Investigation · April 2026

NameSilo Is Protecting xmrwallet[.]com

A US ICANN-accredited registrar publicly defended a 10-year, ~$20M Monero drainer. They denied receiving 20+ delivery-receipted abuse reports. They committed, in writing, to scrubbing the operator's VirusTotal record. When we proved every word of their statement was false, they used paid X Gold Checkmark support to lock our research account. The connection is on the public record — they put it there themselves.

~10years live
$10M-$20Mest. stolen
20+ignored abuse reports
4 / 4false claims in statement
3 / 4registrars suspended
10SHA-256 fingerprinted exhibits

By PhishDestroy Research · Filed with ICANN Contractual Compliance, March 18, 2026 · Skip to evidence

1 · The connection — they put it on the public record themselves

A scammer running a ten-year crypto drainer, on $550-a-month bulletproof hosting in Belize, behind Russian DDoS-Guard, wrote to abuse@phishdestroy.io on February 17, 2026:

"Feel free to subpoena the domain registrar for my information."

— operator of xmrwallet[.]com, in writing, three weeks before NameSilo published their defense

Twenty-four days later, on March 13, 2026, that same registrar — NameSilo — published an official tweet calling him "the victim" of an alleged compromise, denying 20+ abuse reports ever arrived, and committing publicly to helping him scrub his VirusTotal detections.

Three other registrars holding the same domain (PublicDomainRegistry, WebNic, NICENIC) looked at identical evidence and suspended in days. NameSilo wrote a press release for him. The connection is not inferred. It is stated, by both sides, in writing.

NameSilo's official corporate Twitter account publicly defending xmrwallet.com on March 13, 2026, calling the domain compromised, denying prior abuse reports, and committing to remove VirusTotal detections.
NameSilo's tweet, March 13, 2026. Permanently archived: ghostarchive.org/archive/CXXZ0 · SHA-256: ad29e1d3d4803ff37c88ef860bef6de9e62f6ce533657f2e5c5460eb2e0b8ebf
Identical evidence, four registrar responses
RegistrarActionTime to action
PublicDomainRegistry (PDR)SuspendedDays
WebNicSuspendedDays
NICENICSuspendedDays
NameSiloPublic defense + offer to scrub VirusTotalNever

The variable is not the evidence. The variable is the registrar.

Read the full connection chain on GitHub →

2 · The lies — every sentence of the March 13 statement, taken apart

NameSilo's official statement was four sentences. Four falsehoods. Not "differently interpreted." Not "out of date." Not "a misunderstanding." False.

Claim 1 — "Domain was compromised a few months ago."

The theft code is the website. Eight PHP endpoints, server-side session_key exfiltration, base64 transmission of the operator's private view key to operator infrastructure. It has been the website from day one, for ~10 years. NameSilo provided no forensic indicator of any compromise — because there was none.

→ FALSE.

Claim 2 — "Prior to that, we had received no abuse reports."

PhishDestroy alone submitted 20+ delivery-receipted abuse reports through NameSilo's own portal between 2023 and 2026. The receipts have been forwarded to ICANN Contractual Compliance. Either NameSilo's intake system is broken, or the public statement was knowingly false. Both are disqualifying.

→ FALSE.

Claim 3 — "After an extensive review… not involving the registrant."

The operator wrote to us first, on Feb 16, 2026, defending the site as his own work. He never claimed a hack. NameSilo's "review" therefore adopted a framing the operator himself never advanced — meaning either the review didn't ask him, or it adopted a third-party narrative NameSilo hasn't named.

→ FALSE.

Claim 4 — "Working with the registrant to remove the website from VT reports."

This is the most damning sentence in the tweet, and the one NameSilo did not technically lie about — they actually wrote it, and they meant it. A registrar publicly committing to dispute the threat-intelligence findings of every authoritative vendor on a confirmed drainer is not abuse handling. It is active obstruction of consumer-protection telemetry on behalf of a confirmed thief.

→ STATED. AS WRITTEN. DAMNING.

Read the full line-by-line breakdown on GitHub →

3 · The pressure campaign — they're still doing this, right now

The moment we replied to the public statement with the operator's own emails, the silencing started. It hasn't stopped.

Confirmed silencing attempts, dated
DateWhatStatus
2026-03-13NameSilo publishes the four-claim defenseLive, archived
2026-03-16@Phish_Destroy posts the receipts and tags NameSiloTweets now invisible (account locked)
2026-03-18Case forwarded to ICANN Contractual Compliance + law enforcementOn record
2026-03-??@Phish_Destroy permanently locked on X via Gold Checkmark live-support channelStill locked
2026-04-15X automation reviews the appeal: "no violation, restored to full functionality"Lock not lifted; subscription still billed
OngoingBing search delisting attempts targeting phishdestroy.ioTracked; evidence file in preparation
OngoingDDoS targeting phishdestroy.io, source-IPs correlate with NameSilo's "njan la" reseller infrastructureMitigated; analysis publishing on phishdestroy.io

Email #1 from X Support — the lock

"Our support team has determined that a violation against inauthentic behaviors [occurred]. We will not overturn our decision."

No tweet quoted. No specific rule cited. No example. That is not what an automated rule trigger looks like. That is what a human-agent decision looks like, after a complaint.

Email #2 from X Support — the contradiction

X Support email body, April 15 2026: 'Our automated systems have determined there was no violation and have restored your account to full functionality.' X Support email subject line: '[4] Your account has been restored', April 15 2026.
X's own automation, on appeal, April 15 2026: "no violation, restored to full functionality." The lock is still in place. Either a human agent overrode the machine, or X is sending false restoration notices to paying subscribers. Either reading is the same conclusion: concierge censorship that you can buy.

Read the full pressure-campaign timeline on GitHub →

4 · Evidence index — ten exhibits, fingerprinted

Every screenshot below is verbatim, unedited, and SHA-256-fingerprinted. Verify with sha256sum -c EVIDENCE_HASHES.txt against the GitHub mirror. Each image is published under the explicit evidentiary-use grant in the LICENSE: any victim, prosecutor, regulator, or court may attach these as exhibits without further authorization.

Email from N.R., the xmrwallet.com operator, on February 16, 2026, asking PhishDestroy to remove the abuse report. The operator denies any phishing and never claims a hack.
§1 · Feb 16, 2026. Operator's first email — defending the code as his own work, asking PhishDestroy to retract the report. He never claimed a hack.
PhishDestroy's same-day technical reply to the xmrwallet.com operator, documenting eight PHP endpoints of server-side key exfiltration and warning that escalation depends on the operator's response.
§1 · Feb 16, 2026. PhishDestroy's same-day reply — full technical breakdown plus the explicit warning: "What happens next depends entirely on how you choose to proceed."
NameSilo's official Twitter account publishing a four-claim defense of xmrwallet.com on March 13, 2026.
§3 · Mar 13, 2026. NameSilo's official statement. Four sentences, four falsehoods. GhostArchive copy.
@Phish_Destroy tweet from March 16 2026: '@NameSilo is lying'.
§4 · Mar 16, 2026. Direct accusation, citing the operator's own emails as proof.
@Phish_Destroy thread from March 16 2026: NameSilo is acting as press secretary for a $2M+ Monero theft operation.
§4 · Mar 16, 2026. The framing that put NameSilo on notice — and tipped the registrar into using paid X support to silence the account.
@Phish_Destroy: 'Honest question for @NameSilo: Who is this operator to you? Employee? Contractor? Friend of support staff? Relative?'
§4 · Mar 16, 2026. The relationship question put to NameSilo, in public — never answered.
@Phish_Destroy quoting CryptOpus thread from February 22 2026: XMRWallet was reportedly shut down after operating for over a decade as a fraudulent Monero wallet, with $10M+ in user funds stolen.
§4 · quote of Feb 22, 2026. Third-party reporting predates PhishDestroy's investigation by weeks — independently contradicting NameSilo's "no abuse reports received" claim.
X Support email of April 15 2026: 'Our automated systems have determined there was no violation and have restored your account to full functionality.'
§6 · Apr 15, 2026. X's automation cleared @Phish_Destroy in writing. The lock is still in place anyway.
Subject line of the same X Support email: '[4] Your account has been restored', April 15 2026.
§6 · Apr 15, 2026. Subject line of the same email — confirming the body in X's own metadata.
PhishDestroy Threat Intelligence Platform: 350,000+ malicious domains scanned, 54+ trusted partners.
§9. The actual operation NameSilo's takedown was aimed at — not a hobbyist account.

Full evidence index with descriptions and SHA-256 hashes →

5 · For victims of xmrwallet[.]com

If you have lost funds to xmrwallet[.]com, this evidence package is yours. No further authorization required from PhishDestroy. Take it. File it. Attach it.

Direct contact

report@phishdestroy.io

Confidential intake. Bring the dates and the wallet address you used. Do not post wallet addresses or transaction IDs in public Issues.

Open a case on GitHub

Victim Report template →

Issues marked victim are triaged privately and won't be made public without your consent.

Official complaint channels

6 · For ICANN, regulators, journalists

The full case file was forwarded to ICANN Contractual Compliance on March 18, 2026. This page is the public mirror of that filing, with the same screenshots, the same hashes, and the same explicit consent for republication.

Available on request to credentialed parties:

Contact abuse@phishdestroy.io with a subject line that identifies your role.

7 · Mirrors

This story is being kept alive in multiple places, intentionally:

Cut down one link. Five more grow back. We run on the Hydra principle.

Final word

We told the public, in advance, that NameSilo would try to silence us. We notarized that prediction in GhostArchive before the lock dropped. They did exactly what we said they would do.

And here is the article they were trying to prevent.

Scammers delete evidence. NameSilo defended one. X locked our account. The archive remains. The truth remains. We remain.