sunsetCase studyBrowser extension · 2017–2020
Ether
I built EtherAddressLookup (EAL) in June 2017. It started small: find anything on a page that looks like an Ethereum address and turn it into a link to your favourite block explorer.
Phishing sites were stealing private keys at the time, so a month later it got a domain blacklist. On a listed domain, EAL wiped the page and showed a warning instead. At its peak it had 120k active users, and it pioneered phishing domain protection in crypto. MetaMask, and then other wallets, later adopted the idea.
EAL Warning
ATTENTION
We have detected the domain to have malicious intent and have prevented you from interacting with it.
This domain is blocked because it is on our blacklist.
- Links sent to you unprovoked are often malicious.
- Nobody is giving away free money.
- active users at the peak
- 120k
- users in the best archived snapshot (Jun 2018)
- 113,808
- domains on the blacklist
- 14,939
- releases, v1.1 to v1.23.1
- 43
- commits
- 4,503
- contributors
- 67
Nine years on the Web Store
User counts from 45 archived copies of the Chrome Web Store listing, from December 2017 to March 2026.
Show the snapshots
| Snapshot | Users | Version | Rating |
|---|---|---|---|
| 24 Dec 2017 | 55,624 | 1.13.2 | 4.95 (38) |
| 6 Apr 2018 | 109,597 | 1.14.3 | 4.75 (61) |
| 11 May 2018 | 112,991 | 1.16 | 4.7 (70) |
| 11 Jun 2018 | 113,808 | 1.17 | 4.6 (77) |
| 5 Jul 2018 | 112,714 | 1.18.2 | 4.57 (84) |
| 2 Aug 2018 | 107,528 | 1.18.2 | 4.56 (88) |
| 22 Sep 2018 | 104,997 | 1.18.2 | 4.58 (92) |
| 30 Apr 2019 | 92,346 | 1.22 | 4.59 (96) |
| 11 May 2019 | 91,664 | 1.22 | 4.59 (96) |
| 24 Jun 2019 | 87,890 | 1.22 | 4.59 (95) |
| 24 Jul 2019 | 82,844 | 1.22 | 4.59 (95) |
| 18 Aug 2019 | 80,264 | 1.22 | 4.59 (95) |
| 17 Sep 2019 | 80,884 | 1.22 | 4.59 (95) |
| 16 Oct 2019 | 78,549 | 1.22 | 4.59 (95) |
| 22 Nov 2019 | 76,298 | 1.22 | 4.59 (95) |
| 27 Apr 2020 | 70,000+ | 1.23 | 4.59 (96) |
| 1 Jul 2020 | 60,000+ | 1.23 | 4.59 (96) |
| 22 Oct 2020 | 60,000+ | 1.23.1 | – |
| 9 Nov 2020 | 60,000+ | 1.23.1 | – |
| 3 Dec 2020 | 60,000+ | 1.23.1 | – |
| 20 Jan 2021 | 60,000+ | 1.23.1 | – |
| 3 Feb 2021 | 60,000+ | 1.23.1 | – |
| 18 Apr 2021 | 60,000+ | 1.23.1 | – |
| 11 May 2021 | 60,000+ | 1.23.1 | – |
| 1 Jun 2021 | 60,000+ | 1.23.1 | – |
| 4 Aug 2021 | 50,000+ | 1.23.1 | – |
| 27 Sep 2021 | 50,000+ | 1.23.1 | – |
| 19 Oct 2021 | 50,000+ | 1.23.1 | – |
| 6 Dec 2021 | 50,000+ | 1.23.1 | – |
| 8 Jan 2022 | 50,000+ | 1.23.1 | – |
| 5 Apr 2022 | 50,000+ | 1.23.1 | – |
| 18 May 2022 | 50,000+ | 1.23.1 | – |
| 7 Aug 2022 | 40,000+ | 1.23.1 | – |
| 25 Sep 2022 | 50,000+ | 1.23.1 | – |
| 2 Oct 2022 | 50,000+ | 1.23.1 | – |
| 28 Nov 2022 | 40,000+ | 1.23.1 | – |
| 3 Feb 2023 | 40,000+ | 1.23.1 | – |
| 1 Jun 2023 | 40,000+ | 1.23.1 | – |
| 22 Sep 2023 | 40,000+ | 1.23.1 | – |
| 4 Dec 2023 | 40,000+ | 1.23.1 | – |
| 26 May 2024 | 40,000+ | 1.23.1 | – |
| 14 Dec 2024 | 40,000+ | 1.23.1 | – |
| 22 Apr 2025 | 30,000+ | 1.23.1 | – |
| 11 Oct 2025 | 20,000+ | 1.23.1 | 4.5 (98) |
| 4 Mar 2026 | 20,000+ | 1.23.1 | 4.5 (97) |
What it did
EAL kept growing for three years. These are the parts I'd point to, each with the code that ran it.
Address links
A content script walks the text on every page and matches three patterns: a 0x address, an ENS name, and an ENS name with hidden zero-width characters. Each match becomes a link to the block explorer you picked in the settings.
- Page textwalk text nodesRegex
- Regex0x + 40 hex, or .ethEAL
- EALwrap in a linkBlock explorer
// Register RegEx Patternsthis.regExPatterns = [ // Ethereum Address Regex /(^|\s|:|-)((?:0x)[0-9a-fA-F]{40})(\s|$)/gi, // ENS Address Regex /(^|\s|:|-)([a-z0-9][a-z0-9-.]+[a-z0-9](?:\.eth))(\s|$)/gi, // ENS With ZWCs /(^|\s|:|-)([a-z0-9][a-z0-9-.]*(\u200B|\u200C|\u200D|\uFEFF|\u2028|\u2029|‌|‌)[a-z0-9]*(?:\.eth))(\s|$)/gi];And more
- v1.12Hover stats ↗Hover a linked address to see its ETH balance and transaction count, read from a node.
- v1.22Mini block explorer ↗Paste an address or transaction hash into the popup and get a readable summary.
- v1.6Bookmarks ↗Your own trusted links at the top of the popup, six preloaded.
- v1.9 · v1.11ENS checks ↗ENS names became links, and names hiding zero-width characters were flagged.
- v1.13Third-party lists ↗Optional blacklists from iosiro and Segasec, then PhishFort in v1.19.
- v1.17Address labels ↗Name an address once and see the label wherever it appears.
- v1.23Page-level blocks ↗Block a domain plus path, for YouTube livestream scams.
Phishing protection spreads
The EAL blacklist didn't stay inside EAL. MetaMask started its own phishing detector in August 2017, and two days later it was testing against the EAL lists. Four days after that, the EAL README said the lists served both extensions.
These dates come from the public commit history of both repos. That other wallets adopted the approach later is my own account.
- EtherAddressLookup
Ships a domain blacklist in v1.3. On a listed domain, EAL wiped the page and showed a warning instead.
EtherAddressLookup, 7 Jul 2017: Source ↗ - MyEtherWallet
Taylor Monahan adds to the EAL README that its blacklists serve both EAL and MetaMask. The README names @409H and MyEtherWallet as the blacklist's maintainers.
MyEtherWallet, 8 Aug 2017: Source ↗ - EtherAddressLookup
v1.13 adds optional third-party lists from iosiro and Segasec. PhishFort followed in v1.19.
EtherAddressLookup, 12 Dec 2017: Source ↗
blacklists/domains.json at the last commit of each quarter. The dip in September 2017 is a clean-up that removed www. duplicates. The jump in February 2018 is two batches of lookalike MyEtherWallet and MyCrypto domains.From launch to removal
Every entry links to its release, commit or archived page.
Retired with Manifest V2
The last release, v1.23.1, came out in August 2020. Chrome moved extensions to Manifest V3, and I never migrated EAL off Manifest V2, so it was removed from the Chrome Web Store. The code, the blacklists and the whole history are still on GitHub.
v1.23.1 final
the last version on the Web Store
- Store "Updated"
- 4 Sep 2020
- Manifest
- Version 2
- Last archived listing
- 20,000 users
Sources: the EtherAddressLookup repo (314 stars, 276 forks, commits from 19 Jun 2017 to 1 Sep 2022), its release notes, MetaMask's eth-phishing-detect history, and Wayback Machine copies of the Web Store listing, checked on 28 Oct 2026. Code snippets are from the last commit. Screenshots are from the release notes.
