Short answer
Open a "Request blocklist addition" issue in MetaMask's eth-phishing-detect repository, report the site to Blockaid and ScamSniffer, whose lists are used by many wallets, and file the domain and drainer address on Chainabuse. For an ongoing drain, contact SEAL 911. Keep your report factual: the domain, what it copies and why it is malicious.
Who this is for: Crypto teams and security volunteers dealing with a wallet drainer site.
Where to report
| Blocklist | How to report | Who uses it |
|---|---|---|
| MetaMask eth-phishing-detect | GitHub issue "Request blocklist addition" | MetaMask; maintained with ChainPatrol and SEAL |
| Blockaid | report.blockaid.io, Scam option | MetaMask security alerts, among others |
| ScamSniffer | Issue or pull request on its scam-database repository | Phantom, Rabby and others, per its README |
| Chainabuse | chainabuse.com/report, with the domain and drainer address | A public database run by TRM Labs |
ScamSniffer's open data is published with a 7-day delay; its real-time feed is paid. A wallet block protects that wallet's users only, so also take the site down at the registrar and host.
MetaMask's phishing list
- Open the eth-phishing-detect repository on GitHub (a free account is needed).
- Choose New issue, then "Request blocklist addition".
- Enter the malicious domains, one per line, and check that they are not already listed.
- In the rationale, say which project the site copies, link your official domain and describe what the site asks users to do.
The list is active: SEAL's bot committed to it on October 9, 2026. MetaMask points to a ChainPatrol search tool for checking why a domain is blocked.
What to write
Every list asks the same thing: why this domain is malicious. Keep it short and checkable:
Domain: [fake-domain.example] Impersonates: [Your Project], official site [https://your-project.example] What it does: asks visitors to [connect a wallet and sign a permit] to [claim an airdrop] Drainer address: [0x...] Evidence: [screenshot link], seen [2026-10-09 14:20 UTC] Reporter: [name, role at Your Project]
Never paste a seed phrase, private key or signed message into any report.
During an active drain
SEAL 911 describes itself as "a free, around-the-clock emergency hotline" for active security incidents. Reach it through its Telegram bot, @seal_911_bot. It is run by volunteers and does not sell services; be wary of anyone who DMs you claiming to be from it.
If your own site was mistakenly blocked, use Blockaid's Mistake option or MetaMask support, and keep your official domains published so they are easy to verify.
Sources
- MetaMask eth-phishing-detect
- MetaMask and ChainPatrol
- MetaMask: security alerts
- ScamSniffer scam-database
- Blockaid report portal
- SEAL 911
Frequently asked questions
Does a wallet block replace a registrar takedown?
No. It protects users of that wallet only. Report the domain to its registrar and host as well, so it goes offline for everyone.
Is Phantom's GitHub blocklist still used?
Its README still invites pull requests, but the list file has not changed since January 2025, so we do not rely on it. ScamSniffer lists Phantom among the users of its data.
What if a wallet blocks our real site by mistake?
Each provider has a false-positive path: Blockaid's portal has a Mistake option, and MetaMask asks for misclassification reports through its support. Publish your official domains so they are easy to verify.