Exclude the newcomers — the inexperienced operator who found a registrar via a Google ad or picked the cheapest option. Organised scam teams don't pick registrars by price. They pick by track record: which registrar ignores abuse reports, which privacy shield survives a takedown attempt, which reseller delivers domains fast with no questions asked.

In CIS-language fraud forums and Telegram channels, registrar recommendations circulate as operational intelligence. There are black-market resellers — "bulletproof domain" brokers — who specifically source from NICENIC, NameSilo, and similar registrars and sell to scam teams pre-configured. These resellers exist because these registrars reliably do not act on abuse reports. That is the product being sold.

When the same operator fingerprints — email clusters, favicon hashes, server stacks — appear across hundreds of domains registered at the same registrar over months: that is not coincidence. That registrar's non-enforcement is documented institutional knowledge in the criminal ecosystem. The question is not why scammers keep buying from NICENIC or NameSilo. The question is why NICENIC and NameSilo keep selling to them.

PhishDestroy is not the only source. Every major registrar receives abuse reports from APWG, PhishTank, national CERTs, ISACs, brand protection teams, and individual researchers — continuously, in volume. There is no global centralised body that audits whether those reports are actually processed, no mandatory disclosure requirement, no independent verification. A registrar can claim to have received nothing, and there is currently no mechanism to prove otherwise at speed.

NameSilo received documented abuse reports from PhishDestroy alone — more than 20, with full evidence packages, timestamped, on record. Their public position was that they had received nothing. That is not a miscommunication. That is a lie.

The same pattern is predictable across Russian-connected registrars: when confronted, the default response will be "we never received any reports." It is the only legally useful position — because receiving a report and ignoring it is not the same as never receiving one.

There is a measurable difference between registrars that treat abuse as a compliance checkbox and those that treat it as a business policy. Responsible registrars — the ones that do not want fraud operators as clients — respond to a confirmed abuse report by suspending the entire account: every domain registered by that operator, in one action. They have seen the account. They know what it is.

The registrars documented in this investigation respond differently. A complaint arrives. One domain — the reported one — may eventually be suspended. The other 200, 500, or 1,000 domains on the same account continue operating. The operator registers new ones the same day. The registrar has seen the pattern. They have chosen to look away.

KYC and reseller vetting requirements exist on paper. In practice they are either absent or trivially bypassed — a formality that provides legal cover without creating any actual barrier to a fraud operator opening an account and registering domains at scale. Our non-public investigation into registrar intake processes, conducted prior to this report, found no meaningful friction at the account-creation stage for the registrars examined here.

When NameSilo responded to documented abuse of xmrwallet[.]com — a Monero drainer with $10–20M in confirmed victim losses — by offering to clear its VirusTotal detections rather than suspending the domain: that was not a mistake. That was a choice.

Every domain in this dataset is a receipt.

The receipt exists whether the registrar acknowledges the transaction or not.