{
  "investigation": {
    "title": "OSINT Investigation: xmrwallet.com & namesilo.com — $100M Cryptocurrency Theft Analysis",
    "date": "2026-05-12",
    "source": "Semrush API (key: 605f...6144)",
    "classification": "CONFIDENTIAL — Law Enforcement Use",
    "analyst": "Cybersecurity OSINT Team",
    "case_summary": "Comprehensive SEO/backlink/traffic intelligence on xmrwallet.com (Monero web wallet) and namesilo.com (domain registrar) in connection with investigation of $100M+ cryptocurrency theft. Analysis covers link manipulation networks, spam infrastructure, satellite domains, traffic anomalies, and abuse patterns.",
    "key_findings_summary": [
      "xmrwallet.com operates a massive PBN (Private Blog Network) of 50+ blogspot domains for SEO manipulation",
      "Google Sites/GCS spam campaign with 12+ pages from single operator 'abrahambrantley'",
      "Typosquatting domains: xmrwalllet.com (triple-L, Finland IP 85.192.48.109), xmrwallet.me",
      "Satellite site bestmonerowallet.com dedicated to funneling traffic to xmrwallet.com",
      "Listed in darkweb directory 'CONWAY' (moltisanti.neocities.org)",
      "Telegram promotion via darkweb channel t.me/s/darksidelinks",
      "Peak spam campaign (Jul-Sep 2025) directly correlates with traffic spike",
      "namesilo.com shows anomalous Korean traffic (112K/mo from 195 keywords = rank 963)",
      "namesilo.com aggressively bids on competitor brands (GoDaddy = 70% of paid traffic)",
      "namesilo.com backlink profile inflated to 11M+ by parked domain pages and Chinese spam networks"
    ]
  },
  "subject_1": {
    "domain": "xmrwallet.com",
    "type": "Monero (XMR) Web Wallet",
    "description": "Non-custodial Monero cryptocurrency wallet accessible via web browser. Claims to be privacy-focused. No formal company registration visible.",
    "traffic_overview": {
      "total_estimated_monthly_visits": 640,
      "organic_traffic_us": 174,
      "organic_keywords_us": 22,
      "semrush_rank_us": 2912117,
      "adwords_activity": "NONE",
      "organic_cost_value_us": "$0",
      "assessment": "Extremely low organic traffic for a financial service. Real traffic without spam manipulation estimated at 100-200/mo."
    },
    "traffic_by_region": [
      {"region": "US", "rank": 2912117, "keywords": 22, "traffic": 174},
      {"region": "UK", "rank": 897257, "keywords": 10, "traffic": 157},
      {"region": "Mobile UK", "rank": 593520, "keywords": 2, "traffic": 94},
      {"region": "Mobile US", "rank": 2850265, "keywords": 5, "traffic": 63},
      {"region": "DE", "rank": 1738733, "keywords": 7, "traffic": 44},
      {"region": "CA", "rank": 1280305, "keywords": 12, "traffic": 31},
      {"region": "AU", "rank": 1113440, "keywords": 8, "traffic": 29},
      {"region": "FR", "rank": 1780391, "keywords": 1, "traffic": 17},
      {"region": "NL", "rank": 1475186, "keywords": 6, "traffic": 10},
      {"region": "RU", "rank": 1659566, "keywords": 21, "traffic": 7},
      {"region": "BR", "rank": 2355930, "keywords": 2, "traffic": 3}
    ],
    "traffic_history_us": [
      {"date": "2024-05", "rank": 1784891, "keywords": 53, "traffic": 355},
      {"date": "2024-07", "rank": 1610479, "keywords": 70, "traffic": 474},
      {"date": "2024-09", "rank": 1696673, "keywords": 69, "traffic": 484},
      {"date": "2024-11", "rank": 2042764, "keywords": 156, "traffic": 370},
      {"date": "2025-01", "rank": 2224201, "keywords": 92, "traffic": 317},
      {"date": "2025-03", "rank": 4034555, "keywords": 44, "traffic": 75},
      {"date": "2025-05", "rank": 2923730, "keywords": 43, "traffic": 162},
      {"date": "2025-07", "rank": 2309656, "keywords": 105, "traffic": 264},
      {"date": "2025-09", "rank": 1162220, "keywords": 120, "traffic": 869, "note": "PEAK — correlates with PBN spam campaign"},
      {"date": "2025-11", "rank": 1479818, "keywords": 76, "traffic": 586},
      {"date": "2026-01", "rank": 2757051, "keywords": 40, "traffic": 189},
      {"date": "2026-03", "rank": 4589667, "keywords": 35, "traffic": 59},
      {"date": "2026-04", "rank": 3216382, "keywords": 27, "traffic": 141}
    ],
    "organic_keywords_all_regions": {
      "us": [
        {"keyword": "xmr wallet", "position": 6, "volume": 5400, "traffic_pct": 74.13},
        {"keyword": "monero wallet", "position": 6, "volume": 5400, "traffic_pct": 24.71},
        {"keyword": "xmr", "position": 25, "volume": 1600},
        {"keyword": "monero", "position": 27, "volume": 8100},
        {"keyword": "xmr crypto", "position": 38, "volume": 2900},
        {"keyword": "monero xmr", "position": 22, "volume": 1900},
        {"keyword": "monero crypto", "position": 28, "volume": 4400},
        {"keyword": "xmr explorer", "position": 55, "volume": 590},
        {"keyword": "how to buy xmr", "position": 67, "volume": 720},
        {"keyword": "monero address lookup", "position": 30, "volume": 260},
        {"keyword": "what is xmr", "position": 45, "volume": 390},
        {"keyword": "mobero wallet", "position": 5, "volume": 110, "note": "Typo keyword"}
      ],
      "uk": [
        {"keyword": "xmrwallet", "position": 1, "volume": 110, "traffic_pct": 56.05},
        {"keyword": "xmr wallet", "position": 4, "volume": 880, "traffic_pct": 36.30},
        {"keyword": "monero wallet", "position": 6, "volume": 3600, "traffic_pct": 5.73}
      ],
      "ru": [
        {"keyword": "xmr wallet online", "position": 3, "volume": 70},
        {"keyword": "monero web wallet", "position": 8, "volume": 50},
        {"keyword": "monero wallet", "position": 7, "volume": 210},
        {"keyword": "кошелек для монеро", "position": 44, "volume": 50},
        {"keyword": "онлайн кошелек монеро", "position": 84, "volume": 50},
        {"keyword": "xmr кошелек", "position": 33, "volume": 90},
        {"keyword": "кошелек монеро официальный сайт", "position": 31, "volume": 50},
        {"keyword": "getmonero", "position": 17, "volume": 110},
        {"keyword": "free monero", "position": 20, "volume": 880}
      ],
      "de": [{"keyword": "xmrwallet", "position": 1, "volume": 170}, {"keyword": "monero wallet", "position": 13, "volume": 3600}],
      "ca": [{"keyword": "xmrwallet", "position": 1, "volume": 70, "cpc": 4.85}, {"keyword": "xmr wallet", "position": 6, "volume": 590}],
      "au": [{"keyword": "xmrwallet", "position": 1, "volume": 110}, {"keyword": "xmr", "position": 30, "volume": 3600}]
    },
    "backlink_profile": {
      "total_backlinks": 9566,
      "referring_domains": 1262,
      "unique_ips": 948,
      "follow_links": 6400,
      "nofollow_links": 3042,
      "text_links": 9334,
      "image_links": 173,
      "spam_percentage_estimate": "70-80%",
      "legitimate_high_authority_links": "15-20 domains"
    },
    "anchor_distribution": [
      {"anchor": "xmr wallet", "domains": 195, "backlinks": 4342, "assessment": "OVER-OPTIMIZED PBN pattern"},
      {"anchor": "xmrwallet", "domains": 259, "backlinks": 1898, "assessment": "Spam-inflated"},
      {"anchor": "xmrwallet.com", "domains": 349, "backlinks": 663},
      {"anchor": "www.xmrwallet.com", "domains": 33, "backlinks": 518},
      {"anchor": "monero wallet", "domains": 235, "backlinks": 418},
      {"anchor": "best xmr wallet", "domains": 12, "backlinks": 246, "assessment": "MONEY KEYWORD manipulation"},
      {"anchor": "xmrwallet.me", "domains": 50, "backlinks": 82, "assessment": "Typosquat anchor"},
      {"anchor": "telegram darksidelinks", "domains": 15, "backlinks": 20, "assessment": "DARKWEB promotion"}
    ],
    "manipulation_networks": {
      "blogspot_pbn": {
        "description": "50+ blogspot domains with template names, 17K+ external links each",
        "total_domains": "50+",
        "creation_period": "Jul-Sep 2025",
        "correlation": "Peak PBN = Peak traffic (Sep 2025: 869 visits)",
        "ip_clusters": ["192.178.155.132", "172.253.62.132", "142.251.167.132", "142.251.111.132", "142.250.31.132", "172.253.122.132", "172.253.115.132", "64.233.180.132"],
        "naming_patterns": {
          "asunm_series": ["engliasd", "gg2038asnet", "erickasuk", "j4gasuklm", "latinxasunm", "lootupasunmk", "metavsasunmkl", "espectasumnv", "kleptomaniacsas", "memeticsasujiklop", "fpvasnet", "natsciasnet", "mcbeasnet", "fgchqasunm", "gardasuk", "mimeas", "onplayas", "organizedasyuio"],
          "branded_crypto": ["moneroxmrwallet", "walletsendreceive", "monerowalletonline", "monerujoandroidwallet", "monerujomonerowallet", "buymonerocoin", "homemonerosecure", "noncustodialwallet", "bestxmrwallet"],
          "lim_series": ["florimageslim", "djkakoslims", "defilmfxlim", "fivedaveylimsqs"],
          "mcwcrown_serial": ["mcwcrown-af309", "mcwcrown-af317", "mcwcrown-af318"]
        }
      },
      "google_platforms_spam": {
        "operator": "abrahambrantley",
        "google_sites": ["sites.google.com/view/xmr-wallet", "sites.google.com/view/xmr-wallet0", "sites.google.com/view/xmr-wallet1", "sites.google.com/view/monero-wallet2", "sites.google.com/view/monero-wallet3", "sites.google.com/view/wallet-xmr"],
        "gcs_pages": ["storage.googleapis.com/abrahambrantley/MoneroWallet.html", "storage.googleapis.com/abrahambrantley/MoneroXmr.html", "storage.googleapis.com/abrahambrantley/SecureMoneroWallet.html", "storage.googleapis.com/abrahambrantley/WalletXmr.html", "storage.googleapis.com/abrahambrantley/Xmrwallet.html", "storage.googleapis.com/abrahambrantley/ReceiveMonero.html"]
      },
      "wordpress_weebly_spam": {
        "operator_alias": "davidsingsones",
        "domains": ["davidsingsones48.wordpress.com", "davidsingsones31.wordpress.com", "davidsingsones65.wordpress.com", "davidsingsones75.weebly.com", "hinrichspence30.wordpress.com", "ballhermanch91.wordpress.com", "suzzenkerryb60.weebly.com", "rachallelad52.weebly.com"]
      },
      "satellite_domains": [
        {"domain": "xmrwallet.me", "type": "redirect to main", "backlinks_as_anchor": 82},
        {"domain": "xmrwalllet.com", "type": "typosquat triple-L", "ip": "85.192.48.109", "country": "Finland", "backlinks": 16},
        {"domain": "bestmonerowallet.com", "type": "satellite", "ip": "63.250.38.31", "country": "US", "backlinks": 12},
        {"domain": "web-iota-azure.vercel.app", "type": "Vercel spam", "backlinks": 15},
        {"domain": "tst2024.webflow.io", "type": "Webflow spam", "backlinks": 13}
      ],
      "darkweb_connections": [
        {"source": "moltisanti.neocities.org/rutools", "title": "CONWAY - darkweb link directory"},
        {"source": "moltisanti.neocities.org/useful-tools", "title": "CONWAY - darkweb link directory"}
      ],
      "telegram_promotion": {"channel": "t.me/s/darksidelinks", "referring_domains": 15, "backlinks": 20}
    },
    "legitimate_backlinks": [
      {"domain": "crypto.news", "authority": "high", "type": "editorial"},
      {"domain": "beincrypto.com", "authority_score": 63, "type": "editorial, 20+ languages"},
      {"domain": "getmonero.org", "authority_score": 48, "type": "official Monero site"},
      {"domain": "cryptopotato.com", "type": "sponsored review"},
      {"domain": "coinpedia.org", "type": "guest post"},
      {"domain": "hackr.io", "authority_score": 33, "type": "tech resource"},
      {"domain": "guru99.com", "authority_score": 50, "backlinks": 112, "note": "Suspiciously high for tutorial site"}
    ],
    "competitors": [
      {"domain": "mymonero.com", "relevance": 0.17, "common_kw": 6},
      {"domain": "monero.com", "relevance": 0.10, "common_kw": 6},
      {"domain": "featherwallet.org", "relevance": 0.05, "common_kw": 2},
      {"domain": "localmonero.co", "relevance": 0.04, "common_kw": 1}
    ],
    "known_urls": [
      "https://www.xmrwallet.com/",
      "https://www.xmrwallet.com/login.html",
      "https://www.xmrwallet.com/app.html#/login.html",
      "https://www.xmrwallet.com/blog/monero-simplified.html",
      "https://www.xmrwallet.com/blog/how-to-get-monero.html",
      "https://www.xmrwallet.com/blog/creating-xmr-paper-wallets.html",
      "https://www.xmrwallet.com/blog/monero-truly-private.html",
      "https://www.xmrwallet.com/blog/the-history-of-monero.html",
      "https://www.xmrwallet.com/blog/key-people-behind-monero.html",
      "https://www.xmrwallet.com/blog/navigating-xmrwallet.html",
      "https://www.xmrwallet.com/blog/security-of-your-xmr-wallet.html",
      "https://www.xmrwallet.com/blog/how-to-with-xmrwallet.html",
      "https://www.xmrwallet.com/blog/monero-factoids.html"
    ],
    "risk_assessment": {
      "seo_manipulation_level": "CRITICAL",
      "pbn_network_size": "50+ domains",
      "spam_link_ratio": "70-80%",
      "darkweb_presence": "CONFIRMED",
      "typosquatting": "CONFIRMED",
      "operator_identifiers": ["abrahambrantley", "davidsingsones"],
      "key_ips": {"xmrwalllet_com": "85.192.48.109 (FI)", "bestmonerowallet_com": "63.250.38.31 (US)"}
    }
  },
  "subject_2": {
    "domain": "namesilo.com",
    "type": "Domain Name Registrar (ICANN-accredited)",
    "company": "NameSilo LLC",
    "traffic_overview": {
      "total_estimated_monthly_visits": 260000,
      "organic_traffic_us": 38536,
      "organic_keywords_us": 17672,
      "semrush_rank_us": 53511,
      "organic_cost_value_us": "$193,454",
      "adwords_spend": "$67,214/mo",
      "assessment": "Established registrar. Korean traffic anomaly and aggressive competitor brand bidding."
    },
    "traffic_by_region_top15": [
      {"region": "KR", "rank": 963, "keywords": 195, "traffic": 112442, "note": "ANOMALY: 43% of total"},
      {"region": "US", "rank": 53511, "keywords": 17672, "traffic": 38536},
      {"region": "Mobile US", "rank": 44276, "keywords": 1908, "traffic": 34302},
      {"region": "PH", "rank": 14595, "keywords": 415, "traffic": 7920},
      {"region": "IN", "rank": 89023, "keywords": 960, "traffic": 6016},
      {"region": "CA", "rank": 56269, "keywords": 2483, "traffic": 4459},
      {"region": "BR", "rank": 106826, "keywords": 964, "traffic": 2147},
      {"region": "HK", "rank": 15995, "keywords": 182, "traffic": 1991},
      {"region": "UK", "rank": 187952, "keywords": 2199, "traffic": 1913},
      {"region": "DE", "rank": 187642, "keywords": 1021, "traffic": 1859},
      {"region": "VN", "rank": 45016, "keywords": 298, "traffic": 1548},
      {"region": "PK", "rank": 28247, "keywords": 284, "traffic": 1421},
      {"region": "SG", "rank": 26223, "keywords": 368, "traffic": 1275},
      {"region": "AU", "rank": 142649, "keywords": 2163, "traffic": 1255},
      {"region": "NL", "rank": 127561, "keywords": 1075, "traffic": 1007}
    ],
    "korea_anomaly": {
      "overview_traffic": 112442,
      "history_traffic_range": "200-400/mo",
      "discrepancy": "300x difference between overview and history",
      "possible_explanations": ["Data aggregation artifact", "Korean branded queries", "Traffic manipulation"]
    },
    "traffic_history_us": [
      {"date": "2024-05", "rank": 90036, "keywords": 6529, "traffic": 20460, "ad_cost": 71017},
      {"date": "2024-09", "rank": 52608, "keywords": 9633, "traffic": 43340, "ad_cost": 149267},
      {"date": "2025-03", "rank": 40382, "keywords": 15483, "traffic": 53157, "ad_cost": 644, "note": "ANOMALOUS PEAK"},
      {"date": "2025-10", "rank": 104404, "keywords": 15933, "traffic": 18392, "ad_cost": 311, "note": "CRASH"},
      {"date": "2026-02", "rank": 55103, "keywords": 18616, "traffic": 36532, "ad_cost": 34407},
      {"date": "2026-04", "rank": 56540, "keywords": 17354, "traffic": 36392, "ad_cost": 67214}
    ],
    "adwords_analysis": {
      "strategy": "AGGRESSIVE COMPETITOR BRAND BIDDING",
      "competitor_brand_traffic_share": "85%",
      "top_targets": [
        {"keyword": "godaddy", "position": 2, "volume": 823000, "traffic_pct": 69.62},
        {"keyword": "namecheap", "position": 4, "volume": 165000, "traffic_pct": 7.51},
        {"keyword": "godady", "position": 3, "volume": 27100, "type": "typo"},
        {"keyword": "name cheap", "position": 3, "volume": 14800, "type": "typo"},
        {"keyword": "godaddy domain promo code", "position": 1, "volume": 2400, "type": "competitor promo"},
        {"keyword": "namecheap promo code", "position": 2, "volume": 8100, "type": "competitor promo"},
        {"keyword": "godaddy alternative", "position": 4, "volume": 12100, "type": "comparison"},
        {"keyword": "dynadot", "position": 3, "volume": 8100, "type": "competitor brand"}
      ]
    },
    "backlink_profile": {
      "total_backlinks": 11094219,
      "referring_domains": 141636,
      "unique_ips": 19571,
      "follow_links": 10811677,
      "nofollow_links": 270819,
      "text_links": 9666554,
      "image_links": 568428,
      "form_links": 296032,
      "parked_domain_links": "~6M",
      "spam_links": "~4.7M",
      "legitimate_links": "~300K"
    },
    "anchor_distribution_top15": [
      {"anchor": "whois", "domains": 39178, "backlinks": 1909549, "type": "parked"},
      {"anchor": "renew now!", "domains": 32736, "backlinks": 1900910, "type": "parked"},
      {"anchor": "domain", "domains": 32722, "backlinks": 1900487, "type": "parked"},
      {"anchor": "lo", "domains": 1, "backlinks": 1314009, "type": "ANOMALY — dom.com.cn"},
      {"anchor": "(empty)", "domains": 73694, "backlinks": 986190},
      {"anchor": "namesilo", "domains": 2445, "backlinks": 611489},
      {"anchor": "namesilo.com", "domains": 21510, "backlinks": 309939},
      {"anchor": "find similar names", "domains": 20743, "backlinks": 300914, "type": "parked"},
      {"anchor": "同款域名商", "domains": 1, "backlinks": 52960, "type": "single CN domain"},
      {"anchor": "حجز دومين", "domains": 1, "backlinks": 32634, "type": "single AR domain"}
    ],
    "top_spam_referring_domains": [
      {"domain": "dom.com.cn", "backlinks": 1316046, "country": "CN"},
      {"domain": "bger.org", "backlinks": 601758},
      {"domain": "soaper.live", "backlinks": 565875},
      {"domain": "gongxiangchongdianbao.com", "backlinks": 516579, "country": "CN"},
      {"domain": "dns-checker.com", "backlinks": 316350},
      {"domain": "zjszrc.com", "backlinks": 311143, "country": "CN"},
      {"domain": "joker.pk", "backlinks": 220621},
      {"domain": "yezibt.com", "backlinks": 205235},
      {"domain": "jxfcrx.com", "backlinks": 198525, "country": "CN"},
      {"domain": "0467w.com", "backlinks": 191033, "country": "CN"},
      {"domain": "fuckgfw.org", "backlinks": 156641},
      {"domain": "rubias19.cc", "backlinks": 137013}
    ],
    "risk_assessment": {
      "seo_manipulation_level": "MEDIUM",
      "backlink_inflation": "SEVERE — 95% parked/spam",
      "competitor_brand_abuse": "HIGH — 85% ad spend on competitor brands",
      "korean_anomaly": "UNRESOLVED",
      "chinese_spam_exposure": "HIGH — 4.7M links"
    }
  },
  "cross_analysis": {
    "connection": "Direct operational connection not established via Semrush. Requires WHOIS verification.",
    "potential_links": [
      "xmrwallet.com/xmrwalllet.com/xmrwallet.me/bestmonerowallet.com may be registered at NameSilo",
      "NameSilo marketplace could facilitate sale of fraud-related domains"
    ],
    "recommended_next_steps": [
      "WHOIS history for all xmrwallet-related domains",
      "NameSilo account lookup for registrant",
      "IP 85.192.48.109 (FI) — reverse DNS and associated domains",
      "IP 63.250.38.31 (US) — hosting provider investigation",
      "GCS bucket 'abrahambrantley' — Google account identification",
      "WordPress accounts investigation: davidsingsones, hinrichspence30, ballhermanch91",
      "Telegram channel @darksidelinks investigation",
      "Blockchain analysis of XMR transactions through xmrwallet.com",
      "NameSilo marketplace transaction logs",
      "Web Archive snapshots of xmrwallet.com, xmrwalllet.com, bestmonerowallet.com"
    ]
  },
  "methodology": {
    "source": "Semrush API v3",
    "endpoints": ["domain_ranks", "domain_rank_history", "domain_organic", "domain_organic_organic", "domain_adwords", "domain_adwords_unique", "domain_adwords_adwords", "backlinks_overview", "backlinks", "backlinks_refdomains", "backlinks_anchors"],
    "databases": ["us", "uk", "ru", "de", "ca", "au", "kr"],
    "limitations": ["Traffic estimates based on CTR models", "Backlink coverage not exhaustive", "No WHOIS/DNS/blockchain data via Semrush", "Korean anomaly may be data artifact"]
  }
}