Eighteen drainers. One engine. A buyer who is not the builder.

We did not create this cluster. It was already there, one of 80,000 the platform already holds. We opened one of them. The technical paper is the proof of what was inside. Yesterday we walked the ClickFix hallway: two malware doors, twenty-one hosts behind them. Today we open the other door that looked like eighteen separate thefts.

Inside the same corpus of 1,585, we classified 18 domains as cryptocurrency wallet drainers. They look like eighteen attacks. They are not. The lure is rebuilt for each campaign. Under it, a small number of reusable drainers, bought from other people and reskinned. The trail that proved the split was a misconfiguration: one host left its kit on the open web.

The 18 domains sit with the bank lures, the ticket shops, and the ClickFix hallway. Same nexus. Same cluster we did not invent. The August 2026 domain list is the IoPA CSV on Malanta's public GitHub. Hashes, wallet-project ids, and the rest of the indicator set are in the technical paper.

What the victim is offered

Six of the eighteen pretend to be security or developer tooling. Analyzr: "Decode Every Token." DevWatch: "Read every EVM token before you ape." LaunchTool: a no-code Solana token creator. The pitch is aimed at the person who learned to inspect a contract before buying. The tool then asks them to connect a wallet.

These are not thin landing pages. analyzr[.]live is 1.2 MB. povtrader[.]world is 6.9 MB. One capture in our notes is 3.5 MB and does not name its host, so we are not assigning it. An IOC feed will eventually list some of these names, after wallets have been connected. The earlier signal was already in the corpus when we opened the cluster: the eligible / allocation / 2x naming family, and the kit atoms that repeat under different skins.

Two engines under the skins

CJK-function VM. The page builds code at runtime through Function() calls whose source is dense with CJK-range Unicode. The visible script is an interpreter for an encoded stream. We found it on five domains, across four kit builds: sptf-prom[.]com, sptf-promo[.]com, interest-lienfi[.]com, memedex[.]life, memedex[.]today. A similar technique showed up in a MetaMask eth-phishing-detect issue in May 2026. We looked for overlap with this cluster and did not find it. Same class of trick. Not this operation, on the evidence we have.

interact-button. A fixed class name fires the drain. The wallet interaction sits in a separate iframe. We saw it on news-ondofinance[.]com, and as className: "interact-button" inside the kit we pulled off listedokx[.]net. The same string is in a public drainer-builder tutorial on GitHub. A match, by itself, does not put a domain in this corpus. We required the cluster relationship as well. That relationship was already there. We did not create it for the page.

On Solana, the drain runs through signAllTransactions. The victim approves what looks like one action and signs a batch. On EVM chains, the path is token approvals and Permit2. The complete EVM drainer we recovered, testtestb[.]live, is a fake bridge: approve_request, sign_next, swapExactETHForTokens, Permit2, the Uniswap V3 Quoter, and token lists for Ethereum, Optimism, BNB Chain, Polygon, Arbitrum, Avalanche, and Base. There is no hardcoded recipient. The 0x values in the code are token or router contracts. The destination is fetched per victim. backtesttestb[.]live and backtesttesta[.]live are the hosts that supply it.

That per-victim fetch is why blocking one recipient address does not end the kit. The address is not in the lure. It arrives later. Taking down one lure raises the operator's cost by the price of the next domain. It does not remove the engine.

The directory listing that split builder from buyer

Most kit work starts from the outside. We see the lure, we read the JavaScript the browser received, we infer the rest. listedokx[.]net skipped that. Apache was serving Index of / at the web root.

Timestamps on the artifacts run from January through June 2026. Months of the product, sitting on a server that also sits in the cluster we opened. Those months are kit staging. An IOC on a lure hostname arrives after a wallet connects. The IoPA is membership and kit atoms before Delivery.

The plaintext block is the buyer's control panel. hideChanges suppresses the estimated transaction changes. The comments say that also introduces a simulation error. spoofPrompt changes what the transaction appears to be. minValue is the smallest wallet worth draining. targetWallet is described as the buyer's "split wallet." Other switches cover an airdrop pretext and interference with the wallet's own simulation warnings.

A small injector waits until the host page has rendered, looks for the expected button class, and only then loads the drainer. The lure can change every campaign. The engine does not.

vote/ held 14 directories named after Solana token mints. Twelve end in pump. Each directory is a small page posing as a token vote or a verification step, OKX branding, a reward for taking part. Not one generic page with the token as a parameter. A URL per community. The operator picks a token, generates the page, and circulates a link that looks specific to holders of that asset. The vote is the reason to connect the wallet.

How this attaches to the 1,585: listedokx[.]net is a member of the corpus, not a random open directory we stumbled onto. The same nexus that holds the empty seed and the German banking names holds the kit the buyers configure. Preventing access to one lure, once it is an IOC, leaves the engine and the next reskin untouched. That is the same lesson as the technical paper: capability is a product. A taken-down hostname is a line item.

EasyRug is the product, and it is not ours

On sptf-prom[.]com and sptf-promo[.]com we found the EasyRug brand, mirrors of easyrug[.]lol, advertised as "the #1 Rug Pull Tool on Solana." The site, the JavaScript, and the Telegram presence describe a service: tooling to create tokens, attract victims, and take a cut. We excluded EasyRug from the factory counts. It predates this corpus. Including it would have inflated a count that belongs to the cluster we opened, not to a third-party service that cluster consumes.

The website fakes its own bustle. generateRandomContract() invents contract addresses. generateRandomGain() invents +NN% profit figures. A ticker cycles them so the service looks busy. connectWallet calls the CJK-VM drainer through mushswap[.]org. An origin at 144.31.40[.]248 served the page directly over HTTPS, nginx/1.18.0 on Ubuntu, without the CDN layer we saw elsewhere. When we looked, urlscan had no results for that IP, for easyrug[.]lol, or for mushswap[.]org.

The Telegram channel was created in December 2024 and started publishing in March 2025, about eight months before this factory's first observed registration in November 2025. That chronology is why we call EasyRug an established third party that this operation consumes, not a brand the factory invented.

The main channel held 15 messages from 22 Mar 2025 through 13 Aug 2026. One look put the membership near 4,500. Another pass put it near 4,300. We are not treating either number as a customer count. Giveaways advertised on the channel were $500, two $10 SOL prizes, and a $4,500 draw. Instagram accounts easyrug_off and easy_.rug_ were promoted. A clipper program offered pay per 1,000 views. Those figures are EasyRug's own claims. We did not audit the payouts.

In March 2025 the channel advertised the service as free in exchange for 25% of users' profits. In February 2026 it announced the fee had dropped from 25% to 15%. loader.js calls targetWallet "your split wallet." EasyRug V2 advertises "Autosplit + Autopayout." Our stronger reading: the drainer is the product being sold, monetized by a percentage. We do not have evidence that EasyRug is secretly draining its own buyers.

The site is built to look like a product people log into. We counted 39 references to login, 11 to password, nine to register, and six to username, plus a login overlay. A token-creation form asks for a coin name, a ticker, decimals, a description, a website, a Twitter/X account, and a Telegram URL. Decimals default to 9, a common Solana SPL convention. A May 2026 roadmap post describes planned Claude-powered token creation, including images and descriptions. We found no evidence that the Claude integration was built.

Russian-language comments show up in this kit. Some of them are vendor-to-customer notes, not the operator talking to themselves. We separated those in the technical paper. A Cyrillic string inside a purchased drainer tells us about the seller. It does not hand us a named group.

The Bottom Line

Eighteen domains looked like eighteen thefts. The open directory on listedokx[.]net showed one engine, a buyer configuration in plaintext, and a lure that can be swapped without touching the drain. EasyRug is older than this factory, sold as a service, and kept out of our domain counts on purpose.

An IOC on a single drainer hostname arrives after a wallet connects. The IoPA is the kit atom, the naming family, and the fact that the next reskin will land in the same corpus before Initial Access-style theft and before a feed agrees it is malicious.

We opened one cluster out of 80,000. We did not invent the nexuses inside it. That is the proof of what sits behind AI-Powered Threat Intelligence.

Technical paper and indicators: The Anatomy of a Russian-Speaking Cybercrime Cluster. ClickFix hallway: Two malware domains. Twenty-one hosts behind them.. Domain corpus: Malanta's public GitHub.