NameSilo (NASDAQ: URL) — a publicly traded registrar with a 32.2% dead domain rate,
a ten-year fraud under active protection, and a documented pattern of suppressing
the researchers who exposed it.
Every takedown. Every lawyer. Every deleted tweet.
All of it is in the record. All of it makes this louder.
PhishDestroy is a Hydra. You already pulled the first head.
Pedigreeless Russian dogs can write reviews about themselves and buy articles about themselves in the third person.

🔴 LIVE INVESTIGATION FEED · Auto-updated · Last fetch 2026-06-23

US  ██████████████████    966,581 (45.4%)
DE  ██████████░░░░░░░░    575,336 (27.0%)
SG  █░░░░░░░░░░░░░░░░░     79,200 (3.7%)
HK  █░░░░░░░░░░░░░░░░░     74,446 (3.5%)
NL  █░░░░░░░░░░░░░░░░░     70,351 (3.3%)
CA  █░░░░░░░░░░░░░░░░░     60,185 (2.8%)
GB  ░░░░░░░░░░░░░░░░░░     44,739 (2.1%)
BG  ░░░░░░░░░░░░░░░░░░     23,162 (1.1%)

login (10,871) · support (6,517) · crypto (6,247) · secure (6,143) · trust (5,887) · connect (5,690) · account (4,096) · official (4,041) · farm (3,427) · claim (3,352) · update (3,096) · bridge (3,013) · wallet (2,312) · vault (2,292) · token (2,064)

📊 Live web dashboard: see Pages link at top · Updated daily 06:00 UTC

This investigation is part of a series documenting ICANN-accredited registrars that systematically obstruct anti-phishing enforcement or directly profit from fraud infrastructure.

NameSilo LLC is registered in Phoenix, Arizona. NameSilo Technologies Corp is listed on the Canadian Securities Exchange (CSE: BZI via Brisio Innovations). But the actual engineering team is a Russian/CIS outsourcing operation spread across Russia, Belarus, Ukraine, Serbia, Argentina, and Latvia. At least 13+ Russian-speaking employees have been identified in the current and recent team:

The DevOps engineer who holds keys to all NameSilo infrastructure built IT systems for a Russian financial pyramid for 10 years. The PHP developer came from an adult ad network. Project managers sit in Moscow and Belgrade. The frontend developer works from sanctioned Belarus. This is not an American technology company. This is a CIS outsourcing operation with a US mailing address.

This explains everything:

• Why abuse reports are ignored — the team doing the ignoring shares the operator's language and culture
• Why the suppression playbook matches Russian cybercrime patterns
• Why a DMCA takedown request targeting coverage of xmrwallet was filed from Russia
• Why 20+ complaints from international victims and security researchers produced zero action

When you staff your "American registrar" with people whose previous jobs include financial pyramids, adult ad networks, and Russian state-connected companies — you get exactly the kind of registrar that protects a $100M+ phishing operation and calls it "customer service."

NameSilo's PrivacyGuardian privacy-shield service covers hundreds of thousands of domains. Analysis of PrivacyGuardian-shielded domains reveals systematic use by Russian-speaking fraud networks, crypto-drainer operators, and carding infrastructure.

• Offered to clear VirusTotal detections for xmrwallet[.]com operator instead of suspending the domain — direct operational assistance to an active fraud campaign.
• Blacklisted researchers who filed abuse reports, cutting off future reporting channels.
• Suppressed media coverage — coordinated deletion of tweets, articles, and references documenting NameSilo’s complicity.
• 108,000 pages deindexed from Bing in a documented suppression campaign targeting coverage of this investigation.
• Abuse reports with full evidence packages — wallet addresses, victim transaction hashes, phishing kit source, live domain screenshots — met with inaction or active interference.
• As a NASDAQ-listed company, NameSilo’s knowing failure to act on documented fraud infrastructure creates potential securities and regulatory exposure.
• Direct requests with evidence: ignored, delayed, or actively countered.

"NameSilo didn’t just ignore the report. They offered to help the fraudster. That is no longer a compliance failure — it is complicity."

They didn't end up here because we were looking for them. They ended up here because they came looking for us.

This investigation began not with a zone file, but with a threat.

When PhishDestroy started publishing evidence about xmrwallet[.]com — two parties decided the correct response was intimidation. The operator arrived with lawyers and a private detective. NameSilo arrived with platform suppression and a defamation claim on Twitter.

Every attempt was documented. Every attempt failed. Every attempt is now part of the public record.

They wanted legal consequences for us.

We want legal consequences for them.

The difference is that we have the evidence.

The investigation is MIT-licensed. It lives on the blockchain. It has been filed with ICANN and submitted to IC3. There is no version of this story that ends with the evidence gone.

Every deletion attempt is itself evidence. Every threat goes into the dossier. Every escalation increases the footprint of this case.

NameSilo, LLC (IANA #1479) — US-based, ICANN-accredited, CSE-listed registrar (ticker: URL) — publicly defended xmrwallet[.]com, a Monero wallet drainer operating continuously since ~2016, with estimated victim losses of $10–20M.

PhishDestroy submitted 20+ delivery-receipted abuse reports over three years. NameSilo took no action. On March 13, 2026, their official corporate account published a statement calling the operator "the victim," denying all reports ever arrived, and committing in writing to helping him remove his VirusTotal detections. Three other registrars (PDR, WebNic, NICENIC) reviewed the same evidence and suspended the domain within days. NameSilo wrote a press release for him.

When we proved every sentence false using the operator's own emails, NameSilo used X Gold Checkmark live-support access to lock the @Phish_Destroy research account. X's automated review cleared it in writing on April 15, 2026. The lock is still in place.

NameSilo's only documented response to this investigation: the scammer's domain was quietly transferred to Namecheap.

Full scan pipeline and raw data: pkg/raw_data/ — gzip archives, up to 499 MB uncompressed

All data in this repository was collected exclusively from publicly accessible sources:

No non-public systems were accessed. No credentials were tested. No authentication was bypassed. No victim data was processed.

This publication is conducted under:

• ICANN Registrar Accreditation Agreement §3.18 (abuse response obligations)
• CISA Coordinated Vulnerability Disclosure guidelines
• FIRST.org TLP:CLEAR definition — unlimited public sharing permitted

This research documents objectively verifiable facts: domain registration patterns, HTTP response content, and registrar abuse-response latency. These facts were publicly visible before this repository existed.

NameSilo, LLC is an ICANN-accredited registrar operating under contractual obligations to the global internet community. Publication of factual evidence of contractual non-compliance is not defamation — it is the function ICANN's transparency requirements were built to serve.

If NameSilo disputes any finding: submit documented evidence via phishdestroy.io. Findings supported by evidence will be corrected in a timestamped update.

16 SHA-256-verified screenshots · full index: case/EVIDENCE_INDEX.md

Verify integrity:

git clone [https://github.com/phishdestroy/namesilo-evidence.git](https://github.com/phishdestroy/namesilo-evidence.git)
cd namesilo-evidence/evidence && sha256sum -c ../EVIDENCE_HASHES.txt

<img src="https://user-images.githubusercontent.com/74038190/212284100-561aa473-3905-4a80-b561-0d28506553ee.gif" width="100%">