VEYRNOX · Learn · Phishing Site Detection
Phishing Site Detection
Phishing site detection is the wallet-level defence that blocks connections to fraudulent domains impersonating legitimate dApps, exchanges, or bridges. It stops the attack before a signature is ever requested.
How it works
The wallet maintains a threat feed of known phishing domains — sourced from community reports, brand-monitoring services, and passive DNS heuristics. On each dApp connection or WalletConnect handshake, the wallet checks the origin against the feed. Confirmed phishing domains are blocked outright; suspicious lookalikes (typosquats, homoglyphs, punycode variants) surface a warning banner naming the legitimate site being impersonated. The feed refreshes on a short interval so a newly-registered clone is caught within minutes of first sighting.
Why it matters
Phishing is the number-one crypto attack vector — cheaper than exploits, more scalable than social engineering, and effective against sophisticated users. The victim rarely notices anything wrong because the frontend is pixel-perfect. Detection at the wallet layer sidesteps the human eye entirely: the wallet knows the domain is fraudulent even when the user does not.
Related concepts
- Drainer Contract — A drainer contract is a malicious smart contract that, once approved by a victim, transfers assets out of the victim’s wallet to attacker-controlled addresses.
- Threat Intelligence Platform (TIP) — A Threat Intelligence Platform (TIP) is a backend service that aggregates, curates, and distributes real-time threat signals — phishing domains, drainer contracts, sanctioned addresses, suspicious dApps — to consuming clients.
- Transaction Simulation — Transaction simulation is a pre-signing check that runs a proposed transaction against a forked node state and reports the expected net asset change to the user before they sign.
- Address Poisoning — Address poisoning is a wallet-address confusion attack in which an attacker sends a zero-value or dust transaction from an address that visually resembles one of the victim’s frequent contacts.
Frequently asked questions
What counts as a phishing site?
Any domain that impersonates a legitimate dApp, exchange, or wallet to trick users into signing malicious transactions or entering seeds.
Does phishing detection catch every clone?
No feed is complete. Detection catches known and heuristically suspicious sites; combining it with transaction simulation covers the rest.
What if a legitimate site is falsely flagged?
The wallet reports false positives back to the feed operator, and known-good domains are pinned to prevent flapping.
In Veyrnox
Veyrnox uses the Threat Intelligence Platform to feed phishing signals into the AI Security Advisor tier. Free and Safety Plus users still benefit from the removal of the seed-phrase entry surface — the primary target of phishing.