68+ bot posts promoting xmrwallet.com — all still live. Every victim warning — deleted. Purchased for 500 rubles (~$5) per batch on Kwork. The operator's SEO orders match the Google Drive timestamps exactly.
Bot spam (ALIVE)
68+ accounts posting identical promotional content about xmrwallet.com. Purchased on Kwork for 500 rubles per package. "Crypto news" bot farms that tweet links to paid articles. First wave: May 2018 (crypto winter killed the farm, but tweets survive). Second wave: 2023 (same Google Drive images from operator's SEO orders). Still active in 2025-2026. Not a single one removed by X/Twitter.
Victim warnings (DELETED)
@Phish_Destroy — locked via Gold Checkmark. Independent researchers — posts removed. Victims reporting theft — reported and deleted. SHA-256 verified evidence — "inauthentic behavior." X's own automated review: "no violation." Still locked. ~100+ legitimate posts removed. Zero bot posts touched.
Wave 1 — May 2018 (Kwork bot farm, 500 RUB)
~40 accounts posted within hours of each other. Identical format: link to paid NewsBTC article + xmrwallet promo image. The crypto winter of 2018 killed the bot farm's business model, but every single tweet is still indexed. These are the "social signals" that helped the operator's paid articles rank in search.
Wave 2 — 2023 (matches Google Drive SEO orders)
The 2023 accounts use the same images found in the operator's Google Drive folders (last modified October 2023). Same pictures, same captions, same links. The Drive folder titled "Xmr Wallet Photos" contains the exact promotional images these accounts posted.
Wave 3 — 2025-2026 (still going)
Purchased article (still live)
Full URL list (68+ posts)
Every bot post we found in X/Twitter search results. All still live. All promoting a $100M+ theft operation.
Cached screenshots: cached-evidence/twitter-bots/ — 13 key bot posts + NewsBTC article preserved locally.
Full URL list: ALL_BOT_URLS.txt
← Main archive · Evidence · abuse@phishdestroy.io