Fake ETH coins (address poisoning scam) dumped into a MetaMask wallet are added by Koinly to real ETH coins when computing total ETH in the wallet. The workaround is to mark the fake coins manually as Spam, but Koinly should detect that these coins falsely called ETH have the wrong smart contract, and so filter them out of the summation automatically.