From ab32a1ae74a95faea681e869e051a68fdf671e1d Mon Sep 17 00:00:00 2001
From: SukkaW <isukkaw@gmail.com>
Date: Sat, 2 Nov 2024 04:03:27 +0800
Subject: [PATCH] Chore: Update Phishing Build

---
 Build/lib/get-phishing-domains.ts  | 11 +++++------
 Source/domainset/reject_sukka.conf |  1 +
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/Build/lib/get-phishing-domains.ts b/Build/lib/get-phishing-domains.ts
index 6af759b4..e778d988 100644
--- a/Build/lib/get-phishing-domains.ts
+++ b/Build/lib/get-phishing-domains.ts
@@ -63,8 +63,7 @@ const sensitiveKeywords = createKeywordFilter([
   'facebook-',
   'focebaak',
   '.facebook.',
-  'metamask-',
-  '-metamask',
+  'metamask',
   'www.apple',
   '-coinbase',
   'coinbase-',
@@ -83,9 +82,9 @@ const sensitiveKeywords = createKeywordFilter([
 ]);
 const lowKeywords = createKeywordFilter([
   'transactions-',
-  'payment-',
+  'payment',
+  'wallet',
   '-transactions',
-  '-payment',
   '-faceb', // facebook fake
   '.faceb', // facebook fake
   'facebook',
@@ -213,9 +212,9 @@ export function calcDomainAbuseScore(subdomain: string, fullDomain: string = sub
   const sensitiveKeywordsHit = sensitiveKeywords(fullDomain);
 
   if (sensitiveKeywordsHit) {
-    weight += 9;
+    weight += 10;
     if (hitLowKeywords) {
-      weight += 5;
+      weight += 6;
     }
   } else if (hitLowKeywords) {
     weight += 1.5;
diff --git a/Source/domainset/reject_sukka.conf b/Source/domainset/reject_sukka.conf
index aa9ac049..22618789 100644
--- a/Source/domainset/reject_sukka.conf
+++ b/Source/domainset/reject_sukka.conf
@@ -323,6 +323,7 @@ inst.360safe.com
 .googleplay.pro
 .printondemandmerchandise.com
 .thebitmeister.com
+.metamask-app.com
 # Phishing domain like `www-facebook.to-kr.com`
 .to-kr.com
 # Poland Hosting dhosting.pl's free subdomain