Behavioral Pattern Analysis: xmrwallet Operator vs NameSilo

The Pattern

When confronted with evidence of fraud, both the scam operator and the registrar protecting them respond the same way: not with facts, not with transparency, not with action — but with paid press releases, legal threats, and manufactured legitimacy.

Both use PR Newswire (Cision) — the same premium PR distribution platform. Both have almost no organic web presence: xmrwallet has 94 referring domains (almost all paid crypto-spam sites), NameSilo has 102 (mostly exchange filings and coupon sites). Neither entity has real organic coverage. Both rely entirely on paid placement. One buys Kwork SEO spam for 500 rubles. The other buys PR Newswire releases for $500+. Same approach. Different budget. Or the same budget.

A "volunteer open-source wallet" publishing press releases on a platform designed for publicly-traded companies is not normal. It's someone with access to a corporate PR account — or the same PR agent.

Three Improbable Coincidences

Consider these three facts together:

1. The operator invites us to subpoena the registrar — and the registrar helps him. On February 17, 2026, the xmrwallet operator emailed PhishDestroy: "Feel free to subpoena the domain registrar for my information." A guy running a ten-year crypto drainer, on $550/month bulletproof hosting in Belize, behind Russian DDoS-Guard, calmly invited a security research organization to subpoena his own registrar. Nobody behaves like that with a registrar that might shut them down. He already knew how NameSilo would react. And he was right — NameSilo not only refused to act, they publicly offered to help him remove VirusTotal security detections. The operator later escalated: "I've hired a lawyer and a private investigator" (February 23). No lawyer ever appeared. No PI ever made contact. But the confidence was real — because NameSilo had his back. This is not an adversarial relationship. This is a partnership.

2. A registrar ignores 10 years of theft reports — while laundering millions through phantom domains. xmrwallet.com has been documented stealing funds since at least 2018. GitHub issues, Trustpilot reviews, Reddit PSA threads, BitcoinTalk warnings, an FTC warning letter, ICANN complaints — all publicly available. NameSilo claims "we had received no abuse reports" and their "in-depth review found no issues." Meanwhile, the same registrar manages 5.18 million domains of which 81.5% are dead, with 615% registration spikes and serial-pattern bulk purchases (37,375 groups of sequential domains like 3967a.app/3967b.app/3967c.app). The revenue from these phantom registrations is millions of dollars annually. A company actively processing millions in suspicious domain registrations has a financial interest in not investigating fraud — because investigation leads to questions about their own revenue.

3. Both entities have nearly identical web footprints — almost no organic presence. xmrwallet: 94 referring domains, almost all purchased crypto-spam articles and Kwork-seeded links. NameSilo: 102 referring domains, mostly exchange filings, coupon affiliates, and DNS tutorials. Neither has earned organic media coverage. Both rely entirely on paid placement. Both use the same PR distribution platform (PR Newswire/Cision). The probability of a random "volunteer wallet" independently choosing the same premium corporate PR service as one specific publicly-traded Canadian registrar is vanishingly small.

Each coincidence alone might be explained away. Together, they describe a single operation: a scam wallet generates stolen crypto, the registrar launders it through phantom domain registrations, and both entities protect each other from scrutiny using threats, paid PR, and coordinated silence.

A Note From PhishDestroy

We have a victim's own screenshot of her deleted review. We have Wayback Machine snapshots proving reviews disappeared — 7 confirmed from xmrwallet, 129 from NameSilo in four months. We have PR Newswire releases from both entities on the same platform. We have the operator's email inviting us to subpoena his own registrar. We have NameSilo's public tweet threatening legal action instead of addressing a single piece of evidence. We have Yahoo Finance's own label: "This is a paid press release." We have Forbes' own disclaimer: "We earn a commission."

We are fully confident in every claim on this page. Every screenshot is real. Every Wayback Machine link is publicly verifiable. Every PR Newswire page is archived. Every deleted review name can be cross-referenced. We did not fabricate a single data point. We did not need to.

And we have more. Much more. What you see here is what we chose to publish today. There is evidence we are holding back — not because it's weak, but because we release it when it matters most. Every time they lie, we publish another layer. Every time they threaten, we add another mirror. Every time they delete, we've already archived.

Ask yourself — honestly — can there really be this many coincidences?

A scam operator invites you to subpoena his own registrar — and isn't afraid of the answer. Then he threatens you with lawyers who never appear. A "volunteer" running a "free open-source wallet" spends $500–1,500 per press release on the same corporate PR platform where his registrar files quarterly earnings. The registrar — a publicly-traded company — goes on Twitter and declares this client innocent, publicly commits to helping him remove VirusTotal detections, and tells researchers to "halt your falsehoods or face legal action." Not a word about the evidence. Not a single fact addressed.

Both entities maintain Trustpilot pages that nobody organically reads — and both obsessively clean them. Both delete negative reviews. Both plant low-quality bots. Both buy paid articles to prop up products that can't earn organic coverage on their own. Look at NameSilo's website — a registrar managing 6 million domains with a UI their own CEO admits needs a "complete UX overhaul" after seven years. Now look at xmrwallet's promotional materials — SEO articles ordered on Kwork for 500 rubles, bot tweets from accounts with anime avatars, PR Newswire releases about "charity support." The same level of taste. The same contempt for the audience. You think this is a coincidence? Or do they simply not ban themselves?

We have documentation of 31+ abuse reports submitted since 2018. Eight years of reports. NameSilo says they received none. We killed four of the operator's domains — domains registered for five to ten years each. He had paid for a decade of infrastructure because he believed it was untouchable. When we took them down, one by one — .cc through one registrar, .biz through another, each time through registrars that actually read abuse reports — the operator understood that the game had changed. But the real asset in this operation was never xmrwallet.com. xmrwallet is the storefront. The bank — the laundromat — has always been NameSilo.

We'll be direct: we have a good nose for this particular type of operator. Untalented. Predictable. Russian-speaking, based on the forensic trail. We haven't identified them by legal name yet — but we are close, and they know it. Every threat they send leaves a trace. Every review they delete confirms the pattern. Every false DMCA they file adds another exhibit. The psychology of deception is remarkably consistent: when cornered, fraudsters do not produce evidence — they produce threats. And these two entities, when cornered, produce exactly the same threats, in exactly the same tone, through exactly the same channels.

So I'll ask the question plainly: what is our motive?

PhishDestroy is a volunteer initiative. We do not sell domains. We do not compete with NameSilo. We do not hold short positions on their stock. We have no commercial interest in this investigation whatsoever. We have spent months — thousands of hours — documenting evidence, building archives, deploying to permanent immutable storage. For free. Nobody pays us. Nobody asked us to do this. We do it because people are losing money and the systems designed to protect them are failing.

So you have two options. Either we are deranged individuals who have dedicated an unreasonable amount of time to fabricating elaborate evidence against a random Canadian domain registrar, for no discernible personal gain — or they are exactly what eight years of evidence says they are: a registrar that profits from fraud, shelters a theft operation, deletes criticism, manufactures reviews, threatens researchers, ignores regulators, and hides behind press releases it writes about itself in third person.