Request Blocked — antalpha.com (Nasdaq-listed company) flagged, but not present in phantom/blocklist

[easonhu-lang]

Summary

Phantom shows a full-screen red "Request Blocked — This dApp may be malicious" interstitial for antalpha.com, which blocks wallet connection for our users.

We are not an anonymous new project: antalpha.com is the official website of Antalpha, a company listed on Nasdaq (ticker: ANTA).

What we checked before posting

The domain does not appear on any public feed that commonly drives wallet warnings:

Source	Result
phantom/blocklist → blocklist.yaml (current master)	not present
ChainPatrol /api/v2/asset/check	UNKNOWN (not BLOCKED)
eth-phishing-detect	UNKNOWN
GoPlus Security	phishing_site: 0

Since this repository's list does not contain our domain, the block appears to originate from in-house / Blowfish scanning rather than the community list.

About the dApp

antalpha.com hosts "Nina", a subscription AI research assistant for market data. Wallet interactions are limited to standard, user-initiated swaps that the user reviews and signs individually. We do not request blanket token approvals, do not use setAuthority or account-close instructions, and nothing executes without an explicit user signature on a fully simulated transaction.

Identity / verification

• Public listing: Nasdaq: ANTA
• Google Play (Android app "Antalpha AI"): com.antalpha.ai
• X: @antalpha_ai
• Discord: discord.gg/antalpha-ai
• Support contact: nina@ai.antalpha.com
• DNS TXT domain-ownership verification and corporate registration documents available on request.

We have read #320, #423 and #426, and the maintainer guidance to work through review@phantom.com. We have already sent a full report to that address. Posting here as well for visibility, since those threads suggest the email queue can be slow.

Ask

1. Can a maintainer confirm which system is producing the block for antalpha.com?
2. If a specific transaction construction triggered it (the signAndSendTransaction advice given in dApp - Request Blocked - dApp May Be Malicious #426), please confirm and we will implement it.
3. If a reported phishing clone impersonating antalpha.com caused the legitimate domain to be flagged by mistake, please let us know — we would like to submit the fraudulent domain for blocking.

Related

Our transaction signing pages are served from *.metalpha.fund (e.g. auth.ai.metalpha.fund), also under our control, and currently show the yellow "This domain is new" notice. We would like to register these domains as well — please advise on the correct process.

Example

https://antalpha.com

Steps to Reproduce

1. Open https://antalpha.com in a browser with the Phantom extension installed
2. Connect Phantom
3. The red "Request Blocked — This dApp may be malicious" interstitial appears and wallet interaction is blocked

Observed on the Phantom browser extension; exact version available on request.

Phantom Version

No response

Is there an existing discussion for this?

• I have searched the existing discussions

[Th3Ya0vi]

Please follow our domain and transaction warnings guide, including the linked review form if you need further assistance. Thanks!