@metamask-previews/phishing-controller 11.0.0-preview-02e7ff99 → 12.0.0-preview-04657153

package/CHANGELOG.md

@@ -7,6 +7,29 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [12.0.0]
+
+### Added
+
+- Add allowlist functionality to the C2 domain detection system ([#4464](https://github.com/MetaMask/core/pull/4644))
+- Add `PhishingController` functionality for blocking client-side C2 requests by managing a hashed C2 request blocklist ([#4526](https://github.com/MetaMask/core/pull/4526))
+  - Add `requestBlocklist` type to `ListTypes`.
+  - Add `isBlockedRequest` method to `PhishingController`.
+  - Add `isMaliciousRequestDomain` method to `PhishingDetector`.
+  - Add handling of `requestBlocklist` in `PhishingDetector` configuration.
+  - Add logic to update and check `requestBlocklist` when updating a stale list.
+  - Add `sha256Hash` function to generate SHA-256 hash of a domain.
+- Define and export new types: `PhishingControllerGetStateAction`, `PhishingControllerStateChangeEvent`, `PhishingControllerEvents` ([#4633](https://github.com/MetaMask/core/pull/4633))
+
+### Changed
+
+- **BREAKING:** Add `@noble/hashes` `^1.4.0` as dependency ([#4526](https://github.com/MetaMask/core/pull/4526))
+- **BREAKING:**: Add `ethereum-cryptography` `^2.1.2` as dependency ([#4526](https://github.com/MetaMask/core/pull/4526))
+- **BREAKING:** `PhishingControllerMessenger` must allow internal events defined in the `PhishingControllerEvents` type ([#4633](https://github.com/MetaMask/core/pull/4633))
+- Widen `PhishingControllerActions` to include the `PhishingController:getState` action ([#4633](https://github.com/MetaMask/core/pull/4633))
+- Bump `@metamask/base-controller` from `^6.0.2` to `^6.0.3` ([#4625](https://github.com/MetaMask/core/pull/4625))
+- Bump `@metamask/controller-utils` from `^11.0.2` to `^11.1.0` ([#4639](https://github.com/MetaMask/core/pull/4639))
+
 ## [11.0.0]
 
 ### Changed
@@ -228,7 +251,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
     All changes listed after this point were applied to this package following the monorepo conversion.
 
-[Unreleased]: https://github.com/MetaMask/core/compare/@metamask/phishing-controller@11.0.0...HEAD
+[Unreleased]: https://github.com/MetaMask/core/compare/@metamask/phishing-controller@12.0.0...HEAD
+[12.0.0]: https://github.com/MetaMask/core/compare/@metamask/phishing-controller@11.0.0...@metamask/phishing-controller@12.0.0
 [11.0.0]: https://github.com/MetaMask/core/compare/@metamask/phishing-controller@10.1.1...@metamask/phishing-controller@11.0.0
 [10.1.1]: https://github.com/MetaMask/core/compare/@metamask/phishing-controller@10.1.0...@metamask/phishing-controller@10.1.1
 [10.1.0]: https://github.com/MetaMask/core/compare/@metamask/phishing-controller@10.0.0...@metamask/phishing-controller@10.1.0

package/dist/PhishingController.js

@@ -11,7 +11,12 @@
 
 
 
-var _chunkDPHXQJ4Ejs = require('./chunk-DPHXQJ4E.js');
+
+
+
+
+var _chunkXZNT2KYXjs = require('./chunk-XZNT2KYX.js');
+require('./chunk-5NDIXQG5.js');
 require('./chunk-Z4BLTVTB.js');
 
 
@@ -26,5 +31,9 @@ require('./chunk-Z4BLTVTB.js');
 
 
 
-exports.HOTLIST_REFRESH_INTERVAL = _chunkDPHXQJ4Ejs.HOTLIST_REFRESH_INTERVAL; exports.ListKeys = _chunkDPHXQJ4Ejs.ListKeys; exports.ListNames = _chunkDPHXQJ4Ejs.ListNames; exports.METAMASK_HOTLIST_DIFF_FILE = _chunkDPHXQJ4Ejs.METAMASK_HOTLIST_DIFF_FILE; exports.METAMASK_HOTLIST_DIFF_URL = _chunkDPHXQJ4Ejs.METAMASK_HOTLIST_DIFF_URL; exports.METAMASK_STALELIST_FILE = _chunkDPHXQJ4Ejs.METAMASK_STALELIST_FILE; exports.METAMASK_STALELIST_URL = _chunkDPHXQJ4Ejs.METAMASK_STALELIST_URL; exports.PHISHING_CONFIG_BASE_URL = _chunkDPHXQJ4Ejs.PHISHING_CONFIG_BASE_URL; exports.PhishingController = _chunkDPHXQJ4Ejs.PhishingController; exports.STALELIST_REFRESH_INTERVAL = _chunkDPHXQJ4Ejs.STALELIST_REFRESH_INTERVAL; exports.default = _chunkDPHXQJ4Ejs.PhishingController_default; exports.phishingListKeyNameMap = _chunkDPHXQJ4Ejs.phishingListKeyNameMap;
+
+
+
+
+exports.C2_DOMAIN_BLOCKLIST_ENDPOINT = _chunkXZNT2KYXjs.C2_DOMAIN_BLOCKLIST_ENDPOINT; exports.C2_DOMAIN_BLOCKLIST_REFRESH_INTERVAL = _chunkXZNT2KYXjs.C2_DOMAIN_BLOCKLIST_REFRESH_INTERVAL; exports.C2_DOMAIN_BLOCKLIST_URL = _chunkXZNT2KYXjs.C2_DOMAIN_BLOCKLIST_URL; exports.CLIENT_SIDE_DETECION_BASE_URL = _chunkXZNT2KYXjs.CLIENT_SIDE_DETECION_BASE_URL; exports.HOTLIST_REFRESH_INTERVAL = _chunkXZNT2KYXjs.HOTLIST_REFRESH_INTERVAL; exports.ListKeys = _chunkXZNT2KYXjs.ListKeys; exports.ListNames = _chunkXZNT2KYXjs.ListNames; exports.METAMASK_HOTLIST_DIFF_FILE = _chunkXZNT2KYXjs.METAMASK_HOTLIST_DIFF_FILE; exports.METAMASK_HOTLIST_DIFF_URL = _chunkXZNT2KYXjs.METAMASK_HOTLIST_DIFF_URL; exports.METAMASK_STALELIST_FILE = _chunkXZNT2KYXjs.METAMASK_STALELIST_FILE; exports.METAMASK_STALELIST_URL = _chunkXZNT2KYXjs.METAMASK_STALELIST_URL; exports.PHISHING_CONFIG_BASE_URL = _chunkXZNT2KYXjs.PHISHING_CONFIG_BASE_URL; exports.PhishingController = _chunkXZNT2KYXjs.PhishingController; exports.STALELIST_REFRESH_INTERVAL = _chunkXZNT2KYXjs.STALELIST_REFRESH_INTERVAL; exports.default = _chunkXZNT2KYXjs.PhishingController_default; exports.phishingListKeyNameMap = _chunkXZNT2KYXjs.phishingListKeyNameMap;
 //# sourceMappingURL=PhishingController.js.map

package/dist/PhishingController.mjs

@@ -1,4 +1,8 @@
 import {
+  C2_DOMAIN_BLOCKLIST_ENDPOINT,
+  C2_DOMAIN_BLOCKLIST_REFRESH_INTERVAL,
+  C2_DOMAIN_BLOCKLIST_URL,
+  CLIENT_SIDE_DETECION_BASE_URL,
   HOTLIST_REFRESH_INTERVAL,
   ListKeys,
   ListNames,
@@ -11,9 +15,14 @@ import {
   PhishingController_default,
   STALELIST_REFRESH_INTERVAL,
   phishingListKeyNameMap
-} from "./chunk-Q42CM6EP.mjs";
+} from "./chunk-F7CZ3O4X.mjs";
+import "./chunk-G2RL74NS.mjs";
 import "./chunk-XUI43LEZ.mjs";
 export {
+  C2_DOMAIN_BLOCKLIST_ENDPOINT,
+  C2_DOMAIN_BLOCKLIST_REFRESH_INTERVAL,
+  C2_DOMAIN_BLOCKLIST_URL,
+  CLIENT_SIDE_DETECION_BASE_URL,
   HOTLIST_REFRESH_INTERVAL,
   ListKeys,
   ListNames,

package/dist/PhishingDetector.js

@@ -1,8 +1,9 @@
 "use strict";Object.defineProperty(exports, "__esModule", {value: true});
 
-var _chunkDPHXQJ4Ejs = require('./chunk-DPHXQJ4E.js');
+var _chunkXZNT2KYXjs = require('./chunk-XZNT2KYX.js');
+require('./chunk-5NDIXQG5.js');
 require('./chunk-Z4BLTVTB.js');
 
 
-exports.PhishingDetector = _chunkDPHXQJ4Ejs.PhishingDetector;
+exports.PhishingDetector = _chunkXZNT2KYXjs.PhishingDetector;
 //# sourceMappingURL=PhishingDetector.js.map

package/dist/PhishingDetector.mjs

@@ -1,6 +1,7 @@
 import {
   PhishingDetector
-} from "./chunk-Q42CM6EP.mjs";
+} from "./chunk-F7CZ3O4X.mjs";
+import "./chunk-G2RL74NS.mjs";
 import "./chunk-XUI43LEZ.mjs";
 export {
   PhishingDetector

package/dist/chunk-5NDIXQG5.js

@@ -0,0 +1,16 @@
+"use strict";Object.defineProperty(exports, "__esModule", {value: true});// src/types.ts
+var PhishingDetectorResultType = /* @__PURE__ */ ((PhishingDetectorResultType2) => {
+  PhishingDetectorResultType2["All"] = "all";
+  PhishingDetectorResultType2["Fuzzy"] = "fuzzy";
+  PhishingDetectorResultType2["Blocklist"] = "blocklist";
+  PhishingDetectorResultType2["Allowlist"] = "allowlist";
+  PhishingDetectorResultType2["Blacklist"] = "blacklist";
+  PhishingDetectorResultType2["Whitelist"] = "whitelist";
+  PhishingDetectorResultType2["C2DomainBlocklist"] = "c2DomainBlocklist";
+  return PhishingDetectorResultType2;
+})(PhishingDetectorResultType || {});
+
+
+
+exports.PhishingDetectorResultType = PhishingDetectorResultType;
+//# sourceMappingURL=chunk-5NDIXQG5.js.map

package/dist/chunk-5NDIXQG5.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/types.ts"],"names":["PhishingDetectorResultType"],"mappings":";AAyCO,IAAK,6BAAL,kBAAKA,gCAAL;AAIL,EAAAA,4BAAA,SAAM;AAIN,EAAAA,4BAAA,WAAQ;AAIR,EAAAA,4BAAA,eAAY;AAIZ,EAAAA,4BAAA,eAAY;AAKZ,EAAAA,4BAAA,eAAY;AAKZ,EAAAA,4BAAA,eAAY;AAIZ,EAAAA,4BAAA,uBAAoB;AA9BV,SAAAA;AAAA,GAAA","sourcesContent":["/**\n * Represents the result of checking a domain.\n */\nexport type PhishingDetectorResult = {\n  /**\n   * The name of the configuration object in which the domain was found within\n   * an allowlist, blocklist, or fuzzylist.\n   */\n  name?: string;\n  /**\n   * The version associated with the configuration object in which the domain\n   * was found within an allowlist, blocklist, or fuzzylist.\n   */\n  version?: string;\n  /**\n   * Whether the domain is regarded as allowed (true) or not (false).\n   */\n  result: boolean;\n  /**\n   * A normalized version of the domain, which is only constructed if the domain\n   * is found within a list.\n   */\n  match?: string;\n  /**\n   * Which type of list in which the domain was found.\n   *\n   * - \"allowlist\" means that the domain was found in the allowlist.\n   * - \"blocklist\" means that the domain was found in the blocklist.\n   * - \"fuzzy\" means that the domain was found in the fuzzylist.\n   * - \"blacklist\" means that the domain was found in a blacklist of a legacy\n   * configuration object.\n   * - \"whitelist\" means that the domain was found in a whitelist of a legacy\n   * configuration object.\n   * - \"all\" means that the domain was not found in any list.\n   */\n  type: PhishingDetectorResultType;\n};\n\n/**\n * The type of list in which the domain was found.\n */\nexport enum PhishingDetectorResultType {\n  /*\n   * \"all\" means that the domain was not found in any list.\n   */\n  All = 'all',\n  /*\n   * \"fuzzy\" means that the domain was found in the fuzzylist.\n   */\n  Fuzzy = 'fuzzy',\n  /*\n   * \"blocklist\" means that the domain was found in the blocklist.\n   */\n  Blocklist = 'blocklist',\n  /*\n   * \"allowlist\" means that the domain was found in the allowlist.\n   */\n  Allowlist = 'allowlist',\n  /*\n   * \"blacklist\" means that the domain was found in a blacklist of a legacy\n   * configuration object.\n   */\n  Blacklist = 'blacklist',\n  /*\n   * \"whitelist\" means that the domain was found in a whitelist of a legacy\n   * configuration object.\n   */\n  Whitelist = 'whitelist',\n  /*\n   * \"c2DomainBlocklist\" means that the domain was found in the C2 domain blocklist.\n   */\n  C2DomainBlocklist = 'c2DomainBlocklist',\n}\n"]}

package/dist/{chunk-Q42CM6EP.mjs → chunk-F7CZ3O4X.mjs}

@@ -5,6 +5,10 @@ import {
   __privateSet
 } from "./chunk-XUI43LEZ.mjs";
 
+// src/utils.ts
+import { bytesToHex } from "@noble/hashes/utils";
+import { sha256 } from "ethereum-cryptography/sha256";
+
 // src/PhishingController.ts
 import { BaseController } from "@metamask/base-controller";
 import { safelyExecute } from "@metamask/controller-utils";
@@ -36,6 +40,7 @@ var PhishingDetector = class {
         getDefaultPhishingDetectorConfig({
           allowlist: opts.whitelist,
           blocklist: opts.blacklist,
+          c2DomainBlocklist: opts.c2DomainBlocklist,
           fuzzylist: opts.fuzzylist,
           tolerance: opts.tolerance
         })
@@ -55,10 +60,10 @@ var PhishingDetector = class {
     const result = __privateMethod(this, _check, check_fn).call(this, url);
     if (__privateGet(this, _legacyConfig)) {
       let legacyType = result.type;
-      if (legacyType === "allowlist") {
-        legacyType = "whitelist";
-      } else if (legacyType === "blocklist") {
-        legacyType = "blacklist";
+      if (legacyType === "allowlist" /* Allowlist */) {
+        legacyType = "whitelist" /* Whitelist */;
+      } else if (legacyType === "blocklist" /* Blocklist */) {
+        legacyType = "blacklist" /* Blacklist */;
       }
       return {
         match: result.match,
@@ -68,12 +73,88 @@ var PhishingDetector = class {
     }
     return result;
   }
+  /**
+   * Checks if a URL is blocked against the hashed request blocklist.
+   * This is done by hashing the URL's hostname and checking it against the hashed request blocklist.
+   *
+   *
+   * @param urlString - The URL to check.
+   * @returns An object indicating if the URL is blocked and relevant metadata.
+   */
+  isMaliciousC2Domain(urlString) {
+    let hostname;
+    try {
+      hostname = new URL(urlString).hostname;
+    } catch (error) {
+      return {
+        result: false,
+        type: "c2DomainBlocklist" /* C2DomainBlocklist */
+      };
+    }
+    const fqdn = hostname.endsWith(".") ? hostname.slice(0, -1) : hostname;
+    const source = domainToParts(fqdn);
+    for (const { allowlist, name, version } of __privateGet(this, _configs)) {
+      const allowlistMatch = matchPartsAgainstList(source, allowlist);
+      if (allowlistMatch) {
+        const match = domainPartsToDomain(allowlistMatch);
+        return {
+          match,
+          name,
+          result: false,
+          type: "allowlist" /* Allowlist */,
+          version: version === void 0 ? version : String(version)
+        };
+      }
+    }
+    for (const { c2DomainBlocklist, name, version } of __privateGet(this, _configs)) {
+      const hash = sha256Hash(hostname.toLowerCase());
+      const blocked = c2DomainBlocklist?.includes(hash) ?? false;
+      if (blocked) {
+        return {
+          name,
+          result: true,
+          type: "c2DomainBlocklist" /* C2DomainBlocklist */,
+          version: version === void 0 ? version : String(version)
+        };
+      }
+    }
+    return {
+      result: false,
+      type: "c2DomainBlocklist" /* C2DomainBlocklist */
+    };
+  }
 };
 _configs = new WeakMap();
 _legacyConfig = new WeakMap();
 _check = new WeakSet();
 check_fn = function(url) {
-  const domain = new URL(url).hostname;
+  const ipfsCidMatch = url.match(ipfsCidRegex());
+  if (ipfsCidMatch !== null) {
+    const cID = ipfsCidMatch[0];
+    for (const { blocklist, name, version } of __privateGet(this, _configs)) {
+      const blocklistMatch = blocklist.filter((entries) => entries.length === 1).find((entries) => {
+        return entries[0] === cID;
+      });
+      if (blocklistMatch) {
+        return {
+          name,
+          match: cID,
+          result: true,
+          type: "blocklist" /* Blocklist */,
+          version: version === void 0 ? version : String(version)
+        };
+      }
+    }
+  }
+  let domain;
+  try {
+    domain = new URL(url).hostname;
+  } catch (error) {
+    return {
+      result: false,
+      type: "all" /* All */
+    };
+  }
   const fqdn = domain.endsWith(".") ? domain.slice(0, -1) : domain;
   const source = domainToParts(fqdn);
   for (const { allowlist, name, version } of __privateGet(this, _configs)) {
@@ -84,7 +165,7 @@ check_fn = function(url) {
         match,
         name,
         result: false,
-        type: "allowlist",
+        type: "allowlist" /* Allowlist */,
         version: version === void 0 ? version : String(version)
       };
     }
@@ -97,7 +178,7 @@ check_fn = function(url) {
         match,
         name,
         result: true,
-        type: "blocklist",
+        type: "blocklist" /* Blocklist */,
         version: version === void 0 ? version : String(version)
       };
     }
@@ -115,31 +196,13 @@ check_fn = function(url) {
           name,
           match,
           result: true,
-          type: "fuzzy",
+          type: "fuzzy" /* Fuzzy */,
           version: version === void 0 ? version : String(version)
         };
       }
     }
   }
-  const ipfsCidMatch = url.match(ipfsCidRegex());
-  if (ipfsCidMatch !== null) {
-    const cID = ipfsCidMatch[0];
-    for (const { blocklist, name, version } of __privateGet(this, _configs)) {
-      const blocklistMatch = blocklist.filter((entries) => entries.length === 1).find((entries) => {
-        return entries[0] === cID;
-      });
-      if (blocklistMatch) {
-        return {
-          name,
-          match: cID,
-          result: true,
-          type: "blocklist",
-          version: version === void 0 ? version : String(version)
-        };
-      }
-    }
-  }
-  return { result: false, type: "all" };
+  return { result: false, type: "all" /* All */ };
 };
 function ipfsCidRegex() {
   const reg = "Qm[1-9A-HJ-NP-Za-km-z]{44,}|b[A-Za-z2-7]{58,}|B[A-Z2-7]{58,}|z[1-9A-HJ-NP-Za-km-z]{48,}|F[0-9A-F]{50,}";
@@ -150,10 +213,14 @@ function ipfsCidRegex() {
 var PHISHING_CONFIG_BASE_URL = "https://phishing-detection.api.cx.metamask.io";
 var METAMASK_STALELIST_FILE = "/v1/stalelist";
 var METAMASK_HOTLIST_DIFF_FILE = "/v1/diffsSince";
+var CLIENT_SIDE_DETECION_BASE_URL = "https://client-side-detection.api.cx.metamask.io";
+var C2_DOMAIN_BLOCKLIST_ENDPOINT = "/v1/request-blocklist";
+var C2_DOMAIN_BLOCKLIST_REFRESH_INTERVAL = 15 * 60;
 var HOTLIST_REFRESH_INTERVAL = 5 * 60;
 var STALELIST_REFRESH_INTERVAL = 30 * 24 * 60 * 60;
 var METAMASK_STALELIST_URL = `${PHISHING_CONFIG_BASE_URL}${METAMASK_STALELIST_FILE}`;
 var METAMASK_HOTLIST_DIFF_URL = `${PHISHING_CONFIG_BASE_URL}${METAMASK_HOTLIST_DIFF_FILE}`;
+var C2_DOMAIN_BLOCKLIST_URL = `${CLIENT_SIDE_DETECION_BASE_URL}${C2_DOMAIN_BLOCKLIST_ENDPOINT}`;
 var ListKeys = /* @__PURE__ */ ((ListKeys2) => {
   ListKeys2["EthPhishingDetectConfig"] = "eth_phishing_detect_config";
   return ListKeys2;
@@ -173,17 +240,19 @@ var metadata = {
   phishingLists: { persist: true, anonymous: false },
   whitelist: { persist: true, anonymous: false },
   hotlistLastFetched: { persist: true, anonymous: false },
-  stalelistLastFetched: { persist: true, anonymous: false }
+  stalelistLastFetched: { persist: true, anonymous: false },
+  c2DomainBlocklistLastFetched: { persist: true, anonymous: false }
 };
 var getDefaultState = () => {
   return {
     phishingLists: [],
     whitelist: [],
     hotlistLastFetched: 0,
-    stalelistLastFetched: 0
+    stalelistLastFetched: 0,
+    c2DomainBlocklistLastFetched: 0
   };
 };
-var _detector, _stalelistRefreshInterval, _hotlistRefreshInterval, _inProgressHotlistUpdate, _inProgressStalelistUpdate, _registerMessageHandlers, registerMessageHandlers_fn, _updateStalelist, updateStalelist_fn, _updateHotlist, updateHotlist_fn, _queryConfig, queryConfig_fn;
+var _detector, _stalelistRefreshInterval, _hotlistRefreshInterval, _c2DomainBlocklistRefreshInterval, _inProgressHotlistUpdate, _inProgressStalelistUpdate, _isProgressC2DomainBlocklistUpdate, _registerMessageHandlers, registerMessageHandlers_fn, _updateStalelist, updateStalelist_fn, _updateHotlist, updateHotlist_fn, _updateC2DomainBlocklist, updateC2DomainBlocklist_fn, _queryConfig, queryConfig_fn;
 var PhishingController = class extends BaseController {
   /**
    * Construct a Phishing Controller.
@@ -191,12 +260,14 @@ var PhishingController = class extends BaseController {
    * @param config - Initial options used to configure this controller.
    * @param config.stalelistRefreshInterval - Polling interval used to fetch stale list.
    * @param config.hotlistRefreshInterval - Polling interval used to fetch hotlist diff list.
+   * @param config.c2DomainBlocklistRefreshInterval - Polling interval used to fetch c2 domain blocklist.
    * @param config.messenger - The controller restricted messenger.
    * @param config.state - Initial state to set on this controller.
    */
   constructor({
     stalelistRefreshInterval = STALELIST_REFRESH_INTERVAL,
     hotlistRefreshInterval = HOTLIST_REFRESH_INTERVAL,
+    c2DomainBlocklistRefreshInterval = C2_DOMAIN_BLOCKLIST_REFRESH_INTERVAL,
     messenger,
     state = {}
   }) {
@@ -228,16 +299,26 @@ var PhishingController = class extends BaseController {
      * this function that prevents redundant configuration updates.
      */
     __privateAdd(this, _updateHotlist);
+    /**
+     * Update the C2 domain blocklist.
+     *
+     * This should only be called from the `updateC2DomainBlocklist` function, which is a wrapper around
+     * this function that prevents redundant configuration updates.
+     */
+    __privateAdd(this, _updateC2DomainBlocklist);
     __privateAdd(this, _queryConfig);
     // TODO: Replace `any` with type
     // eslint-disable-next-line @typescript-eslint/no-explicit-any
     __privateAdd(this, _detector, void 0);
     __privateAdd(this, _stalelistRefreshInterval, void 0);
     __privateAdd(this, _hotlistRefreshInterval, void 0);
+    __privateAdd(this, _c2DomainBlocklistRefreshInterval, void 0);
     __privateAdd(this, _inProgressHotlistUpdate, void 0);
     __privateAdd(this, _inProgressStalelistUpdate, void 0);
+    __privateAdd(this, _isProgressC2DomainBlocklistUpdate, void 0);
     __privateSet(this, _stalelistRefreshInterval, stalelistRefreshInterval);
     __privateSet(this, _hotlistRefreshInterval, hotlistRefreshInterval);
+    __privateSet(this, _c2DomainBlocklistRefreshInterval, c2DomainBlocklistRefreshInterval);
     __privateMethod(this, _registerMessageHandlers, registerMessageHandlers_fn).call(this);
     this.updatePhishingDetector();
   }
@@ -267,6 +348,16 @@ var PhishingController = class extends BaseController {
   setHotlistRefreshInterval(interval) {
     __privateSet(this, _hotlistRefreshInterval, interval);
   }
+  /**
+   * Set the interval at which the C2 domain blocklist will be refetched.
+   * Fetching will only occur on the next call to test/bypass.
+   * For immediate update to the phishing list, call {@link updateHotlist} directly.
+   *
+   * @param interval - the new interval, in ms.
+   */
+  setC2DomainBlocklistRefreshInterval(interval) {
+    __privateSet(this, _c2DomainBlocklistRefreshInterval, interval);
+  }
   /**
    * Determine if an update to the stalelist configuration is needed.
    *
@@ -283,12 +374,20 @@ var PhishingController = class extends BaseController {
   isHotlistOutOfDate() {
     return fetchTimeNow() - this.state.hotlistLastFetched >= __privateGet(this, _hotlistRefreshInterval);
   }
+  /**
+   * Determine if an update to the C2 domain blocklist is needed.
+   *
+   * @returns Whether an update is needed
+   */
+  isC2DomainBlocklistOutOfDate() {
+    return fetchTimeNow() - this.state.c2DomainBlocklistLastFetched >= __privateGet(this, _c2DomainBlocklistRefreshInterval);
+  }
   /**
    * Conditionally update the phishing configuration.
    *
    * If the stalelist configuration is out of date, this function will call `updateStalelist`
    * to update the configuration. This will automatically grab the hotlist,
-   * so it isn't necessary to continue on to download the hotlist.
+   * so it isn't necessary to continue on to download the hotlist and the c2 domain blocklist.
    *
    */
   async maybeUpdateState() {
@@ -301,6 +400,10 @@ var PhishingController = class extends BaseController {
     if (hotlistOutOfDate) {
       await this.updateHotlist();
     }
+    const c2DomainBlocklistOutOfDate = this.isC2DomainBlocklistOutOfDate();
+    if (c2DomainBlocklistOutOfDate) {
+      await this.updateC2DomainBlocklist();
+    }
   }
   /**
    * Determines if a given origin is unapproved.
@@ -315,10 +418,24 @@ var PhishingController = class extends BaseController {
   test(origin) {
     const punycodeOrigin = toASCII(origin);
     if (this.state.whitelist.includes(punycodeOrigin)) {
-      return { result: false, type: "all" };
+      return { result: false, type: "all" /* All */ };
     }
     return __privateGet(this, _detector).check(punycodeOrigin);
   }
+  /**
+   * Checks if a request URL's domain is blocked against the request blocklist.
+   *
+   * This method is used to determine if a specific request URL is associated with a malicious
+   * command and control (C2) domain. The URL's hostname is hashed and checked against a configured
+   * blocklist of known malicious domains.
+   *
+   * @param origin - The full request URL to be checked.
+   * @returns An object indicating whether the URL's domain is blocked and relevant metadata.
+   */
+  isBlockedRequest(origin) {
+    const punycodeOrigin = toASCII(origin);
+    return __privateGet(this, _detector).isMaliciousC2Domain(punycodeOrigin);
+  }
   /**
    * Temporarily marks a given origin as approved.
    *
@@ -334,6 +451,24 @@ var PhishingController = class extends BaseController {
       draftState.whitelist.push(punycodeOrigin);
     });
   }
+  /**
+   * Update the C2 domain blocklist.
+   *
+   * If an update is in progress, no additional update will be made. Instead this will wait until
+   * the in-progress update has finished.
+   */
+  async updateC2DomainBlocklist() {
+    if (__privateGet(this, _isProgressC2DomainBlocklistUpdate)) {
+      await __privateGet(this, _isProgressC2DomainBlocklistUpdate);
+      return;
+    }
+    try {
+      __privateSet(this, _isProgressC2DomainBlocklistUpdate, __privateMethod(this, _updateC2DomainBlocklist, updateC2DomainBlocklist_fn).call(this));
+      await __privateGet(this, _isProgressC2DomainBlocklistUpdate);
+    } finally {
+      __privateSet(this, _isProgressC2DomainBlocklistUpdate, void 0);
+    }
+  }
   /**
    * Update the hotlist.
    *
@@ -374,8 +509,10 @@ var PhishingController = class extends BaseController {
 _detector = new WeakMap();
 _stalelistRefreshInterval = new WeakMap();
 _hotlistRefreshInterval = new WeakMap();
+_c2DomainBlocklistRefreshInterval = new WeakMap();
 _inProgressHotlistUpdate = new WeakMap();
 _inProgressStalelistUpdate = new WeakMap();
+_isProgressC2DomainBlocklistUpdate = new WeakMap();
 _registerMessageHandlers = new WeakSet();
 registerMessageHandlers_fn = function() {
   this.messagingSystem.registerActionHandler(
@@ -389,10 +526,16 @@ registerMessageHandlers_fn = function() {
 };
 _updateStalelist = new WeakSet();
 updateStalelist_fn = async function() {
-  let stalelistResponse;
-  let hotlistDiffsResponse;
+  let stalelistResponse = null;
+  let hotlistDiffsResponse = null;
+  let c2DomainBlocklistResponse = null;
   try {
-    stalelistResponse = await __privateMethod(this, _queryConfig, queryConfig_fn).call(this, METAMASK_STALELIST_URL).then((d) => d);
+    const stalelistPromise = __privateMethod(this, _queryConfig, queryConfig_fn).call(this, METAMASK_STALELIST_URL);
+    const c2DomainBlocklistPromise = __privateMethod(this, _queryConfig, queryConfig_fn).call(this, C2_DOMAIN_BLOCKLIST_URL);
+    [stalelistResponse, c2DomainBlocklistResponse] = await Promise.all([
+      stalelistPromise,
+      c2DomainBlocklistPromise
+    ]);
     if (stalelistResponse?.data && stalelistResponse.data.lastUpdated > 0) {
       hotlistDiffsResponse = await __privateMethod(this, _queryConfig, queryConfig_fn).call(this, `${METAMASK_HOTLIST_DIFF_URL}/${stalelistResponse.data.lastUpdated}`);
     }
@@ -401,6 +544,7 @@ updateStalelist_fn = async function() {
     this.update((draftState) => {
       draftState.stalelistLastFetched = timeNow;
       draftState.hotlistLastFetched = timeNow;
+      draftState.c2DomainBlocklistLastFetched = timeNow;
     });
   }
   if (!stalelistResponse || !hotlistDiffsResponse) {
@@ -410,6 +554,7 @@ updateStalelist_fn = async function() {
   const metamaskListState = {
     ...eth_phishing_detect_config,
     ...partialState,
+    c2DomainBlocklist: c2DomainBlocklistResponse ? c2DomainBlocklistResponse.recentlyAdded : [],
     name: phishingListKeyNameMap.eth_phishing_detect_config
   };
   const newMetaMaskListState = applyDiffs(
@@ -439,13 +584,48 @@ updateHotlist_fn = async function() {
     return;
   }
   const hotlist = hotlistResponse.data;
-  const newPhishingLists = this.state.phishingLists.map(
-    (phishingList) => applyDiffs(
+  const newPhishingLists = this.state.phishingLists.map((phishingList) => {
+    const updatedList = applyDiffs(
       phishingList,
       hotlist,
-      phishingListNameKeyMap[phishingList.name]
-    )
-  );
+      phishingListNameKeyMap[phishingList.name],
+      [],
+      []
+    );
+    return updatedList;
+  });
+  this.update((draftState) => {
+    draftState.phishingLists = newPhishingLists;
+  });
+  this.updatePhishingDetector();
+};
+_updateC2DomainBlocklist = new WeakSet();
+updateC2DomainBlocklist_fn = async function() {
+  let c2DomainBlocklistResponse = null;
+  try {
+    c2DomainBlocklistResponse = await __privateMethod(this, _queryConfig, queryConfig_fn).call(this, `${C2_DOMAIN_BLOCKLIST_URL}?timestamp=${roundToNearestMinute(
+      this.state.c2DomainBlocklistLastFetched
+    )}`);
+  } finally {
+    this.update((draftState) => {
+      draftState.c2DomainBlocklistLastFetched = fetchTimeNow();
+    });
+  }
+  if (!c2DomainBlocklistResponse) {
+    return;
+  }
+  const recentlyAddedC2Domains = c2DomainBlocklistResponse.recentlyAdded;
+  const recentlyRemovedC2Domains = c2DomainBlocklistResponse.recentlyRemoved;
+  const newPhishingLists = this.state.phishingLists.map((phishingList) => {
+    const updatedList = applyDiffs(
+      phishingList,
+      [],
+      phishingListNameKeyMap[phishingList.name],
+      recentlyAddedC2Domains,
+      recentlyRemovedC2Domains
+    );
+    return updatedList;
+  });
   this.update((draftState) => {
     draftState.phishingLists = newPhishingLists;
   });
@@ -471,6 +651,9 @@ var PhishingController_default = PhishingController;
 // src/utils.ts
 var DEFAULT_TOLERANCE = 3;
 var fetchTimeNow = () => Math.round(Date.now() / 1e3);
+function roundToNearestMinute(unixTimestamp) {
+  return Math.floor(unixTimestamp / 60) * 60;
+}
 var splitStringByPeriod = (stringToSplit) => {
   const periodIndex = stringToSplit.indexOf(".");
   return [
@@ -478,7 +661,7 @@ var splitStringByPeriod = (stringToSplit) => {
     stringToSplit.slice(periodIndex + 1)
   ];
 };
-var applyDiffs = (listState, hotlistDiffs, listKey) => {
+var applyDiffs = (listState, hotlistDiffs, listKey, recentlyAddedC2Domains = [], recentlyRemovedC2Domains = []) => {
   const diffsToApply = hotlistDiffs.filter(
     ({ timestamp, targetList }) => timestamp > listState.lastUpdated && splitStringByPeriod(targetList)[0] === listKey
   );
@@ -486,7 +669,8 @@ var applyDiffs = (listState, hotlistDiffs, listKey) => {
   const listSets = {
     allowlist: new Set(listState.allowlist),
     blocklist: new Set(listState.blocklist),
-    fuzzylist: new Set(listState.fuzzylist)
+    fuzzylist: new Set(listState.fuzzylist),
+    c2DomainBlocklist: new Set(listState.c2DomainBlocklist)
   };
   for (const { isRemoval, targetList, url, timestamp } of diffsToApply) {
     const targetListType = splitStringByPeriod(targetList)[1];
@@ -499,7 +683,16 @@ var applyDiffs = (listState, hotlistDiffs, listKey) => {
       listSets[targetListType].add(url);
     }
   }
+  if (listKey === "eth_phishing_detect_config" /* EthPhishingDetectConfig */) {
+    for (const hash of recentlyAddedC2Domains) {
+      listSets.c2DomainBlocklist.add(hash);
+    }
+    for (const hash of recentlyRemovedC2Domains) {
+      listSets.c2DomainBlocklist.delete(hash);
+    }
+  }
   return {
+    c2DomainBlocklist: Array.from(listSets.c2DomainBlocklist),
     allowlist: Array.from(listSets.allowlist),
     blocklist: Array.from(listSets.blocklist),
     fuzzylist: Array.from(listSets.fuzzylist),
@@ -564,9 +757,14 @@ var matchPartsAgainstList = (source, list) => {
     return target.every((part, index) => source[index] === part);
   });
 };
+var sha256Hash = (hostname) => {
+  const hashBuffer = sha256(new TextEncoder().encode(hostname.toLowerCase()));
+  return bytesToHex(hashBuffer);
+};
 
 export {
   fetchTimeNow,
+  roundToNearestMinute,
   applyDiffs,
   validateConfig,
   domainToParts,
@@ -576,18 +774,23 @@ export {
   domainPartsToDomain,
   domainPartsToFuzzyForm,
   matchPartsAgainstList,
+  sha256Hash,
   PhishingDetector,
   PHISHING_CONFIG_BASE_URL,
   METAMASK_STALELIST_FILE,
   METAMASK_HOTLIST_DIFF_FILE,
+  CLIENT_SIDE_DETECION_BASE_URL,
+  C2_DOMAIN_BLOCKLIST_ENDPOINT,
+  C2_DOMAIN_BLOCKLIST_REFRESH_INTERVAL,
   HOTLIST_REFRESH_INTERVAL,
   STALELIST_REFRESH_INTERVAL,
   METAMASK_STALELIST_URL,
   METAMASK_HOTLIST_DIFF_URL,
+  C2_DOMAIN_BLOCKLIST_URL,
   ListKeys,
   ListNames,
   phishingListKeyNameMap,
   PhishingController,
   PhishingController_default
 };
-//# sourceMappingURL=chunk-Q42CM6EP.mjs.map
+//# sourceMappingURL=chunk-F7CZ3O4X.mjs.map