# NameSilo, LLC — PhishDestroy Threat Report Source: https://phishdestroy.io/domain/?registrar=NameSilo%2C+LLC Generated: 2026-10-11T11:05:45+00:00 ## Registrar profile Brand: NameSilo IANA ID: 1479 Country: US Founded: 2009 Website: https://namesilo.com ## ⚠️ BAD-FAITH NOTICE — CRITICAL NameSilo actively retaliated against threat researchers publishing evidence of its clients After PhishDestroy published documented receipts of NameSilo hosting a Monero drainer operation (xmrwallet.com, $20M+ in thefts, 10+ years of inaction), our @Phish_Destroy X account was reported and suspended — despite X's own automated review clearing the reports. NameSilo then publicly defended the scam operator rather than acting on abuse complaints. Pattern of behaviour is consistent with ICANN RAA 3.18 non-compliance: abuse reports triggered retaliation instead of mitigation. ### Evidence - NameSilo Killed Our Twitter — full report: https://phishdestroy.io/namesilo-killed-our-twitter - xmrwallet.com / NameSilo exposure: https://phishdestroy.io/xmrwallet-namesilo-exposed ## PhishDestroy statement NameSilo is the worst registrar, packed with cheap domains purely for volume. It wants phishing and Russian propaganda, and it employs a large number of representatives from Russia. This is a conscious choice by the registrar to be what it is. NameSilo hates criticism. It loves buying articles about itself, promoting itself on its own domains, and writing one-line reviews about itself. We believe that a registrar relying on an outsourced operation staffed by scammers and employees of Russian state projects needs to understand one basic point: it must respect the laws of every country, not only Russia's. NameSilo presents itself as an American registrar, not as a safe haven for Russian scams and propaganda. We strongly recommend avoiding every NameSilo service, including the services of its sewer-cleaning company, and especially domain registration. These people clearly understand what they are doing and why. ## What this means in human terms - 99.65% of NameSilo's portfolio has ZERO confirmed traffic. - For every 1 top-million domain, there are 1.3 phishing domains. - Phishing domains outnumber Tranco top-10K domains by 387x. - 0.43% vs 5.18M total domains: barely anything. - 0.98% vs 2.3M domains with a live IP: almost 1%. - 2.34% vs 958K HTTP-alive domains: every 43rd site. - 125.6% vs 17.8K Top-million domains: more scam than legit. - 40.9% vs 54.8K real-business domains: 1 phishing for every 2.5 businesses. This is why NameSilo buys phantom domains. When you compare 22,000 malicious domains against 5.18 million total, it is 0.43% — barely anything. Strip away the dead weight and compare against domains that actually work, and the picture changes completely. The phantom domains are a statistical smokescreen. ## No authority. No accountability. For this registrar there are no authorities. Its abuse department believes it has the right and authority to help clients remove antivirus detections. From the 2018 precedent, we know that ICANN is fine with this. Therefore, we urge victims not to waste time on ICANN or NameSilo's abuse department and to contact local law enforcement directly. ## Threat statistics - Flagged phishing domains in PhishDestroy DB: 7,170 - Last seen active: 1,796 (25%) - Unavailable at latest stored check: 5,374 - VirusTotal-detected: 6,998 (97.6% detection rate) - Avg VT detections (non-zero): 8.1 - High-confidence threats (VT ≥ 5): 4,513 - First flagged: 2025-06-30 14:45:50 - Last flagged: 2026-10-11 11:58:41 ## Sample flagged domains (top 50 by VT detections) - t-mobile.ndilcz.top [VT:25, status:dead] → https://phishdestroy.io/domain/t-mobile.ndilcz.top/ - t-mobile.rmlcws.top [VT:25, status:dead] → https://phishdestroy.io/domain/t-mobile.rmlcws.top/ - login.authsharedepointsonline.top [VT:24, status:dead] → https://phishdestroy.io/domain/login.authsharedepointsonline.top/ - seguroseguroautosoap.sbs [VT:24, status:dead] → https://phishdestroy.io/domain/seguroseguroautosoap.sbs/ - t-mobile.eblgrq.top [VT:24, status:dead] → https://phishdestroy.io/domain/t-mobile.eblgrq.top/ - t-mobile.gaiqbf.top [VT:24, status:dead] → https://phishdestroy.io/domain/t-mobile.gaiqbf.top/ - t-mobile.gyftxi.top [VT:24, status:dead] → https://phishdestroy.io/domain/t-mobile.gyftxi.top/ - t-mobile.hpwnqk.top [VT:24, status:dead] → https://phishdestroy.io/domain/t-mobile.hpwnqk.top/ - t-mobile.oktdfz.top [VT:24, status:dead] → https://phishdestroy.io/domain/t-mobile.oktdfz.top/ - t-mobile.pkwnyz.top [VT:24, status:dead] → https://phishdestroy.io/domain/t-mobile.pkwnyz.top/ - bet73099.com [VT:23, status:dead] → https://phishdestroy.io/domain/bet73099.com/ - pago-online.sbs [VT:23, status:dead] → https://phishdestroy.io/domain/pago-online.sbs/ - t-mobile.feqwrc.top [VT:23, status:dead] → https://phishdestroy.io/domain/t-mobile.feqwrc.top/ - t-mobile.gtfzvs.top [VT:23, status:dead] → https://phishdestroy.io/domain/t-mobile.gtfzvs.top/ - t-mobile.gvesjo.top [VT:23, status:dead] → https://phishdestroy.io/domain/t-mobile.gvesjo.top/ - t-mobile.jmzbxw.top [VT:23, status:dead] → https://phishdestroy.io/domain/t-mobile.jmzbxw.top/ - t-mobile.kbstxv.top [VT:23, status:dead] → https://phishdestroy.io/domain/t-mobile.kbstxv.top/ - t-mobile.mgsclu.top [VT:23, status:dead] → https://phishdestroy.io/domain/t-mobile.mgsclu.top/ - t-mobile.mlcszj.top [VT:23, status:dead] → https://phishdestroy.io/domain/t-mobile.mlcszj.top/ - t-mobile.ogmysr.top [VT:23, status:dead] → https://phishdestroy.io/domain/t-mobile.ogmysr.top/ - t-mobile.onmilz.top [VT:23, status:dead] → https://phishdestroy.io/domain/t-mobile.onmilz.top/ - t-mobile.vejdfs.top [VT:23, status:dead] → https://phishdestroy.io/domain/t-mobile.vejdfs.top/ - t-mobile.vemcwf.top [VT:23, status:dead] → https://phishdestroy.io/domain/t-mobile.vemcwf.top/ - t-mobile.ymbjqc.top [VT:23, status:dead] → https://phishdestroy.io/domain/t-mobile.ymbjqc.top/ - t-mobile.zmsfne.top [VT:23, status:dead] → https://phishdestroy.io/domain/t-mobile.zmsfne.top/ - tk-h5.spys1010.vip [VT:23, status:dead] → https://phishdestroy.io/domain/tk-h5.spys1010.vip/ - bet298.co [VT:22, status:alive] → https://phishdestroy.io/domain/bet298.co/ - ds4windows.io [VT:22, status:dead] → https://phishdestroy.io/domain/ds4windows.io/ - emsysten.top [VT:22, status:dead] → https://phishdestroy.io/domain/emsysten.top/ - galabet10711.com [VT:22, status:dead] → https://phishdestroy.io/domain/galabet10711.com/ - ghjgfree.top [VT:22, status:dead] → https://phishdestroy.io/domain/ghjgfree.top/ - grabfree.top [VT:22, status:dead] → https://phishdestroy.io/domain/grabfree.top/ - hungfapeper.sbs [VT:22, status:dead] → https://phishdestroy.io/domain/hungfapeper.sbs/ - mongolianews.info [VT:22, status:dead] → https://phishdestroy.io/domain/mongolianews.info/ - t-mobile.chzqwo.top [VT:22, status:dead] → https://phishdestroy.io/domain/t-mobile.chzqwo.top/ - t-mobile.dgyrte.top [VT:22, status:dead] → https://phishdestroy.io/domain/t-mobile.dgyrte.top/ - t-mobile.ibegmp.top [VT:22, status:dead] → https://phishdestroy.io/domain/t-mobile.ibegmp.top/ - t-mobile.kbnisa.top [VT:22, status:dead] → https://phishdestroy.io/domain/t-mobile.kbnisa.top/ - t-mobile.kxgoni.top [VT:22, status:dead] → https://phishdestroy.io/domain/t-mobile.kxgoni.top/ - t-mobile.lugodh.top [VT:22, status:dead] → https://phishdestroy.io/domain/t-mobile.lugodh.top/ - t-mobile.sokqtg.top [VT:22, status:dead] → https://phishdestroy.io/domain/t-mobile.sokqtg.top/ - t-mobile.ugamtw.top [VT:22, status:dead] → https://phishdestroy.io/domain/t-mobile.ugamtw.top/ - t-mobile.vwrxch.top [VT:22, status:dead] → https://phishdestroy.io/domain/t-mobile.vwrxch.top/ - testamentenligne.info [VT:22, status:dead] → https://phishdestroy.io/domain/testamentenligne.info/ - un5nu885wq5t1nyda79cugcxxttg.login.authsharedepointsonline.top [VT:22, status:dead] → https://phishdestroy.io/domain/un5nu885wq5t1nyda79cugcxxttg.login.authsharedepointsonline.top/ - whcipring.top [VT:22, status:dead] → https://phishdestroy.io/domain/whcipring.top/ - 0wf0acct.us [VT:21, status:dead] → https://phishdestroy.io/domain/0wf0acct.us/ - b45038.com [VT:21, status:dead] → https://phishdestroy.io/domain/b45038.com/ - bet73aa.com [VT:21, status:dead] → https://phishdestroy.io/domain/bet73aa.com/ - bet83088.com [VT:21, status:dead] → https://phishdestroy.io/domain/bet83088.com/ ## Links - Full interactive hub: https://phishdestroy.io/domain/?registrar=NameSilo%2C+LLC - Site-wide LLM feed: https://phishdestroy.io/llms.txt - Report abuse / appeals: https://phishdestroy.io/appeals/