NameSilo, LLC
Registrar Abuse Investigation

xmrwallet[.]com is a Monero wallet drainer that has been running since approximately 2016. On every login, the site silently transmits the user's private view key to the operator's server via a base64-encoded session_key parameter. Eight PHP endpoints handle the exfiltration. raw_tx_and_hash.raw = 0 ensures all client-side transactions are discarded. The site has never been compromised — the theft code is the product. Estimated victim losses: $10–20M.

PhishDestroy submitted 20+ delivery-receipted abuse reports to NameSilo between 2023 and 2026. No action was taken. On March 13, 2026, NameSilo's official corporate account published a statement calling the operator "the victim," denying all reports ever arrived, and committing in writing to helping him remove his VirusTotal detections. Three other registrars — PDR, WebNic, NICENIC — reviewed the same evidence and suspended the domain within days.

When PhishDestroy published the operator's own emails proving every sentence false, NameSilo used X Gold Checkmark live-support access to lock the @Phish_Destroy research account. X's automated review cleared the account in writing on April 15, 2026. The lock remains in place. NameSilo's only documented response to this investigation: the scammer's domain was quietly transferred to Namecheap.

Exhibit A — NameSilo's official statement · March 13, 2026 · 11,300 views

Archived: ghostarchive.org/archive/CXXZ0  ·  SHA-256: ad29e1d3d4803ff37c88ef860bef6de9e62f6ce533657f2e5c5460eb2e0b8ebf