NameSilo Abuse Response and Phishing Portfolio Analysis

Documented phishing domains, targeted-report outcomes, portfolio methodology, and the PhishDestroy accountability record for NameSilo, LLC.

195,456
Total Tracked
195,454
VT Detected
88,276
Last Seen Active
98,058
Unavailable at Last Check
2
VT Pending
NameSilo

NameSilo πŸ‡ΊπŸ‡Έ

πŸ‡ΊπŸ‡Έ United States Founded 2009 IANA #1479 namesilo.com
Registrar notice Β· CRITICAL NameSilo actively retaliated against threat researchers publishing evidence of its clients

After PhishDestroy published documented receipts of NameSilo hosting a Monero drainer operation (xmrwallet.com, $20M+ in thefts, 10+ years of inaction), our @Phish_Destroy X account was reported and suspended β€” despite X's own automated review clearing the reports. NameSilo then publicly defended the scam operator rather than acting on abuse complaints. Pattern of behaviour is consistent with ICANN RAA 3.18 non-compliance: abuse reports triggered retaliation instead of mitigation.

NameSilo Killed Our Twitter β€” full report xmrwallet.com / NameSilo exposure
PhishDestroy statement Β· NameSilo Β· IANA #1479

NameSilo: a conscious choice to be what it is

NameSilo is the worst registrar, packed with cheap domains purely for volume. It wants phishing and Russian propaganda, and it employs a large number of representatives from Russia. This is a conscious choice by the registrar to be what it is.

NameSilo hates criticism. It loves buying articles about itself, promoting itself on its own domains, and writing one-line reviews about itself.

What this means in human terms:

99.65%of NameSilo's portfolio has
ZERO confirmed traffic
1 : 1.3For every 1 top-million domain,
1.3 phishing domains
387xPhishing domains outnumber
Tranco top-10K by 387x

The "dirty ratio" depends on what you compare against:

vs Total (5.18M):0.43%"barely anything"
vs Live IP (2.3M):0.98%"almost 1%"
vs HTTP alive (958K):2.34%"every 43rd site"
vs Top-million (17.8K):125.6%"more scam than legit"
vs Real business (54.8K):40.9%"1 phishing for every 2.5 businesses"

This is why NameSilo buys phantom domains. When you compare 22,000 malicious domains against 5.18 million total, it's "0.43% β€” barely anything." But when you strip away the dead weight and compare against domains that actually work, the picture changes completely. The phantom domains are a statistical smokescreen.

Report to Your Local Authorities

Choose your country to see verified official cybercrime reporting routes. Add the affected domain to prepare a local-language complaint draft.

Nothing is sent automatically. Review every fact and submit the complaint yourself through an official route.

6,543
Phishing Domains
2,143
Still Alive
4,400
Taken Down
97.4%
Detection Rate
8.0
Avg VT Score
32.8%
Alive Rate
6,543 phishing-domain abuse reports sent: NameSilo
PhishDestroy sends one primary abuse report for every phishing domain entered in its threat database. This page contains 6,543 domains registered through NameSilo, so the primary report total is 6,543. Database coverage starts Jun 30, 2025. 33% of these reported domains remain active, suggesting inadequate enforcement of abuse policies.
97.4% of domains flagged by VirusTotal 4,037 domains with VT β‰₯ 5
Tracking since Jun 2025 β€” latest: Aug 27, 2026
NameSilo, LLC 6,543 domains
Screenshot of bet63xx.com
bet63xx.com
17 VTUnknown
Screenshot of bet63xx.com
bet63xx.com
Screenshot of bet67365.co
bet67365.co
17 VTUnknownBet365
Screenshot of bet67365.co
bet67365.co
Screenshot of bet73049.com
bet73049.com
17 VTUnknown
Screenshot of bet73049.com
bet73049.com
Screenshot of bet73056.com
bet73056.com
17 VTTaken Downbet365
Screenshot of bet73056.com
bet73056.com
Screenshot of bet73060.com
bet73060.com
17 VTTaken Downbet365
Screenshot of bet73060.com
bet73060.com
Screenshot of bet73064.com
bet73064.com
17 VTUnknownBet365
Screenshot of bet73064.com
bet73064.com
Screenshot of bet73071.com
bet73071.com
17 VTUnknownBet365
Screenshot of bet73071.com
bet73071.com
Screenshot of bet73kk.com
bet73kk.com
17 VTActiveBet365
Screenshot of bet73kk.com
bet73kk.com
Screenshot of bet83080.com
bet83080.com
17 VTUnknownbet365
Screenshot of bet83080.com
bet83080.com
Screenshot of bet83084.com
bet83084.com
17 VTUnknownBet365
Screenshot of bet83084.com
bet83084.com
Screenshot of bet83086.com
bet83086.com
17 VTUnknownbet365
Screenshot of bet83086.com
bet83086.com
Screenshot of bet83099.com
bet83099.com
17 VTUnknownBet365
Screenshot of bet83099.com
bet83099.com
blackhatusa.com
17 VTActive
blox.gamestreambunker.com
17 VTUnknowngoogle
Screenshot of btc-veralith-v30.sbs
btc-veralith-v30.sbs
17 VTActive
Screenshot of btc-veralith-v30.sbs
btc-veralith-v30.sbs
Screenshot of bybitrade.com
bybitrade.com
17 VTUnknownBybit
Screenshot of bybitrade.com
bybitrade.com
Screenshot of bybmarket.xyz
bybmarket.xyz
17 VTUnknownBybit
Screenshot of bybmarket.xyz
bybmarket.xyz
Screenshot of ccnyiw3564.click
ccnyiw3564.click
17 VTActive
Screenshot of ccnyiw3564.click
ccnyiw3564.click
Screenshot of ceza-davalarim.xyz
ceza-davalarim.xyz
17 VTUnknownGoogle
Screenshot of ceza-davalarim.xyz
ceza-davalarim.xyz
chamlang.ekklesiadallas.info
17 VTActiveallegro
Screenshot of coinbaseset.com
coinbaseset.com
17 VTUnknownCoinbase
Screenshot of coinbaseset.com
coinbaseset.com
customersupportonline247.com
17 VTActive
Screenshot of dasi303.com
dasi303.com
17 VTActiveMicrosoft
Screenshot of dasi303.com
dasi303.com
Screenshot of decameronaquarium.hoteltodoincluido.org
decameronaquarium.hoteltodoincluido.org
17 VTActive
Screenshot of decameronaquarium.hoteltodoincluido.org
decameronaquarium.hoteltodoincluido.org
Screenshot of dic9t524.cc
dic9t524.cc
17 VTUnknownacross
Screenshot of dic9t524.cc
dic9t524.cc
docusign.nzworldtravel.com
17 VTUnknown
Screenshot of ecxodus.com
ecxodus.com
17 VTUnknownacross
Screenshot of ecxodus.com
ecxodus.com
ellisgroupofma.info
17 VTActive
Screenshot of env.ghanaposta.cc
env.ghanaposta.cc
17 VTUnknown["x.com"]
Screenshot of env.ghanaposta.cc
env.ghanaposta.cc
Screenshot of esxxnsg.top
esxxnsg.top
17 VTActiveMetaMask
Screenshot of esxxnsg.top
esxxnsg.top
Screenshot of ethereumfund.top
ethereumfund.top
17 VTUnknownEthereum
Screenshot of ethereumfund.top
ethereumfund.top
Screenshot of eulersflnencs.org
eulersflnencs.org
17 VTUnknownAngel Draineracross
Screenshot of eulersflnencs.org
eulersflnencs.org
Screenshot of exodusdy.com
exodusdy.com
17 VTActiveExodus
Screenshot of exodusdy.com
exodusdy.com
Screenshot of exodusfm.com
exodusfm.com
17 VTCloaked Β· LiveExodus
Screenshot of exodusfm.com
exodusfm.com
Screenshot of fffddds.top
fffddds.top
17 VTTaken Downamazon
Screenshot of fffddds.top
fffddds.top
Screenshot of fifa-gs.com
fifa-gs.com
17 VTActivefifa
Screenshot of fifa-gs.com
fifa-gs.com
fifa.beer
17 VTTaken Downfifa
fifa.click
17 VTUnknown
Screenshot of financexau.com
financexau.com
17 VTUnknown
Screenshot of financexau.com
financexau.com
Screenshot of fintech-assets.com
fintech-assets.com
17 VTUnknowncryptoscam
Screenshot of fintech-assets.com
fintech-assets.com
Screenshot of folkfi.one
folkfi.one
17 VTActive
Screenshot of folkfi.one
folkfi.one
Screenshot of freegift-pump.fun
freegift-pump.fun
17 VTUnknownPump.fun
Screenshot of freegift-pump.fun
freegift-pump.fun
Screenshot of galabet116o.com
galabet116o.com
17 VTUnknown["whatsapp"]
Screenshot of galabet116o.com
galabet116o.com
Screenshot of gbgltuatjn.yoga
gbgltuatjn.yoga
17 VTUnknownApple
Screenshot of gbgltuatjn.yoga
gbgltuatjn.yoga
gemini-coins.sbs
17 VTActiveGemini
Screenshot of getsupport-find.com
getsupport-find.com
17 VTCloaked Β· Liveapple
Screenshot of getsupport-find.com
getsupport-find.com
Screenshot of ggooglemeetinginterview.live
ggooglemeetinginterview.live
17 VTActiveApple
Screenshot of ggooglemeetinginterview.live
ggooglemeetinginterview.live
h5mijp.cfd
17 VTUnknown
Screenshot of helpazinvest.com
helpazinvest.com
17 VTUnknownGoogle
Screenshot of helpazinvest.com
helpazinvest.com
homepage-secure.com
17 VTCloaked Β· Liveport3
Screenshot of horinvexs.com
horinvexs.com
17 VTUnknownacross
Screenshot of horinvexs.com
horinvexs.com
Screenshot of i9eobtiy.cc
i9eobtiy.cc
17 VTUnknownacross
Screenshot of i9eobtiy.cc
i9eobtiy.cc
Screenshot of icloud-searchdevice.help
icloud-searchdevice.help
17 VTUnknownApple
Screenshot of icloud-searchdevice.help
icloud-searchdevice.help
Screenshot of idlocate-phone.us
idlocate-phone.us
17 VTCloaked Β· Liveapple
Screenshot of idlocate-phone.us
idlocate-phone.us
Screenshot of iiooss.top
iiooss.top
17 VTUnknownamazon
Screenshot of iiooss.top
iiooss.top
Screenshot of iphonefuwu.com
iphonefuwu.com
17 VTUnknownApple
Screenshot of iphonefuwu.com
iphonefuwu.com
Screenshot of japvf.devopsarcana.com
japvf.devopsarcana.com
17 VTActiveCoinbase
Screenshot of japvf.devopsarcana.com
japvf.devopsarcana.com
Screenshot of jl.ci67.com
jl.ci67.com
17 VTActiveMetaMask
Screenshot of jl.ci67.com
jl.ci67.com
Screenshot of kaias.org
kaias.org
17 VTActive
Screenshot of kaias.org
kaias.org
Screenshot of kamusorgulama.net
kamusorgulama.net
17 VTUnknown
Screenshot of kamusorgulama.net
kamusorgulama.net
Screenshot of katana138.net
katana138.net
17 VTUnknowntelegram
Screenshot of katana138.net
katana138.net
Screenshot of kazero.cc
kazero.cc
17 VTUnknowngenericcrypto
Screenshot of kazero.cc
kazero.cc
Screenshot of kraken.i2005.buzz
kraken.i2005.buzz
17 VTActiveKraken
Screenshot of kraken.i2005.buzz
kraken.i2005.buzz
Screenshot of ladlweiaa32.com
ladlweiaa32.com
17 VTUnknownacross
Screenshot of ladlweiaa32.com
ladlweiaa32.com
Screenshot of ledger-wallet.io
ledger-wallet.io
17 VTUnknownLedger
Screenshot of ledger-wallet.io
ledger-wallet.io
Screenshot of legion.best
legion.best
17 VTActive
Screenshot of legion.best
legion.best
Screenshot of lingleme.top
lingleme.top
17 VTUnknownAmazon
Screenshot of lingleme.top
lingleme.top
Screenshot of lionsgateinvestment.trade
lionsgateinvestment.trade
17 VTUnknowncoinbase
Screenshot of lionsgateinvestment.trade
lionsgateinvestment.trade
Screenshot of lisa238.com
lisa238.com
17 VTActive
Screenshot of lisa238.com
lisa238.com
Screenshot of longmao.110407.xyz
longmao.110407.xyz
17 VTUnknowngemini
Screenshot of longmao.110407.xyz
longmao.110407.xyz
Screenshot of luckyauracasino.click
luckyauracasino.click
17 VTUnknowngenericcrypto
Screenshot of luckyauracasino.click
luckyauracasino.click
Screenshot of m.258877.co
m.258877.co
17 VTTaken DownBet365
Screenshot of m.258877.co
m.258877.co
Screenshot of m.allinonegalaxy.com
m.allinonegalaxy.com
17 VTActive
Screenshot of m.allinonegalaxy.com
m.allinonegalaxy.com
Screenshot of m.ying8868.com
m.ying8868.com
17 VTActive
Screenshot of m.ying8868.com
m.ying8868.com
Screenshot of maiifjq.top
maiifjq.top
17 VTUnknownFacebook
Screenshot of maiifjq.top
maiifjq.top
mail-primicias.dvhtechnology.com
17 VTUnknownmicrosoft
Screenshot of mail-quantstamp.dvhtechnology.com
mail-quantstamp.dvhtechnology.com
17 VTUnknownmicrosoft
Screenshot of mail-quantstamp.dvhtechnology.com
mail-quantstamp.dvhtechnology.com
mail-wellcertified.dvhtechnology.com
17 VTUnknownmicrosoft
Screenshot of mail.apple.com-l.cloud
mail.apple.com-l.cloud
17 VTUnknownApple
Screenshot of mail.apple.com-l.cloud
mail.apple.com-l.cloud
mail.col-sopportcloud.top
17 VTUnknownApple
mail.quantumnexusledger.com
17 VTActiveLedger
mail.ubicacionsatelital.help
17 VTUnknownApple
marketingpulse.live
17 VTActivecryptoscam
Screenshot of maxwin.casino
maxwin.casino
17 VTUnknowngenericcrypto
Screenshot of maxwin.casino
maxwin.casino
Screenshot of meta-mask.live
meta-mask.live
17 VTCloaked Β· LiveMetaMask
Screenshot of meta-mask.live
meta-mask.live
Screenshot of metamaskcard.live
metamaskcard.live
17 VTUnknownMetaMask
Screenshot of metamaskcard.live
metamaskcard.live
Screenshot of moonwealth.top
moonwealth.top
17 VTUnknown
Screenshot of moonwealth.top
moonwealth.top
mostbet-uz-kirish-mostbet.com
17 VTCloaked Β· Live
Screenshot of multibit.info
multibit.info
17 VTActiveBitcoin
Screenshot of multibit.info
multibit.info
Screenshot of office.redstarsoft.net
office.redstarsoft.net
17 VTActiveMicrosoft
Screenshot of office.redstarsoft.net
office.redstarsoft.net
Screenshot of onedrivese.online
onedrivese.online
17 VTActiveMicrosoft
Screenshot of onedrivese.online
onedrivese.online
otpuss.top
17 VTActive
Screenshot of paludewa777.com
paludewa777.com
17 VTUnknownroblox
Screenshot of paludewa777.com
paludewa777.com
Screenshot of pdrop.securedledgernano.com
pdrop.securedledgernano.com
17 VTUnknownLedger
Screenshot of pdrop.securedledgernano.com
pdrop.securedledgernano.com
Screenshot of peakprofitexchange.com
peakprofitexchange.com
17 VTActive
Screenshot of peakprofitexchange.com
peakprofitexchange.com
platforms.markusscholz.info
17 VTActive
Screenshot of post-nhncafe.com
post-nhncafe.com
17 VTUnknown
Screenshot of post-nhncafe.com
post-nhncafe.com
Screenshot of qelarolt.org
qelarolt.org
17 VTActiveargent
Screenshot of qelarolt.org
qelarolt.org
Screenshot of quantyxintel.top
quantyxintel.top
17 VTTaken DownGoogle
Screenshot of quantyxintel.top
quantyxintel.top
richbotrevolutions.cfd
17 VTActive
Β« Prev 2 3 4 5 6 7 8 Next Β» Page 5 of 66

Browse by Registrar

Select a registrar to see all flagged domains registered through them.

NiceNIC 28,997 Cloudflare 21,482 Dynadot 10,868 PDR Ltd. d/b/a PublicDomainRe... 8,036 Namecheap 7,828 GoDaddy 6,667 NameSilo 6,543 Gname.com Pte. Ltd. 6,527 WebNIC 5,152 Global Domain Group 4,377 Trustname.com 4,243 Tucows 4,217 Wix Studio 4,093 Hostinger 3,402 Vercel 2,859 GitHub, Inc. 2,765 MarkMonitor 2,587 Dominet (HK) Limited 2,205 Spaceship, Inc. 2,164 OwnRegistrar, Inc. 2,013 Netlify 1,976 Hosting Concepts B.V. d/b/a R... 1,743 Cloudflare Pages 1,724 Name.com 1,668 CSC Corporate Domains, Inc. 1,601 MAT BAO CORPORATION 1,488 Cosmotown 1,447 REGRU-RU 1,428 Key-Systems 1,411 Squarespace Domains II 1,295

Showing 6,543 domains above

Browse by Drainer Type

Wallet drainer kits detected on phishing domains.

Angel Drainer 4,415 Solana Drainer 2,671 Wallet Connect Abuse 1,673 Inferno Drainer 41 Ice Phishing 40 wallet_drainer 31 Unknown Drainer 7 known_drainer_kit 1 MS Drainer 1 Venom Drainer 1

Browse by Scam Kit

Common scam campaign types detected by page title analysis.

Gambler Scam 9,892 Airdrop Scam 6,268 Seed Phrase Phishing 744 Wallet Connect Abuse 598 Token Presale 237 Recovery Scam 97 Verification Scam 67 Giveaway Scam 58 NFT Mint 51 Credential Phishing 31 Staking Scam 8 Prize Scam 3 Steam Phishing 3

Browse by Target Brand

Legitimate brands being impersonated by phishing sites.

Ledger 7,747 genericcrypto 7,736 across 6,798 Google 6,364 Coinbase 4,214 MetaMask 3,899 Trezor 3,427 Solana 3,045 Ethereum 2,953 genericcloudflare 2,919 Binance 2,592 Kraken 2,495 Facebook 2,242 cryptoscam 1,827 Cloudflare 1,606 Apple 1,546 x.com 1,439 base 1,431 Microsoft 1,324 Bet365 1,320

Browse by Scam Type

Classification of phishing campaigns by attack methodology and social engineering technique.

AML Scam 2,033 Seed Phrase Theft 19 Airdrop Scam 8,312 Investment Scam 333

Threat Response Pipeline

How every domain in this hub is verified and how confirmed threats are neutralized. Full pipeline visualization β†’

Threat Intelligence Checksβ€” every domain is scanned & cross-checked against:
urlscan.ioScreenshot Β· DOM Β· HTTPVirusTotal90+ AV enginesGoogle Safe BrowsingTransparency ReportCloudflare RadarDNS Β· certs Β· categoriesAlienVault OTXThreat-intel pulsesWayback MachineHistorical evidenceabuse.ch ThreatFoxIOC correlationcrt.shCertificate TransparencyDNS Security FiltersQuad9 Β· AdGuard Β· CleanBrowsingWeb-CheckFull surface scan
Global Vendor Syncβ€” confirmed detections are pushed to 29 partners:
GoogleSafe BrowsingGoogleWeb Risk APIMicrosoftSmartScreenVirusTotalDetection feedCloudflareRadar / 1.1.1.1YandexSafe BrowsingURLScan.ioPublic scanESETWebGuardBitdefenderThreat exchangeNortonSafe WebSymantecSiteReviewAviraCloud detectionAvast / AVGWeb ShieldKasperskyOpenTIPDr.WebOnline scannerNetcraftTakedown APIPhishTankVerified voteAPWG eCXBulk feedPhishStatsOpen feedPhish.ReportHosting abuseSpamhausDBL feedPolySwarmMarketplaceCheckPhishBolster scanQutteraMalware scanURLquerySandboxCriminal IPAsset intelCRDFThreat CenterScamadviserTrust scoreMyWOTWeb of Trust