# xmrwallet — Domain Network

| Domain | Status | Registered | Expires | Registrar | IP / ASN |
|--------|--------|-----------|---------|-----------|----------|
| [xmrwallet.com](xmrwallet.com/) | ACTIVE | 2016-08-29 | 2031-08-29 | NameSilo | 186.2.165.49 / AS59692 |
| [xmrwallet.net](xmrwallet.net/) | ACTIVE | 2026-02-26 | 2036-02-26 | NICENIC | **190.115.31.40** / AS59692 |
| [xmrwallet.me](xmrwallet.me/) | ACTIVE | 2026-02-26 | 2036-02-26 | Key-Systems | **185.129.100.248** / AS57724 |
| [xmrwallet.cc](xmrwallet.cc/) | SUSPENDED | 2026-02-04 | 2034-02-04 | PDR | ~~185.129.100.248~~ / AS57724 |
| [xmrwallet.biz](xmrwallet.biz/) | SUSPENDED | 2026-02-09 | 2031-02-09 | WebNic | ~~190.115.31.40~~ / AS59692 |

## IP Recycling

```
xmrwallet.biz  (suspended)  →  190.115.31.40   →  xmrwallet.net  (active)
xmrwallet.cc   (suspended)  →  185.129.100.248  →  xmrwallet.me   (active)
```

## Timeline

```
2016-08-29  xmrwallet.com  registered
2026-02-04  xmrwallet.cc   registered   (8yr prepaid)
2026-02-09  xmrwallet.biz  registered   (5yr prepaid)
2026-02-13  PhishDestroy publishes investigation
2026-02-16  Operator emails: "We don't store keys" (lie)
2026-02-17  Operator: "This is the data we need" (contradicts Feb 16)
2026-02-17  Operator: "Subpoena the registrar" (before any abuse report)
2026-02-23  xmrwallet.cc   SUSPENDED
2026-02-23  xmrwallet.biz  SUSPENDED
2026-02-23  Operator: "I've hired a lawyer" (never appeared)
2026-02-26  xmrwallet.net  registered   (10yr prepaid)
2026-02-26  xmrwallet.me   registered   (10yr prepaid)
2026-03     Captcha system deployed
2026-03-04  NameSilo claims "compromise" — contradicted by operator's emails
2026-03-16  Medium + dev.to articles published with email evidence
```

## NameSilo Cover-Up

NameSilo is the only registrar that refused to act. They called the operator "the victim" and claimed the site was "compromised." The operator's own emails (Feb 16-17) contradict this — he defended the code as his own before NameSilo invented the hack story. File ICANN complaint: https://www.icann.org/compliance/complaint

## Abuse Contacts

| Domain | Registrar Abuse | Hosting |
|--------|----------------|---------|
| xmrwallet.com | abuse@namesilo.com (**sided with operator**) | abuse@ddos-guard.net |
| xmrwallet.net | abuse@nicenic.net | abuse@ddos-guard.net |
| xmrwallet.me | abuse@key-systems.net | abuse@ddos-guard.net |

### Scanners

- https://safebrowsing.google.com/safebrowsing/report_phish/
- https://phish.report/
- https://www.virustotal.com/gui/domain/xmrwallet.com
- https://www.virustotal.com/gui/domain/xmrwallet.net
- https://www.virustotal.com/gui/domain/xmrwallet.me