[robin-liquidium]

Adds two domains impersonating Liquidium, a Bitcoin lending protocol. Our only official domain is https://liquidium.fi. I'm the founder of Liquidium; we did not authorise either site.

liquidium.rest: phishing clone with an injected Solana wallet drainer

• What it is: a live reverse-proxy clone of https://liquidium.fi (built on the webrecorder/wombat replay engine). It uses our page title ("Liquidium Official Website | Native BTC-Backed Loans") and our content, plus two injected scripts that are not on our site.
• https://liquidium.rest/_waf/connect-kit.js: an obfuscated Solana drainer kit. It contains functions such as runFundsMigration, BuildPlan with splitDestinations (splits funds across 2–3 recipient addresses), portfolio valuation and spoofTransaction "with-sweep" transactions. Drain plans are fetched from POST https://liquidium.rest/rpc.
  • SHA-256 (fetched 2026-10-10): 01c57e12b7a7bccd10501b02d9b093d832b4be6837ec381fc15bf34ed237f641
  • The homepage still loads it as /_waf/connect-kit.js?id=…. Plain non-browser requests now get a 401, so the script appears to be gated.
• https://liquidium.rest/__/replay-inject.e823a81e7bdffb34cea7bbff1dc21ec76afd7827a20dca1501851251d50643ba.js: intercepts clicks on "Open App" and other outbound links and opens a fake "Connect wallet" modal (Phantom, Solflare, …) in place of our real app.
• Domain: registered 2026-09-27 via Spaceship, behind Cloudflare. It is promoted through paid Instagram ads and ranks on Google for "liquidium".

liquidium.fun: brand impersonation for an unaffiliated token

• Registered 2026-10-02 (Namecheap).
• Single-page site titled "LIQUIDIUM | Launchpad for Themed Bundle Launches". It promotes a pump.fun-style Solana token contract (FCbePQZCacRNmSRDK1Rd4WcoZWdLn5tE7NhzkqnUpump) with a "Copy CA" button and links to x.com/liquidiumsol.
• Liquidium has no Solana token and is not affiliated with this site or its token.
• To be clear, I found no wallet-connect or drainer code on this domain (checked 2026-10-10). It is included because it uses the Liquidium name to sell an unrelated token, which misleads our users. It appeared 5 days after the liquidium.rest drainer and also targets Solana users.

🤖 Generated with Claude Code

Summary by CodeRabbit

• Other
  • Added liquidium.rest and liquidium.fun to the blocklist.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: b766e4c1-ee82-4024-883e-30df1453990d

---

📥 Commits

Reviewing files that changed from the base of the PR and between 5030186 and 14e7658.

---

📒 Files selected for processing (1)

• blocklist.yaml

---

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

---

---

📝 Walkthrough

Walkthrough

The blocklist now includes liquidium.rest and liquidium.fun.

Changes

Blocklist domain additions

Layer / File(s)	Summary
Add domain entries blocklist.yaml	Adds liquidium.rest and liquidium.fun to the blocklist.

---

Priority: ➖ Normal

Change: Feature

Merge Risk: ⚪ Minimal · up to 14e76

Both domains are included in the generated blocklist when built, and the Pages workflow builds that data before preparing its artifact. No merge-blocking issue is established.

Architecture Summary

Architecture risk: 🔵 Low · up to 14e76

The change affects 1 system.

Changed systems: blocklist.yaml

Architecture concerns
No architecture-level concerns identified.

Review details

Systems and components

• observed — blocklist.yaml (service) was modified; 1 changed file maps to changed impact.

Before / after behavior

• observed — Modified behavior in blocklist.yaml: Added liquidium.rest and liquidium.fun as blocklist URL entries.

---

Pre-merge checks | 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly identifies the two domains added to the blocklist and states the reported impersonation of liquidium.fi. It accurately summarizes the main change.
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

---

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create a new PR

---

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

_{Comment @coderabbitai help to get the list of available commands.}