dev-ops: prevent Block52 domains from being blocklisted as phishing (preventative)

Aperta
  • Qualcosa non va?
#771 1 commento 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
5/5
Tempo stimato
Più di una settimana
Idoneità per principianti
24/100
Tipo di issue
Funzionalità
Chiarezza
Abbastanza chiara
Stato di attività
Attiva
Stack tecnologico
google-cloud, typescript
Ambito
devops, security

Direzione di ricerca

Start by checking the repository’s existing deployment and automation setup to see where a scheduled job and team alerts belong; the issue does not name those entry points. The job should check the listed domains against the specified blocklists and filtering resolvers, and its test alert should be shown to arrive. The acceptance criteria also call for domain verification, live security.txt files, consistent canonical URLs, and a committed appeal playbook.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

dev-ops

Why (preventative, nothing is wrong today)

On 2026-10-08, PlayBlind (a new crypto poker room) had playblind.com added to MetaMask's phishing blocklist by the Security Alliance (SEAL) sync bot. There was no report and no contact; their removal request (MetaMask/eth-phishing-detect#301099) is still open. Within hours their players couldn't reach the site:

  • Home routers with security filters (e.g. eero Advanced Security) started redirecting the domain to a block page. We reproduced this on a home eero on 2026-10-11, while public DNS still resolved the real server.
  • MetaMask warns or blocks wallet connections.

Block52 has the same risk profile: a crypto site that asks users to connect a wallet and deposit USDC, on a .xyz domain (cheap, heavily abused, low trust with filters), plus a second domain (block52.com). Automated feeds can flag a legitimate site with no warning. If it happened to us, players would be locked out of app.block52.xyz until an appeal clears, which can take days.

Current status (checked 2026-10-12): ✅ clean
  • MetaMask eth-phishing-detect blocklist (~106.5k entries): no block52 / texashodl entries, no issues mentioning Block52.
  • A home eero with Advanced Security resolves app.block52.xyz, block52.xyz and node1.block52.xyz normally.

Preventative measures

  1. Daily blocklist monitoring (highest value). Alert the team (Telegram/email) within hours if any of our domains appears on:

    • MetaMask eth-phishing-detect (src/config.json blacklist + fuzzylist)
    • Google Safe Browsing (Lookup API)
    • security-filtering DNS resolvers (e.g. Cloudflare 1.1.1.2, Quad9 9.9.9.9 via DoH)

    Domains: app.block52.xyz, block52.xyz, node1.block52.xyz, block52.com, app.block52.com, plus texashodl.net / node.texashodl.net.

  2. Register all domains in Google Search Console. Google emails the owner if Safe Browsing flags a page, and it's the route to request a review.

  3. Publish a security.txt (/.well-known/security.txt) on each domain with a security contact, so security groups (SEAL, MetaMask, registrars) can reach us before or after flagging.

  4. One canonical domain for the app, stated everywhere: website footer, X, Telegram, README, docs. Mixed or unofficial domains look like phishing to classifiers.

  5. Pre-written appeal playbook (docs/ops/blocklist-appeal.md) listing who to contact and with what: MetaMask GitHub removal issue, SEAL "Blocked Websites" appeal form, Google Safe Browsing review, eero / Cloudflare / Quad9 false-positive forms. Include proof of ownership (DNS TXT record) and links to the open-source repos.

  6. Lookalike-domain watch. Monitor new registrations similar to block52 (e.g. b1ock52, block-52, blocks52). Scam lookalikes are what get the real brand reported. Consider registering the obvious typos.

  7. Keep the site un-hackable-looking. A compromised page that steals keys gets a site blocklisted legitimately:

    • #611 (game wallet mnemonic stored in plaintext localStorage)
    • a Content-Security-Policy header limiting where scripts can load from
    • dependency pinning/auditing for wallet libraries

Acceptance criteria

  • AC-1 A scheduled job checks every listed domain daily against the sources in (1) and notifies the team on any hit, with a test alert proven to arrive.
  • AC-2 All domains are verified in Google Search Console with alerts going to a monitored inbox.
  • AC-3 security.txt is live on each domain.
  • AC-4 The canonical app URL is documented and consistent across site, socials and repos.
  • AC-5 The appeal playbook is committed to the repo.

Related

  • #611: plaintext game-wallet mnemonic
  • #686: index.html edge-cached for 24h (affects how fast a fix reaches users if a page is ever compromised)

🤖 Generated with Claude Code

Lingua principale
TypeScript
Stelle
2
Fork
5
Merge medio
22h 35m
PR unite (30g)
91

Preparare l'ambiente

Non abbiamo ancora controllato i file di configurazione di questo progetto. Parti dal suo README e consulta la nostra guida al primo contributo per i passaggi generali.

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di block52/ui

Tutte le issue di block52/ui

Issue simili

Altre issue su TypeScript

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.