[Legitimate Site Blocked] portrait.so

[ryanshahine]

Example:
https://portrait.so/ryan

Description

MetaMask shows a phishing warning when visiting user pages under: portrait.so/[username]

However:

• portrait.so and portrait.so/[username] do not appear in:
  • https://metamask.github.io/eth-phishing-detect/
  • https://github.com/MetaMask/eth-phishing-detect/blob/main/src/config.json
  • https://raw.githubusercontent.com/security-alliance/blocklists/refs/heads/main/domain.txt

Despite not being listed in these blocklists, the MetaMask phishing warning still appears.

Environment

• MetaMask version: v13.20.1
• Browser: Chrome

Observations

The warning appears only on user pages (e.g. /ryan), not on the root domain.

This suggests the detection may be triggered by a resource loaded on user pages. Some external services used on these pages include:

• node1.irys.xyz
• uploader.irys.xyz
• media.portrait.host
• irys.portrait.host

It may be related to one of these domains or to a heuristic triggered by embedded content.

[ryanshahine]

The root cause of the warning page is related to fetching user uploads (images/videos) from uploader.irys.xyz. We have disabled loading data from uploader.irys.xyz for now, which solves this issue temporarily.

I see that there's an open PR (#228972) related to Irys, but don't think that it solves this issue.

[ryanshahine]

I opened a PR to allowlist portrait.so: #229215

Portrait has been operating since 2022 and hosts user pages where user uploads are restricted to images and videos only, with no executable content rendered.

We use decentralized storage networks (IPFS, Irys, Arweave) and occasionally switch gateways depending on availability. In the past we have seen similar false positives triggered by specific gateways, even though any user site itself does not serve phishing content; only images and videos.

Because of this, portrait.so should be safe to allowlist.

[AlexHerman1]

this should be resolved now

[ryanshahine]

@AlexHerman1

Unfortunately this still appears to be unresolved on my side.

I am currently testing with the latest MetaMask version (v13.22.0) and still receive the phishing warning when visiting user pages such as mine: https://portrait.so/ryan

The warning does not appear on the root domain (https://portrait.so), only on pages under portrait.so/[username].

For context, Portrait has been operating since 2022 and hosts user profile pages. These pages only render user uploads that are restricted to images and videos; no executable scripts or arbitrary HTML from users are served.

User media is fetched from decentralized storage networks (IPFS, Irys, Arweave) through gateways, and historically we have seen false positives when specific gateways were flagged even though the actual site content itself is benign. We also run our own proxied gateways that may be flagged.

If there is a specific rule or upstream list still causing the warning, I’d be happy to help investigate further.

This PR would whitelist Portrait #229215, which would solve these issues.