Reported phishing addresses
How Forensia flags addresses that a security project has reported as phishing-related, and why it is labelled as their report.
#Plain languageIn plain terms
Security researchers keep public lists of addresses used in phishing: fake sites and messages that trick people into signing away their funds. If an address you are looking at is on such a list, you want to know.
Forensia checks one open list. When there is a match it says who reported it. Forensia did not investigate the incident and does not vouch for the report.
#How it worksHow it works
- Periodically download the published list of reported addresses.
- Refuse it if it is implausibly small.
- On each lookup on an Ethereum-style network, check the subject and its counterparties for an exact match.
- Report matches as a third party's report, with the date the list was retrieved.
#Technical detailThe exact rules
The source is ScamSniffer's open phishing-address database, published under the GPL-3.0 licence with a seven-day delay. The data is fetched at run time. It is not copied into the product.
| Setting | Value |
|---|---|
| Refresh | Every 12 hours |
| Freshness limit | 7 days |
| Smallest list accepted | 500 addresses |
| Largest download accepted | 8 MiB |
| Addresses screened per lookup | 256 |
The list must be a JSON array. Entries that are well-formed 20-byte addresses are kept, lowercased and de-duplicated. Screened addresses are the subject and every sender, recipient and token contract in the activity.
If a refresh fails, the previous list stays in place until it ages past the freshness limit. A source record for the list (method scamsniffer_phishing_list, carrying the list's SHA-256 and retrieval time) is added to the result only when there is a match.
A match is shown on screen only. The two phishing findings and the list's source record are left out of saved results, JSON backups and Markdown reports, and the source digest of the saved copy is recomputed without them. A saved investigation reopened later does not show the match. Run the lookup again to see it.
| Outcome | Finding | Class and confidence |
|---|---|---|
| The subject is reported | finding:phishing-reported-subject | Attribution, medium |
| A counterparty is reported | finding:phishing-reported-counterparties | Attribution, medium |
#LimitsWhat it does not tell you
- Phishing screening fails silently. Nothing is shown when no list has been loaded, when the stored list is older than seven days, when the list store cannot be read, or when the list was checked and nothing matched. All four look the same in the result: no finding, no warning and no source record.
- Unlike sanctions screening, there is no "screening unavailable" notice and no "not listed" entry, and nothing appears under "Lists checked". No phishing finding is not proof that the address was checked.
- The published list runs seven days behind. A very recent phishing address will not be on it yet.
- The list is not exhaustive, and its entries are not verified here.
- A transfer involving a reported address does not establish that the searched address is involved in phishing.
- A match is not kept in a saved result, a backup or a report. An exported file with no phishing entry says nothing about whether one was shown.
- Disputes about an entry belong with the list's publisher.