/polkadot-js/phishing), and the daily sync brings it here. A site that targets Pezkuwi specifically, and that upstream would not list, goes in the `deny` section of [`pezkuwi/overlay.json`](pezkuwi/overlay.json), with its reason and date.
### Availability
Changes reach [phishing.pezkuwichain.io/all.json](https://phishing.pezkuwichain.io/all.json) and [phishing.pezkuwichain.io/address.json](https://phishing.pezkuwichain.io/address.json) within the hour after they land on `master`. These can be consumed via [@pezkuwi/phishing](https://github.com/pezkuwichain/phishing/tree/master/packages/phishing) and other tools capable of parsing JSON.
## Notable users
The following wallets integrate either address or site blocking from these lists:
<!--
Note to editors: Additions welcome. Keep it alphabetical after the
org-specific projects, i.e. Pezkuwi first, rest alphabetical
following that
-->
- [Pezkuwi Extension](https://github.com/pezkuwichain/pezkuwi-extension)
- [Pezkuwi SDK UI](https://github.com/pezkuwichain/pwap)
- [Pezkuwi Apps](https://pezkuwichain.app)
### Integration
Since the lists are published as JSON, integration for any non-JS wallets (only a JS library that is provided) should be simple - retrieve the applicable list, parse the JSON, and do the required checks either on the host or address as per the requirements. The Javascript library does have some features that may be worth thinking about for other integrations -
- instead of retrieving the list each time a request is made, a local copy is cached for 45 minutes and then re-retrieved when the timer expires (as a request is made)
- for address checks, the check is done on the decoded ss58 address to ensure that network-jumps with the same keys are avoided (so addresses do not have to be re-added for other networks, a single entry will cover all)
### Contributing
These lists are intended to be maintained with active input from the community, so contributions are welcome, either via a pull request (edit above as described in additions) or by [logging an issue](https://github.com/pezkuwichain/phishing/issues).
View Git Blame Copy Permalink