Hosted Solana wallet drainer kit behind token-checker, airdrop and trading look-alikes (hunting rule)

Backend hosts the drainer script was served from: delegate-plenty.data-repo[.]cc, aluminum-ramble.data-repo[.]cc, mushy-scurvy.data-repo[.]cc, prowler-written.web-dist[.]cc, dribble-distaste.asset-base[.]cc, pengu-as.wallet-secure[.]click, keep-sandbar.defex[.]cc, hardship-outsource.defex[.]cc and dallying-reveler.fontmaxplugin[.]cc; pengu-as.wallet-secure[.]click and dallying-reveler.fontmaxplugin[.]cc were still serving it at the end of October 2026. The backend domains data-repo[.]cc, web-dist[.]cc, asset-base[.]cc and app-services[.]cc were registered on the same day (2 May 2026); defex[.]cc and fontmaxplugin[.]cc earlier, at the same registrar. Lure families: check-<random>.devwatch<word>.<cheap TLD> ('DEVWATCH — Analysis' token pages), listing-<random>.orbitrelay<word>.<TLD>, memescandata.<TLD>, pump.fun stream look-alikes on netlify.app and .pro domains, pumpswap.<TLD>, photonsol.live / photontrade.lol, airdrop and allocation pages on netlify.app, and sol-twint[.]icu (a Polymarket copy). The script's own configuration is encrypted per request, so the receiving wallets are not visible in it; the code match is the reliable signal. The backend domains share their registrar, naming and registration days with infrastructure published for the 'Rublevka Team' crypto drainer operation, and fontmaxplugin[.]cc is listed in that report; parsley-provolone.commontechrepo[.]cc, a backend host of the same shape from that report, is tracked here too.