[AdrianPinCar]

Summary

Adds zzig-ecosystem.xyz to the bottom of blocklist.yaml — a verbatim clone of zig.finance weaponised with a cryptocurrency wallet drainer that explicitly targets Phantom. We operate zig.finance (ZIG Finance / ZIGChain); this PR comes from our organisation account.

Verified live at 2026-11-11T22:17:33Z (HTTP 200).

Why it should be blocklisted

The site is a byte-level copy of our website, so a user has no visual cue that anything is wrong. It serves 49 asset paths with content hashes identical to our private build output, reproduces our partner logos, and its own metadata still points at us:

• og:url → https://zig.finance/
• og:image → https://zig.finance/_astro/og-default.UPA9kI21.png (hotlinked from our servers)
• JSON-LD @id → https://zig.finance/#organization, with sameAs listing our genuine X, Telegram, Discord and LinkedIn accounts
• robots: index, follow — it is actively seeking search placement under our brand, and is already being cited by AI assistants as a source about ZIG Markets

The payload

Our /_astro/a.DOZ8M58m.js is replaced by an injected script:

https://zzig-ecosystem.xyz/chunk.34.mvjmscet.js
sha256  5bbc9801f1ecd98dcfb6bcad6a490f98d2cc77f2a490c19512f7201366db669f
size    17079 bytes
last-modified  2026-10-26 18:52:42 GMT  (the same day the domain was registered)

Static analysis only — we did not execute it:

• Phantom is directly targeted (7 references), alongside MetaMask, through EIP-6963 provider discovery
• Destination address, base64-obfuscated in the source: 0x623f65e5945c0fecf8f68ff9d98ce56fece6bc6a
• Chain: Base, via a hardcoded RPC pool (mainnet.base.org and five others)
• Method: permit signature flows to capture token approvals rather than prompting a transfer
• Exfiltration: encrypted via crypto.subtle; enumerates IndexedDB object stores
• Evasion: navigator.webdriver, headless detection, plus plugin / device / memory / network fingerprinting, so it stays dormant for crawlers and scanners

Registration

Registrar    Eranet International Limited (IANA 1868)
Registered   2026-10-26T21:09:51Z
Nameservers  pola.ns.cloudflare.com, ridge.ns.cloudflare.com

Also submitted to MetaMask's eth-phishing-detect, and reported to Cloudflare, the .xyz registry, Eranet, and Google Safe Browsing.

Summary by CodeRabbit

• Security Updates
  • Added a reported site impersonating a legitimate finance service to the blocklist. This update helps protect users from the site, which is reported to target cryptocurrency wallet users. The listing records the reported impersonation and targeting behavior so the site can be recognized by the blocklist.

[coderabbitai]

No actionable comments were generated in the recent review.

Walkthrough

The blocklist adds zzig-ecosystem.xyz and describes it as a reported clone of zig.finance that targets Phantom and MetaMask wallets through EIP-6963 provider discovery.

Changes: Domain blocklist

Layer / File(s)	Summary
Add reported clone domain blocklist.yaml	Adds zzig-ecosystem.xyz with a description of the reported clone, its wallet targets, and its provider-discovery method.

Change: Other

Merge Risk: Minimal · up to e67de

This adds one reported phishing-clone domain to the blocklist. No code behavior changes, and no actionable merge risk remains beyond the normal check that the domain is correct.

Architecture risk: Low · up to e67de

The change affects 1 system.

Changed systems: blocklist.yaml

Architecture concerns
No architecture-level concerns identified.

Review details

Systems and components

• observed — blocklist.yaml (service) was modified; 1 changed file maps to changed impact.

Before / after behavior

• observed — Modified behavior in blocklist.yaml: Adds zzig-ecosystem.xyz to the blocklist with a description of the reported clone and its wallet targets and provider-discovery method.

Pre-merge checks: 4

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title names the domain added to blocklist.yaml and identifies it as a ZIG Finance clone that serves a Base wallet drainer targeting Phantom. The raw summary confirms the only change is a two-line …
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Title check

Explanation

The title names the domain added to blocklist.yaml and identifies it as a ZIG Finance clone that serves a Base wallet drainer targeting Phantom. The raw summary confirms the only change is a two-line addition of zzig-ecosystem.xyz to blocklist.yaml, with a description calling it a clone of zig.finance that targets Phantom and MetaMask. The title's main point matches the change. It is long at 90 characters, but it stays specific and on topic.

Finishing Touches

Generate unit tests (beta)

• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Recent review info

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 44c49b57-f39b-483f-a82e-1052b23ce257

Commits

Reviewing files that changed from the base of the PR and between 5030186 and e67de97.

Files selected for processing: 1

• blocklist.yaml

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.