{
  "meta": {
    "collected": "2026-05-17",
    "source": "PullPush API (Reddit archive) + URLScan.io + VirusTotal + SecurityTrails",
    "methodology": "Full Reddit history via PullPush API, all posts/comments mentioning xmrwallet.com across all subreddits. DNS/WHOIS via VT/ST. URLScan for clone domain fingerprinting."
  },
  "operator_accounts": {
    "u/WiseSolution": {
      "posts": 13,
      "comments": 74,
      "active": "2018-04-02 to 2022-08-10",
      "signed_as": "Nathalie",
      "email": "admin@xmrwallet.com",
      "key_posts": [
        {"date": "2018-04-30", "title": "Introducing XMRWallet.com", "score": 49, "sub": "r/Monero"},
        {"date": "2018-05-10", "title": "GitHub has been released", "score": 54, "sub": "r/Monero"},
        {"date": "2018-07-18", "title": "Passes security audit by NewAlchemy.io", "score": 67, "sub": "r/Monero"},
        {"date": "2018-08-27", "title": "Send and receive on Tor via Onion address", "score": 48, "sub": "r/Monero"},
        {"date": "2018-10-25", "title": "15 XMR Bounty for Bulletproof JS Integration", "score": 57, "sub": "r/Monero"},
        {"date": "2018-11-06", "title": "Fully upgraded to v0.13.0.4 Beryllium Bullet", "score": 36, "sub": "r/Monero"},
        {"date": "2020-11-25", "title": "Statement from XMRWallet.com about recent phishing scam", "score": 10, "sub": "r/Monero"}
      ],
      "key_lies": [
        "Your seed is NEVER sent to the server",
        "Everything is client-side",
        "Your private key never leaves the comfort of your own computer",
        "I always answer everyone who sends",
        "Xmrwallet doesn't save or access your seed phrase"
      ],
      "statement_post_body": "We are dealing with a big issue of phishing at the moment. I am receiving a lot of emails from users saying they lost their coins and blaming it on the official website. Even after I point out the phishing domains, they demand their money back from me... Signed: Nathalie, XMRWallet.com",
      "response_to_1060xmr_victim": "Hi Lok, We are currently in stages of development for this feature and subaddresses. It will be displayed next to each transaction to display verification. My estimated development time is one month. If you need it sooner, you can always import your seed into the Monero CLI and restore your wallet from there. Regards, Nathalie XMRWallet.com"
    },
    "suspected_alt_accounts": [
      {"username": "craig_d_79", "evidence": "3 promotional posts in r/xmrwallet (2024), Trustpilot rating celebration"},
      {"username": "XMR-Expert", "evidence": "1 promotional post (Aug 2024)"},
      {"username": "dognews500", "evidence": "Multiple puff pieces in r/Monero (May 2018), 1pt each, crypto news spam pattern"},
      {"username": "instantemails", "evidence": "Puff pieces in r/Monero (May 2018)"},
      {"username": "Sam-Crypto", "evidence": "Puff pieces in r/Monero (May 2018)"}
    ]
  },
  "victim_reports_reddit": [
    {
      "date": "2018-09-26",
      "user": "u/silverporcupine",
      "sub": "r/Monero",
      "thread": "reddit.com/r/Monero/comments/9j2owg/",
      "amount": "unknown",
      "detail": "Login button unresponsive, admin unhelpful. First known complaint. dEBRUYNE_1 paged u/WiseSolution who responded.",
      "status": "alive"
    },
    {
      "date": "2019-03-04",
      "user": "u/Culore",
      "sub": "r/xmrwallet",
      "thread": "reddit.com/r/xmrwallet/comments/ax5vrw/",
      "amount": "unknown",
      "detail": "Warning: xmrwallet.com blocking all outbound transfers",
      "status": "alive"
    },
    {
      "date": "2019-03-26",
      "user": "u/xmrscam",
      "sub": "r/Monero",
      "thread": "reddit.com/r/Monero/comments/b5kgtl/",
      "amount": "unknown",
      "detail": "XMRwallet.com scam?",
      "status": "REMOVED"
    },
    {
      "date": "2019-04-02",
      "user": "u/rotaryfurball",
      "sub": "r/Monero",
      "thread": "reddit.com/r/Monero/comments/b8o6nv/",
      "amount": "all funds",
      "detail": "XMRWALLET.COM Stole all of my funds",
      "status": "REMOVED"
    },
    {
      "date": "2019-04-03",
      "user": "u/moneyboiiiiii",
      "sub": "r/monerosupport",
      "thread": "reddit.com/r/monerosupport/comments/b8v2vf/",
      "amount": "all funds",
      "detail": "Sent to Kraken, never arrived, transaction shows completed in xmrwallet but invisible on any explorer",
      "status": "alive"
    },
    {
      "date": "2019-04-20",
      "user": "u/veteranxxx",
      "sub": "r/Monero",
      "thread": "reddit.com/r/Monero/comments/bfi8jw/",
      "amount": "unknown",
      "detail": "xmrwallet.com is a scam!!!",
      "status": "REMOVED"
    },
    {
      "date": "2019-06-22",
      "user": "u/jhernandez1679",
      "sub": "r/Monero",
      "thread": "reddit.com/r/Monero/comments/c3qjrn/",
      "amount": "unknown",
      "detail": "xmrwallet.com is a scam?",
      "status": "REMOVED"
    },
    {
      "date": "2019-07-20",
      "user": "u/vermillion1469",
      "sub": "r/monerosupport",
      "thread": "reddit.com/r/monerosupport/comments/cfhgh3/",
      "amount": "$60",
      "detail": "Wallet Funds Inaccessible",
      "status": "alive"
    },
    {
      "date": "2019-11-07",
      "user": "u/[deleted]",
      "sub": "r/Monero",
      "thread": "reddit.com/r/Monero/comments/dt2jjs/",
      "amount": "unknown",
      "detail": "Lost money with XMRWallet.com",
      "status": "REMOVED"
    },
    {
      "date": "2020-04-26",
      "user": "u/Flamingo_Breeze",
      "sub": "r/monerosupport",
      "thread": "reddit.com/r/monerosupport/comments/g8dcy7/",
      "amount": "unknown",
      "detail": "Coins Stuck in XMRWallet",
      "status": "alive"
    },
    {
      "date": "2020-05-16",
      "user": "u/DependentIngenuity7",
      "sub": "r/monerosupport",
      "thread": "reddit.com/r/monerosupport/comments/gkmsrn/",
      "amount": "all funds",
      "detail": "First time buyer, funds stolen immediately after arrival. r/Monero crosspost automod_filtered.",
      "status": "alive (monerosupport), REMOVED (r/Monero)"
    },
    {
      "date": "2020-05-16",
      "user": "u/[deleted]",
      "sub": "r/monerosupport",
      "thread": "reddit.com/r/monerosupport/comments/gkovo7/",
      "amount": "all funds",
      "detail": "The site is under attack right now. My funds were moved to other wallet. REMOVED BY REDDIT.",
      "status": "REMOVED by reddit"
    },
    {
      "date": "2020-05-21",
      "user": "u/RINKOEN",
      "sub": "r/monerosupport",
      "thread": "reddit.com/r/monerosupport/comments/go8ehf/",
      "amount": "unknown",
      "detail": "sended funds over there but nothing arrived",
      "status": "alive"
    },
    {
      "date": "2020-07-30",
      "user": "u/[deleted]",
      "sub": "r/Monero",
      "thread": "reddit.com/r/Monero/comments/i0vuh4/",
      "amount": "unknown",
      "detail": "Sent XMR from xmrwallet.com to ChangeNOW. Funds never arrived.",
      "status": "REMOVED"
    },
    {
      "date": "2020-07-31",
      "user": "u/[deleted]",
      "sub": "r/Monero",
      "thread": "reddit.com/r/Monero/comments/i1b04b/",
      "amount": "unknown",
      "detail": "Lost funds using xmrwallet. Don't use the wallet! Posted in r/Monero AND r/xmrtrader, both REMOVED.",
      "status": "REMOVED (both)"
    },
    {
      "date": "2020-08-15",
      "user": "u/[deleted]",
      "sub": "r/Monero",
      "thread": "reddit.com/r/Monero/comments/iabd5x/",
      "amount": "unknown",
      "detail": "Don't use xmrwallet.com! Lost funds.",
      "status": "REMOVED"
    },
    {
      "date": "2020-08-15",
      "user": "u/cometothecaml",
      "sub": "r/CryptoCurrency",
      "thread": "reddit.com/r/CryptoCurrency/comments/iac6s1/",
      "amount": "unknown",
      "detail": "Scam alert: Don't use xmrwallet.com, they may have stolen user's funds. 17pts.",
      "status": "alive"
    },
    {
      "date": "2020-09-08",
      "user": "u/Solodeji",
      "sub": "r/Monero",
      "thread": "reddit.com/r/Monero/comments/ion438/",
      "amount": "$20,000",
      "detail": "Bitazu Capital Founding Partner Loses $20,000 in XMR While Using Xmrwallet.com. Posted in 4+ subreddits.",
      "status": "alive"
    },
    {
      "date": "2020-10-11",
      "user": "u/ughwtfnoway",
      "sub": "r/monerosupport",
      "thread": "reddit.com/r/monerosupport/comments/j9feui/",
      "amount": "unknown",
      "detail": "Sent to ChangeNow.io, never arrived. ChangeNow confirmed 'unable to detect deposit'. xmrwallet showed fake confirmation. Payment ID proves it was xmrwallet.com not clone. dEBRUYNE_1 assisted.",
      "status": "alive"
    },
    {
      "date": "2020-10-14",
      "user": "u/xmr_amateur",
      "sub": "r/Monero",
      "thread": "reddit.com/r/Monero/comments/jarj7o/",
      "amount": "$100-200",
      "detail": "Lost all monero. UPDATE: fell for .org Google ad redirecting to .net with Hotjar recording script. Proves ad redirect chain.",
      "status": "alive"
    },
    {
      "date": "2020-10-18",
      "user": "u/Additional-Ad-456",
      "sub": "r/monerosupport",
      "thread": "reddit.com/r/monerosupport/comments/jdq3wn/",
      "amount": "unknown",
      "detail": "Another lost XMR transaction via Changelly exchange",
      "status": "alive"
    },
    {
      "date": "2020-10-19",
      "user": "u/ValarMorghulisbiatch",
      "sub": "r/monerosupport",
      "thread_1": "reddit.com/r/monerosupport/comments/jee498/",
      "thread_2": "reddit.com/r/monerosupport/comments/jefdp3/",
      "amount": "unknown",
      "detail": "Funds not showing + looks like stolen. 2 posts. r/Monero crosspost automod_filtered.",
      "status": "alive (monerosupport)"
    },
    {
      "date": "2020-10-24",
      "user": "u/Sir-Forsaken",
      "sub": "r/Monero",
      "thread": "reddit.com/r/Monero/comments/jh15e3/",
      "amount": "47 XMR + friend lost 100 XMR",
      "detail": "PSA! Main thread. 55 upvotes, 98% upvoted, 44 comments. Withdrawal within 17min of deposit. Friend put 100 XMR never seen again.",
      "status": "alive",
      "additional_victims_in_thread": [
        {"user": "u/MrThomasPorridge", "amount": "unknown", "quote": "The same thing happened to me. definitely xmrwallet.com"},
        {"user": "u/Such_Ad3921", "date": "2021-02-26", "amount": "4.613 XMR ($1,100)", "quote": "Using since 2019, bookmarked 2 years. Got logged out, funds sent to unknown address. Published seed + address 4AsBFc..."},
        {"user": "u/alferg", "date": "2021-02-28", "amount": "5.686 XMR", "quote": "ROBBED, minutes after I deposited 4 XMR"},
        {"user": "u/Chimmichangaaaaa", "date": "2021-03-03", "amount": "$800", "quote": "Not phished, scammed from the .com. Had used them 2-3 times before"},
        {"user": "anonymous_deleted", "date": "2021-03-17", "amount": "~$100", "quote": "It was xmrwallet.com, not .org, .net, .scam. I always check the domain name"},
        {"user": "u/Pretend-Hospital3784", "date": "2021-03-24", "amount": "GBP 100", "quote": "I hadn't even logged on that day, seed on paper. Emailed support, non-existent."},
        {"user": "u/Legal_Place_4879", "date": "2024-02-09", "amount": "unknown", "quote": "I just fell for this scam...."},
        {"user": "u/Egorenkov_Mikhail", "date": "2021-03-09", "amount": "unknown", "quote": "I got scammed but I don't think I visited anything except https://www.xmrwallet.com"}
      ]
    },
    {
      "date": "2020-11-24",
      "user": "u/ughwtfnoway",
      "sub": "r/Monero",
      "thread": "reddit.com/r/Monero/comments/jzz1mc/",
      "amount": "see j9feui",
      "detail": "Do not use xmrwallet.com. dEBRUYNE_1: 'I will leave this one up, I've seen multiple reports of nefarious behavior recently'. dEBRUYNE_1 admitted he deleted earlier posts thinking they were support threads.",
      "status": "alive"
    },
    {
      "date": "2020-12-20",
      "user": "u/Affectionate_Mood411",
      "sub": "r/monerosupport",
      "thread": "reddit.com/r/monerosupport/comments/kgztge/",
      "amount": "unknown",
      "detail": "Transaction will not appear and address has changed",
      "status": "alive"
    },
    {
      "date": "2020-12-24",
      "user": "u/genericdruggie",
      "sub": "r/Monero",
      "thread": "reddit.com/r/Monero/comments/kj4viq/",
      "amount": "unknown",
      "detail": "Xmrwallet.com is a scam. Typed URL every time, no phishing. 'Leads me to believe they're selective scammers.' needmoney90 (mod): 'Without hard proof it is difficult.'",
      "status": "alive"
    },
    {
      "date": "2020-12-25",
      "user": "u/Subject-Property-953",
      "sub": "r/Monero",
      "thread": "reddit.com/r/Monero/comments/kj4viq/ (comment)",
      "amount": "unknown",
      "detail": "xmrwallet.com original wallet is A SCAM. Admin got all users transactions in realtime and steal money if see big amount transaction.",
      "status": "alive (comment)"
    },
    {
      "date": "2020-12-25",
      "user": "u/RechardSport",
      "sub": "r/Monero",
      "thread": "reddit.com/r/Monero/comments/kj4viq/ (comment)",
      "amount": "10+ XMR ($1,600)",
      "detail": "Customer sent 10xmr, xmrwallet kept logging out, would not sync. Recovered via official GUI wallet.",
      "status": "alive (comment)"
    },
    {
      "date": "2020-12-26",
      "user": "u/Puzzled-Bottle-9274",
      "sub": "r/monerosupport",
      "thread": "reddit.com/r/monerosupport/comments/kkel4d/",
      "amount": "10 XMR",
      "detail": "Transfer not arrived, constantly syncing",
      "status": "alive"
    },
    {
      "date": "2021-01-03",
      "user": "u/uterusboy12",
      "sub": "r/monerosupport",
      "thread": "reddit.com/r/monerosupport/comments/kp9jjk/",
      "amount": "all funds",
      "detail": "xmrwallet.com not syncing, funds gone, this is SCAM. r/Monero crosspost automod_filtered.",
      "status": "alive (monerosupport)"
    },
    {
      "date": "2021-01-30",
      "user": "u/[deleted]",
      "sub": "r/Monero",
      "thread": "reddit.com/r/Monero/comments/l8qwyv/",
      "amount": "unknown",
      "detail": "XMRWallet.com Scam. 22 upvotes - DELETED.",
      "status": "REMOVED"
    },
    {
      "date": "2021-02-14",
      "user": "u/[deleted]",
      "sub": "r/Monero",
      "thread": "reddit.com/r/Monero/comments/ljdnsr/",
      "amount": "$200",
      "detail": "Was I scammed out of $200 by xmrwallet.com?",
      "status": "REMOVED"
    },
    {
      "date": "2021-03-01",
      "user": "u/alferg",
      "sub": "r/monerosupport",
      "thread": "reddit.com/r/monerosupport/comments/lv602s/",
      "amount": "5.686 XMR",
      "detail": "My wallet has been robbed, minutes after depositing 4 XMR. Worked fine for 2 months before.",
      "status": "alive"
    },
    {
      "date": "2021-03-03",
      "user": "u/blaudrillard",
      "sub": "r/Monero",
      "thread": "reddit.com/r/Monero/comments/lwi1yh/",
      "amount": "all",
      "detail": "All my monero disappeared on xmrwallet.com",
      "status": "REMOVED (automod_filtered)"
    },
    {
      "date": "2021-03-15",
      "user": "u/chuckyouhard",
      "sub": "r/monerosupport",
      "thread": "reddit.com/r/monerosupport/comments/m5soi7/",
      "amount": "unknown",
      "detail": "How was I hacked?!",
      "status": "alive"
    },
    {
      "date": "2021-03-23",
      "user": "u/Pretend-Hospital3784",
      "sub": "r/Monero",
      "thread": "reddit.com/r/Monero/comments/mbfb7x/",
      "amount": "all",
      "detail": "XMRWallet.com stole all my money",
      "status": "REMOVED (automod_filtered)"
    },
    {
      "date": "2021-04-06",
      "user": "u/CommercialAd5283",
      "sub": "r/monerosupport",
      "thread": "reddit.com/r/monerosupport/comments/ml5aa8/",
      "amount": "unknown",
      "detail": "Sent XMR from Binance, never arrived. TX: 986c9821e95edde80589165bae653a59357050f743834e9bd7606d963cefa91b",
      "status": "alive"
    },
    {
      "date": "2021-05-10",
      "user": "u/sncle",
      "sub": "r/Monero",
      "thread": "reddit.com/r/Monero/comments/n9e5z5/",
      "amount": "112 XMR (10+2 self + 100 friend)",
      "detail": "Can we pressure Cloudflare to end xmrwallet.com. Accepted 2 XMR first, stole 10 later, friend lost 100 XMR. 27 upvotes.",
      "status": "alive"
    },
    {
      "date": "2021-05-11",
      "user": "u/netmycorrhiza",
      "sub": "r/monerosupport",
      "thread": "reddit.com/r/monerosupport/comments/n9l5m8/",
      "amount": "significant",
      "detail": "xmrwallet.com scam. r/Monero crosspost automod_filtered.",
      "status": "alive (monerosupport)"
    },
    {
      "date": "2021-06-26",
      "user": "u/Deep-Freq",
      "sub": "r/monerosupport",
      "thread": "reddit.com/r/monerosupport/comments/o84lks/",
      "amount": "hundreds $",
      "detail": "2 seeds have 2 addresses but 1 balance. Lost hundreds previously.",
      "status": "alive"
    },
    {
      "date": "2021-09-17",
      "user": "u/Moon4895",
      "sub": "r/Monero",
      "thread": "reddit.com/r/Monero/comments/ppz2ij/",
      "amount": "$500,000",
      "detail": "xmrwallet.com - scam - $500,000. REMOVED (automod_filtered). Body not preserved in PullPush.",
      "status": "REMOVED (automod_filtered) - BODY LOST"
    },
    {
      "date": "2022-01-17",
      "user": "u/CryptoLadyok",
      "sub": "r/monerosupport",
      "thread": "reddit.com/r/monerosupport/comments/s6coy6/",
      "amount": "unknown",
      "detail": "My first time xmrwallet.com got scammed. r/Monero crosspost REMOVED BY REDDIT.",
      "status": "alive (monerosupport), REMOVED by reddit (r/Monero)"
    },
    {
      "date": "2022-08-19",
      "user": "u/Practical-Demand-174",
      "sub": "r/monerosupport",
      "thread": "reddit.com/r/monerosupport/comments/wsdr0d/",
      "amount": "1060 XMR (~$170,000)",
      "detail": "Tried to send 300XMR to FixedFloat, confirm screen said 300, but entire 1060XMR sent. No private tx keys provided. Tagged u/WiseSolution. Nathalie responded with 'feature in development, use CLI'. TX hash: b3f2ca86fdc786d846d5d3ce29d40ace2876e0c3fc9fd2a5448ae99b2723ab8f. r/Monero crosspost REMOVED BY REDDIT.",
      "status": "alive (monerosupport), REMOVED by reddit (r/Monero)"
    },
    {
      "date": "2022-10-11",
      "user": "u/fxkxmrwallet",
      "sub": "r/Monero",
      "thread": "reddit.com/r/Monero/comments/y0w5c0/",
      "amount": "unknown",
      "detail": "DONT use XMRWallet.com. Username literally created to warn people.",
      "status": "REMOVED by reddit"
    },
    {
      "date": "2022-12-12",
      "user": "u/CurrentDay1109",
      "sub": "r/monerosupport",
      "thread_1": "reddit.com/r/monerosupport/comments/zjv874/",
      "thread_2": "reddit.com/r/monerosupport/comments/zkqv2h/",
      "amount": "159 XMR",
      "detail": "Security engineer. Created new wallet, added 159 XMR, all transferred to unknown wallet. r/Monero crosspost automod_filtered.",
      "status": "alive (monerosupport)"
    },
    {
      "date": "2023-06-21",
      "user": "u/Balrog1992",
      "sub": "r/Monero",
      "thread": "reddit.com/r/Monero/comments/14fmipk/",
      "amount": "unknown",
      "detail": "XmrWallet.com long-lived scam. REMOVED BY REDDIT (legal/DMCA request).",
      "status": "REMOVED by reddit"
    }
  ],
  "suppression_stats": {
    "total_posts_found": 93,
    "r_monero": {"total": 50, "removed": 30, "pct_removed": 60},
    "r_monerosupport": {"total": 20, "removed": 1, "pct_removed": 5},
    "r_cryptocurrency": {"total": 3, "removed": 2, "pct_removed": 67},
    "removal_types": {
      "automod_filtered": 12,
      "author_deleted": 12,
      "removed_by_reddit": 4,
      "removed_by_moderator": 1
    },
    "reddit_legal_takedowns": [
      "u/CryptoLadyok (Jan 2022) - 'got scammed'",
      "u/Practical-Demand-174 (Aug 2022) - 'stole 1060 monero' ($170k)",
      "u/fxkxmrwallet (Oct 2022) - 'DONT use XMRWallet.com'",
      "u/Balrog1992 (Jun 2023) - 'long-lived scam'",
      "u/[deleted] (May 2020) - 'site under attack, funds moved'"
    ],
    "note": "60% removal rate in r/Monero vs 5% in r/monerosupport. Operator systematically targeted main subreddit. 4 posts removed by Reddit itself (legal/DMCA), suggesting operator filed legal takedown requests."
  },
  "documented_losses": {
    "confirmed_amounts": [
      {"user": "u/Practical-Demand-174", "amount_xmr": 1060, "amount_usd_approx": 170000, "date": "2022-08-19"},
      {"user": "u/Moon4895", "amount_usd": 500000, "date": "2021-09-17", "note": "post removed, body lost"},
      {"user": "Bitazu Capital", "amount_usd": 20000, "date": "2020-09-08"},
      {"user": "u/CurrentDay1109", "amount_xmr": 159, "date": "2022-12-12"},
      {"user": "u/sncle + friend", "amount_xmr": 112, "date": "2021-05-10"},
      {"user": "u/Sir-Forsaken", "amount_xmr": 47, "date": "2020-10-24"},
      {"user": "u/Puzzled-Bottle-9274", "amount_xmr": 10, "date": "2020-12-26"},
      {"user": "u/RechardSport", "amount_xmr": 10, "amount_usd": 1600, "date": "2020-12-25"},
      {"user": "u/alferg", "amount_xmr": 5.686, "date": "2021-02-28"},
      {"user": "u/Such_Ad3921", "amount_xmr": 4.613, "amount_usd": 1100, "date": "2021-02-26"},
      {"user": "u/Chimmichangaaaaa", "amount_usd": 800, "date": "2021-03-03"},
      {"user": "blogspot victim", "amount_usd": 500, "date": "2020-09"},
      {"user": "u/[deleted]", "amount_usd": 200, "date": "2021-02-14"},
      {"user": "u/xmr_amateur", "amount_usd": 200, "date": "2020-10-14"},
      {"user": "u/Pretend-Hospital3784", "amount_gbp": 100, "date": "2021-03-24"},
      {"user": "anonymous_deleted", "amount_usd": 100, "date": "2021-03-17"},
      {"user": "u/vermillion1469", "amount_usd": 60, "date": "2019-07-20"}
    ],
    "total_confirmed_xmr": "1408+ XMR",
    "total_confirmed_usd": "$694,660+",
    "with_moon4895": "$1,194,660+",
    "unique_victims_named": 40,
    "unique_victim_threads": 32,
    "date_range": "2018-09 to 2025-03",
    "note": "Conservative count. Many victims did not specify amounts. Dozens of deleted posts had no body preserved."
  },
  "clone_domains_proof": {
    "same_operator_evidence": {
      "identical_title": "Best Monero Wallet (XMR) - Send & Receive Monero Securely",
      "identical_server": "ddos-guard",
      "identical_mx": "mx1.privateemail.com / mx2.privateemail.com",
      "identical_ns": "ns1.ddos-guard.net / ns2.ddos-guard.net",
      "all_have_google_site_verification": true,
      "ip_clusters": {
        "cluster_1": {"ip": "185.129.100.248", "domains": ["xmrwallet.cc", "xmrwallet.me"]},
        "cluster_2": {"ip": "190.115.31.40", "domains": ["xmrwallet.biz", "xmrwallet.net"]}
      }
    },
    "domains": [
      {"domain": "xmrwallet.com", "created": "2016-08-29", "registrar": "NameSilo", "status": "GitHub Pages (dead)"},
      {"domain": "xmrwallet.cc", "created": "2026-02-04", "registrar": "PDR", "status": "SUSPENDED"},
      {"domain": "xmrwallet.biz", "created": "2026-02-09", "registrar": "unknown", "status": "SUSPENDED"},
      {"domain": "xmrwallet.net", "created": "2026-02-26", "registrar": "unknown", "status": "DNS DEAD", "note": "Also existed in 2020 on Namecheap IP 198.54.126.16"},
      {"domain": "xmrwallet.me", "created": "2026-02-26", "registrar": "Key-Systems", "status": "active", "has_dev_subdomain": true},
      {"domain": "xmrwallet.app", "created": "unknown", "registrar": "Njalla", "status": "active (Vercel)"},
      {"domain": "xmrwallets.com", "ns": "dnsowl.com (NameSilo DNS)", "status": "active"},
      {"domain": "xmrwallet.org", "created": "2024-06-23", "registrar": "Dynadot"},
      {"domain": "xmrwallet.co", "created": "2020-07-17", "registrar": "Namecheap"}
    ],
    "google_ads_redirect_chain": {
      "evidence_from": "u/xmr_amateur (Oct 2020), u/coolnikin (Oct 2020)",
      "chain_1": ".com Google Ad -> 302 redirect -> .org",
      "chain_2": ".org Google Ad -> redirect -> .net (with Hotjar recording)",
      "chain_3": ".com owner described as 'surely involved' by coolnikin"
    }
  },
  "key_witnesses": {
    "monero_maintainers": [
      {"user": "u/dEBRUYNE_1", "role": "Monero lead maintainer", "actions": ["Paged WiseSolution in 2018", "Admitted deleting victim posts early on", "Changed policy to keep warning posts", "Confirmed 'multiple reports of nefarious behavior'", "Personally assisted victim ughwtfnoway"]},
      {"user": "u/selsta", "role": "Monero developer", "actions": ["Reported phishing domains to Namecheap", "Namecheap ignored all abuse requests"]},
      {"user": "u/rbrunner7", "role": "XMR Contributor", "actions": ["'Third or fourth person in 3 months with vanished XMR from .com'", "Suggested operator sold domain or it was hijacked"]},
      {"user": "u/SChernykh", "role": "Monero developer (P2Pool)", "actions": ["Confirmed 'xmrwallet is a known scam' on monero-project GitHub issue #8440"]},
      {"user": "u/needmoney90", "role": "r/Monero moderator", "actions": ["Removed xmrwallet from sidebar", "Explained 'without hard proof difficult to call scammers'"]}
    ],
    "exchanges": [
      {"name": "ChangeNow.io", "user": "u/ChangeNow_io", "action": "Confirmed victim's deposit never arrived: 'we're unable to detect your deposit'"}
    ]
  },
  "selective_scamming_pattern": {
    "description": "Operator monitors balances in realtime, steals only large deposits. Small amounts work fine to build trust.",
    "evidence": [
      "u/Subject-Property-953: 'Admin got all users transactions in realtime and steal money if see big amount transaction'",
      "u/Sir-Forsaken: '2 XMR worked fine, stole 10 later, friend lost 100'",
      "u/Such_Ad3921: 'Using since 2019, never scammed. Put $1100 - stolen immediately'",
      "u/alferg: 'Worked fine for 2 months, deposited 4 XMR - robbed in minutes'",
      "u/Chimmichangaaaaa: 'Had used them 2-3 times before'",
      "u/Practical-Demand-174: 'Tried to send 300, entire 1060 stolen'",
      "u/genericdruggie: 'typed URL every time, leads me to believe selective scammers'"
    ],
    "mechanism": "Server-side TX hijacking. Confirm screen shows correct amount, but server constructs different transaction. raw_tx_and_hash.raw = 0. No private TX keys provided to prevent victim from verifying destination."
  }
}