[kobylazar]

coinomi.exchange is an official domain operated by Coinomi, the multi-chain crypto wallet (coinomi.com), and it is currently being shown as a phishing site by the Phantom extension.

The domain does not appear in blocklist.yaml, eth-blocklist.yaml, nft-blocklist.yaml, or fuzzylist.yaml in this repo, so the flag seems to come from another source. Since Issues are disabled here, we're submitting this as a whitelist PR. We'd appreciate a manual review and removal, and we're happy to verify ownership via a DNS TXT record or an email from an @coinomi.com address.

Submitted by Koby Lazar, Coinomi.

Summary by CodeRabbit

• Configuration
  • The approved-domain list now includes coinomi.exchange; nftplus.io remains listed. No other changes to the list or user-visible behavior were noted in the supplied summary.

[coderabbitai]

No actionable comments were generated in the recent review.

Walkthrough

The whitelist retains nftplus.io and adds coinomi.exchange.

Changes: Domain whitelist

Layer / File(s)	Summary
Add domain to whitelist whitelist.yaml	The whitelist retains nftplus.io and adds coinomi.exchange.

Suggested reviewers: hanahiroaze

Change: Bug fix

Merge Risk: Minimal · up to 060ab

This adds a domain entry to the exported whitelist data in the existing format. No defect was found in the repository. Whether it removes the reported warning depends on an external consumer that this repository does not contain.

Security architecture risk: Low · up to 060ab

The change adds one domain without altering enforcement code or the data format. Documentation says this whitelist is currently unused, which limits the demonstrated impact. Domain ownership and live consumer behavior remain unverified, so no active bypass is established, but minimal risk cannot be concluded.

Retained concerns
No architecture-level concerns identified.

Security review details

Security Blast Radius

• inferred — If downstream consumers activate this shared whitelist, the new membership could affect users receiving either generated dataset, rather than only the submitting user's local exception. Actual reach, exact-host versus subdomain matching, and precedence over other protections remain unknown.

Security Findings and Attack Paths

• observed — The supplied security assessment defers the candidate because authoritative domain ownership and consumer behavior are unresolved. It retains no verified finding. The domain's self-asserted affiliation does not independently establish legitimacy, but the available evidence also does not establish attacker ownership or an active phishing-protection bypass.

Trust Boundaries and Controls

• observed — Repository-authored membership enters generated security data through the existing url projection. The relevant CI guard verifies that url is truthy; it does not authenticate domain ownership. This guard predates the PR, and no evidence establishes that required approvals or other external authorization controls are absent.

Hardening Proposals

• proposed — Resolve the trust decision with an authoritative Coinomi affiliation reference or independently authenticated ownership confirmation, and establish the deployed consumer's whitelist matching and precedence before relying on this addition to resolve the reported false positive.

Pre-merge checks: 4

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title names the change: adding coinomi.exchange to the whitelist. The raw summary confirms that whitelist.yaml adds coinomi.exchange and keeps nftplus.io. The objectives match this, since the PR a…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Title check

Explanation

The title names the change: adding coinomi.exchange to the whitelist. The raw summary confirms that whitelist.yaml adds coinomi.exchange and keeps nftplus.io. The objectives match this, since the PR asks for removal of a phishing flag on that domain. The title is specific and on topic, and it states the reason (false positive) as well.

Finishing Touches

Generate unit tests (beta)

• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Recent review info

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 8066c753-92fa-49d8-9a8a-7d243ad6895c

Commits

Reviewing files that changed from the base of the PR and between 5030186 and 060ab40.

Files selected for processing: 1

• whitelist.yaml

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.