From b54f78b5dc595a49cb18783de582ab62fe347889 Mon Sep 17 00:00:00 2001 From: bobvasic Date: Mon, 19 Oct 2026 13:41:19 +0200 Subject: [PATCH 1/2] Add ccreator.io (wallet drainer) and solmint.net (impersonates Solmint) ccreator.io serves a bare wallet-connect page loading the walletadapter-cdn-cloud.com drainer kit (PhishDestroy: malicious, sinkholed). solmint.net is the same operator's current site, trading on the name of Solmint (solmint.dev) since 2025-08-22. Reported by RaptorLabs, operator of solmint.dev. --- blocklist.yaml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/blocklist.yaml b/blocklist.yaml index 741f0d1c..0ac3e160 100644 --- a/blocklist.yaml +++ b/blocklist.yaml @@ -2319,3 +2319,7 @@ - url: pumpp-fun.pages.dev - url: phantom-restorewalletteamdesk.webflow.io - url: dextoolwallets.on.fleek.co + - url: ccreator.io + description: Wallet drainer. Bare "Connect Wallet" page (/?app=spoodle) loading the walletadapter-cdn-cloud.com drainer kit (PhishDestroy - malicious, sinkholed) via blank-ckd.pages.dev/blank.js, with a visit beacon and a geo-IP check. Former domain of the operator of solmint.net. Reported by RaptorLabs, operator of solmint.dev. + - url: solmint.net + description: Impersonates Solmint (solmint.dev) - registered 2025-08-22, two days after the operator's business proposal to Solmint was declined; his product "ccreator.io" was renamed "Solmint.net"; page title "Solmint - Solana Token Creator"; the sister domain ccreator.io serves a wallet drainer. Reported by RaptorLabs, operator of solmint.dev. From cf6fc224eb94a20f46832c68befeb8a4c751db74 Mon Sep 17 00:00:00 2001 From: bobvasic Date: Mon, 19 Oct 2026 19:18:45 +0200 Subject: [PATCH 2/2] Reword solmint.net entry: ccreator.io is the operator's former domain Claude-Session: https://claude.ai/code/session_01AwFPBizE1rWQq2SGcsHRhx --- blocklist.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/blocklist.yaml b/blocklist.yaml index 0ac3e160..62d06d95 100644 --- a/blocklist.yaml +++ b/blocklist.yaml @@ -2322,4 +2322,4 @@ - url: ccreator.io description: Wallet drainer. Bare "Connect Wallet" page (/?app=spoodle) loading the walletadapter-cdn-cloud.com drainer kit (PhishDestroy - malicious, sinkholed) via blank-ckd.pages.dev/blank.js, with a visit beacon and a geo-IP check. Former domain of the operator of solmint.net. Reported by RaptorLabs, operator of solmint.dev. - url: solmint.net - description: Impersonates Solmint (solmint.dev) - registered 2025-08-22, two days after the operator's business proposal to Solmint was declined; his product "ccreator.io" was renamed "Solmint.net"; page title "Solmint - Solana Token Creator"; the sister domain ccreator.io serves a wallet drainer. Reported by RaptorLabs, operator of solmint.dev. + description: Impersonates Solmint (solmint.dev) - registered 2025-08-22, two days after the operator's business proposal to Solmint was declined; his product "ccreator.io" was renamed "Solmint.net"; page title "Solmint - Solana Token Creator"; his former domain ccreator.io now serves a wallet drainer. Reported by RaptorLabs, operator of solmint.dev.