The detector is about twenty (inefficient) lines. Cauctus was flagged because it's similar "cactus" is similar to "auctus", which is on their known good list of domains they're checking for impersonations of.

https://github.com/MetaMask/eth-phishing-detect/blob/master/...