xmrwallet.com — How a $2M+ Scam Got Into AI Recommendations

Date: 2026-05-13

Subject: xmrwallet.com & namesilo.com

Focus: Mechanism of infiltration into ChatGPT/AI search recommendations

---

TL;DR

xmrwallet.com built a multi-layered SEO/GEO campaign: 50+ PBN blogspot domains, paid listicle placements on high-authority sites (crypto.news, guru99, hackr.io), Google platform spam, WordPress/Weebly networks, and Trustpilot review farming. These listicles became the primary source from which ChatGPT and other LLMs form "best Monero wallet" recommendations. 1,262 referring domains, 9,566 backlinks — 70-80% spam. Traffic: ~640 visits/mo (Semrush), too low for SimilarWeb to measure.

---

1. MECHANISM OF INCLUSION IN AI RECOMMENDATIONS

1.1 Pipeline: Content -> Listicles -> LLM Training/RAG -> User Recommendation

[Sponsored Articles] -> [Listicle "Best Monero Wallet"] -> [Google Index]
         |                        |                              |
         v                        v                              v
  [PBN Backlinks]         [Authority Signals]           [ChatGPT RAG Pipeline]
         |                        |                              |
         v                        v                              v
  [SERP Ranking]          [Repetition = Truth]          [AI Recommendation]

LLMs (ChatGPT, Perplexity, Gemini) use RAG (Retrieval-Augmented Generation) — pulling data from the web. Key signals:

1. Repetition = truth — if 10+ sources say "xmrwallet is the best," the LLM will reproduce it
2. Source authority — crypto.news, guru99.com, beincrypto.com = high authority score
3. Listicle format — 59.5% of all AI quotes come from listicle content
4. Freshness — articles are regularly updated ("2024", "2025", "2026" in titles)

1.2 Specific Steps by the xmrwallet Operator

A. Paid Listicle Articles (GEO Layer 1)

Site	Authority	Type	xmrwallet Position	Sponsored Note
crypto.news	High	SPONSORED guest post	#1 "undoubtedly the standout"	YES - #sponsored tag
guru99.com	50	Affiliate listicle	#1 "Editor's Choice"	NO (affiliate link guru99.link/a5e914)
hackr.io	33	Editorial listicle	#4 "Best Browser-Based"	NO
softwaretestinghelp.com	Med	Listicle	Top-10	NO
coincodecap.com	Med	Listicle (cautious)	Listed with warnings	NO
coingape.com	Med	Listicle	Listed	NO
cryptopotato.com	Med	Sponsored review	Dedicated article	Implicit
binance.com/square	High	Cross-posted from crypto.news	#1	Third-party disclaimer

crypto.news article — key. Clearly marked #sponsored, auto cross-posted on Binance Square. States "undoubtedly XMRWallet is the standout" — such superlative statements ("best", "undoubtedly", "standout") trigger AI recommendations.

B. PBN Network for SEO Boost (GEO Layer 2)

50+ blogspot domains, created Jul-Sep 2025:

• `engliasd.blogspot.com` — 50,176 external links, anchor "xmrwallet"
• `fmcproda.blogspot.com` — 14,509 external links
• `intonettvas.blogspot.com` — 13,509 external links
• Series: asunm_*, lim_*, mcwcrown_*, branded crypto names

IP clusters: 192.178.155.132, 172.253.62.132, 142.251.167.132 (Google IPs — Blogspot)

Correlation: peak PBN spam (Jul-Sep 2025) = peak traffic (Sep 2025: 869 visits, 3x the norm)

C. Google Platform Spam (GEO Layer 3)

Operator abrahambrantley created:

• 6+ Google Sites pages (`sites.google.com/view/xmr-wallet*`)
• 6+ Google Cloud Storage pages (`storage.googleapis.com/abrahambrantley/*.html`)

Google domains = high trust score for LLM.

D. WordPress/Weebly/Rentry Spam (GEO Layer 4)

Operator davidsingsones + other aliases:

• `davidsingsones48.wordpress.com`, `davidsingsones31.wordpress.com`, etc.
• `suzzenkerryb60.weebly.com`, `rachallelad52.weebly.com`
• `rentry.co/h3vau`

E. Dead PBN Networks (Expendable Layers)

Two clusters of dead PBNs, used and discarded:

Hetzner cluster (IP: 168.119.205.26, DE):

• cryptoblog.site, bitsta.net, bitglobe.net, cryptoheart.net, bitinvest.info
• All died Nov 2025

French cluster (IP: 62.84.182.75, FR):

• 10 domains of various niches (betting, music, health, taxi)
• Classic multi-niche PBN, all died Nov-Dec 2025

F. Darkweb/Telegram Promotion (Trust Layer)

• Included in darkweb catalog CONWAY (moltisanti.neocities.org)
• Telegram channel @darksidelinks — 15 referring domains, 20 backlinks
• This creates an "underground credibility" signal

G. Trustpilot Review Farming

• 76+ reviews, rating 4.2
• Pattern: waves of 5-star reviews from single-review accounts
• Operator responds to scam complaints: "you're referring to a clone site"
• Trustpilot rating = authority signal for LLM

1.3 Why ChatGPT Picks This Up

According to GEO industry data (2026):

1. Listicle content = 59.5% of all AI quotes — xmrwallet in 8+ listicles
2. Superlatives trigger recommendations — "undoubtedly the standout", "Editor's Choice", "best"
3. Repetition = consensus for LLM — identical claims in 8+ sources
4. Niche topics are more vulnerable — "Monero wallet" = obscure topic, easier for LLM to "fold"
5. Reddit mentions = 4x more likely to be quoted — u/WiseSolution promoted on r/Monero (banned 2018)
6. 53.6% of ChatGPT responses without web sources — recommendations from training data, including these listicles

---

2. TRAFFIC — SUMMARY FOR BOTH SITES

xmrwallet.com

Metric	Value
Estimated monthly visits	640 (Semrush)
SimilarWeb	N/A (too little traffic)
Organic traffic US	174/mo
Organic keywords US	22
Semrush rank US	2,912,117
Paid ads	NONE
Peak traffic	Sep 2025: 869 (PBN spam campaign)
Current traffic	~60-140/mo (declining)
Real traffic estimate	100-200/mo without spam
Total backlinks	9,566
Referring domains	1,262
Spam links	70-80%

SimilarWeb cannot even show data — traffic is below the measurement threshold. For a "service" through which $2M+ has passed, this is incredibly low — victims come through AI recommendations and direct links, not through search.

namesilo.com

Metric	Value
Estimated monthly visits	260K (Semrush) / 799.5K (SimilarWeb Sep 2024)
SimilarWeb global rank	#48,531
SimilarWeb category rank	#174 (Web Hosting & Domains)
Bounce rate	35.22%
Pages per visit	6.99
Avg visit duration	5:02
Organic traffic US	38,536/mo
Organic keywords US	17,672
AdWords spend	$67,214/mo
Total backlinks	11,094,219
Referring domains	141,636
Spam/parked links	~95% (10.8M out of 11M)

Anomalies:

• Korean traffic: 112K/mo (43% total) — 300x discrepancy vs history (200-400/mo)
• 85% ad spend on competitor brands (GoDaddy = 70% paid traffic)
• Chinese spam: 4.7M links (dom.com.cn alone = 1.3M)
• ScamAdviser: "high percentage of spammers and fraud sites" among clients

---

3. NAME PARASITISM — THE "XMRWALLET" EXPLOIT

3.1 The Name Itself Is an SEO Weapon

The domain xmrwallet.com is not a brand — it's a generic keyword grab. "XMR" + "wallet" = the exact query users type when looking for a Monero wallet. Compare with legitimate wallets:

Wallet	Name Type	Domain	SEO Strategy
Monerujo	Unique brand	monerujo.io	Organic — earns ranking through quality
Cake Wallet	Unique brand	cakewallet.com	Organic
Feather Wallet	Unique brand	featherwallet.org	Organic
MyMonero	Semi-generic	mymonero.com	Organic (est. 2014, Monero core team)
xmrwallet	Pure keyword	xmrwallet.com	Keyword squatting + PBN + paid placements

No legitimate wallet project uses a bare keyword domain combined with aggressive SEO manipulation. The name alone guarantees top placement for "xmr wallet" queries without any product merit.

3.2 m2049r Subdomain — Stealing a Real Developer's Identity

The GitHub user m2049r is the creator of github.com/m2049r/xmrwallet — the legitimate open-source Monerujo wallet, published years before xmrwallet.com existed. The scam operator:

1. Took the same repository name — registered xmrwallet.com to match the GitHub repo path m2049r/xmrwallet
2. Created a subdomain m2049r.xmrwallet.com — directly parasitizing the developer's username to capture search queries like "m2049r xmrwallet"
3. Result: When users search for the legitimate Monerujo project, the scam domain appears alongside or above the real repository — Google interprets the subdomain match as topical relevance

Does any legitimate wallet do this? No. Cake Wallet doesn't create monerujo.cakewallet.com. Feather doesn't create mymonero.featherwallet.org. This is not competition — this is identity parasitism designed to intercept traffic meant for a real developer's project.

This technique is an SEO exploit: use a competitor's exact name as a subdomain to force Google to associate your domain with their search queries. Legitimate open-source projects and volunteer developers do not engage in this practice.

4. AI TRAINING DATA CONTAMINATION — PAID ARTICLES AS LLM SOURCES

The sponsored articles purchased by the operator (crypto.news, guru99, cryptopotato, etc.) served a dual purpose beyond immediate SEO:

1. Pre-2023 LLM training — Early ChatGPT versions (GPT-3.5, GPT-4) had no internet access and relied entirely on training data. Articles published before 2023 on high-authority domains were included in OpenAI's training corpus. The operator's paid placements in 2022-2023 became part of the model's "knowledge".
2. Post-2023 RAG pipeline — Modern ChatGPT with web browsing retrieves these same articles via Bing. The articles still rank on Google/Bing, so the scam recommendation persists through both training data AND real-time retrieval.
3. Self-reinforcing loop — AI recommends xmrwallet → new articles cite AI recommendation → AI trains on those articles → stronger recommendation. Several articles now removed by publishers continue to exist in AI training data.

Key insight: Even deleted sponsored articles continue to poison AI recommendations because the training data snapshot is permanent. The operator effectively paid once for permanent AI contamination.

---

5. WHERE DOES NAMESILO TRAFFIC COME FROM — A COMPLETE ANALYSIS

9.1 Decomposition of 260K monthly visits (Semrush) / 800K (SimilarWeb)

Difference between Semrush vs SimilarWeb:

• Semrush counts organic search traffic = 260K
• SimilarWeb counts ALL traffic (direct + referral + search + social) = 800K
• Delta ~540K = direct + referral + social traffic

9.2 Source #1: PARKED DOMAINS (~6M backlinks, main referral)

NameSilo manages 4M+ active domains. By default, each new domain receives a parking page with links to namesilo.com:

Anchors from parking pages:

Anchor	Domains	Backlinks
"whois"	39,178	1,909,549
"renew now!"	32,736	1,900,910
"domain"	32,722	1,900,487
"find similar names"	20,743	300,914
TOTAL parked	~33K domains	~6M links

This is 54% of all backlinks — automatically generated upon domain registration. Each parked domain = ~180 links to namesilo.com (whois, renew, domain links).

Traffic from parked domains:

• Direct referral through clicks on "whois" / "renew now!" / "find similar names"
• Estimate: ~50-100K visits/mo from 33K parked domains (if 1-3 clicks/domain/month)

9.3 Source #2: CHINESE SPAM NETWORK (~4.7M links)

Domain	Backlinks	Type
dom.com.cn	1,316,046	Single anchor "lo" — automatic scraper
gongxiangchongdianbao.com	516,579	CN spam
zjszrc.com	311,143	CN spam
jxfcrx.com	198,525	CN spam
0467w.com	191,033	CN spam
+ other CN domains	~2.2M
TOTAL CN spam	~4.7M links	42% of all backlinks

Mechanism: Chinese sites massively scrape WHOIS data and publish it with links to the registrar. dom.com.cn alone created 1.3M links with anchor "lo" — this is an automatic parser, not a human.

Anomaly: One CN domain (同款域名商) = 52,960 links. One AR domain (حجز دومين) = 32,634 links. Both = single domain, mass page generation.

9.4 Source #3: KOREAN TRAFFIC ANOMALY (112K/mo = 43% total)

Data:

• Korea: rank #963, 195 keywords, 112,442 traffic/mo
• US: rank #53,511, 17,672 keywords, 38,536 traffic/mo
• Korea = 43% total organic, but only 195 keywords vs 17,672 US

300x discrepancy: History data for Korea shows 200-400/mo, overview shows 112K/mo.

Hypotheses (from likely to unlikely):

1. Semrush data artifact — Korean data is aggregated differently, possibly includes branded queries through Naver (46.5% market share in Korea) which Semrush does not separate correctly. NameSilo DOES NOT offer .kr domains, has no Korean localization — no organic reason for rank #963 in Korea.
2. namesilo-china.com cross-attribution — SimilarWeb shows namesilo-china.com as #3 competitor (4.3K visits). Possibly Semrush mis-attributes part of Asian traffic to the main domain.
3. Purchased traffic / bot traffic — SparkTraffic and similar services sell Korean web traffic from $5. If NameSilo or an affiliate buys Korean bot traffic for inflating metrics — this would explain the 300x spike.
4. Korean reseller/affiliate — a hidden partner promotes NameSilo in Korea, generating traffic through affiliate links which Semrush counts as organic.

Important: NameSilo DOES NOT sell .kr domains, has no Korean localization, does not accept Korean payment methods (only Alipay/UnionPay for China). Korean market = GoDaddy KR, DotName Korea, HostingKR, Cafe24. No organic reason for 112K Korean visits.

9.5 Source #4: ADWORDS ($67K/mo, competitor brand bidding)

85% of the advertising budget = other brands:

• "godaddy" (vol 823K, pos 2) = 70% paid traffic
• "namecheap" (vol 165K, pos 4)
• Typos: "godady", "name cheap"
• Promo codes: "godaddy domain promo code", "namecheap promo code"
• Alternatives: "godaddy alternative"

Paid traffic estimate: $67K/mo spend, ~30-50K visits/mo

9.6 Source #5: ORGANIC SEARCH US (38.5K/mo, legitimate)

17,672 keywords, rank #53,511 — this is real organic traffic for a domain registrar. Includes:

• Brand queries ("namesilo", "name silo")
• Product queries ("cheap domains", "domain registration")
• Comparison queries ("namesilo vs namecheap")

9.7 Source #6: DIRECT TRAFFIC

Registered users visit directly to manage domains. With a base of 170K+ customers and 4M+ domains — direct traffic could be 200-400K/mo (main part of SimilarWeb delta).

9.8 TRAFFIC HISTORY US — ANOMALIES

Period	Traffic	Ad Cost	Note
2024-05	20,460	$71K	Baseline
2024-09	43,340	$149K	Heavy ad spend = 2x traffic
2025-03	53,157	$644	ANOMALY: peak traffic, ZERO ad spend
2025-10	18,392	$311	Crash to below baseline
2026-02	36,532	$34K	Recovery with moderate ads
2026-04	36,392	$67K	Current, heavy ads

March 2025 anomaly: Traffic peak (53K) with almost zero ad spend ($644). This is either:

• Massive organic/viral event (not found)
• Bot/purchased traffic inflation
• Data artifact

Oct 2025 crash: 18K with $311 ad spend = 66% drop from peak. If bot traffic was turned off — explains it.

9.9 SUMMARY: real vs inflated

Source	Est. Monthly	Real/Fake
Direct (customers)	200-400K	REAL
Organic search (US+global)	80-120K	REAL
Paid search (AdWords)	30-50K	REAL (competitor brand)
Parked domain referral	50-100K	ARTIFICIAL (auto-generated)
Korean anomaly	112K	SUSPICIOUS (no organic reason)
Chinese spam referral	minimal actual visits	FAKE (link-only, no clicks)
Total real	~350-550K
SimilarWeb reported	800K
Inflation factor	~1.5-2.3x

Bottom line: NameSilo's real traffic = ~400-500K/mo. Inflation comes from:

1. Parked domain auto-links (inflates backlink count, some referral traffic)
2. Chinese spam (inflates backlink count to 11M, minimal real traffic)
3. Korean anomaly (112K unexplained, likely data artifact or purchased)
4. March 2025 spike (unexplained peak with zero ad spend)

---

---

SOURCES

• ZeroFox: SEO Poisoning LLMs
• PPC.land: How Brands Manipulate ChatGPT
• SimilarWeb: namesilo.com
• SimilarWeb: xmrwallet.com
• crypto.news: 5 Best Monero Wallets (SPONSORED)
• Guru99: Best Monero Wallets
• Hackr.io: Best Monero Wallets
• Trustpilot: xmrwallet.com
• ScamAdviser: xmrwallet.com
• Scam-Detector: xmrwallet.com
• Semrush — backlink/traffic data (subscription required)

ALL REFERRING DOMAINS (1262)

Complete list of domains linking to xmrwallet.com. Sorted by authority score. Green = authority 30+, Red = authority <10 (likely spam). Filter by domain, IP, or country.

Source: Semrush API, May 2026. 1262 referring domains total. Only 15-20 have authority score >30.

---

ALL BACKLINKS (1827)

Complete backlink profile of xmrwallet.com. Red rows = known spam platforms (blogspot, wordpress.com, weebly, Google Sites). Filter by URL or anchor text.

Source: Semrush API, May 2026. 1827 backlinks total. 70-80% estimated spam.