https://phishdestroy.io/news Investigations, threat research, registrar accountability reports and platform updates from PhishDestroy. en Sun, 23 Aug 2026 03:25:01 +0000 https://phishdestroy.io/steam-api-scam-exposed https://phishdestroy.io/steam-api-scam-exposed An in-depth profile of private scam panel mechanics, the five offer swap algorithms, maFile phishing bundles, and why Steam's 'anti-scam' measures are a calculated business strategy. Fri, 21 Aug 2026 00:00:00 +0000 https://phishdestroy.io/valve-profits-from-stolen-accounts https://phishdestroy.io/valve-profits-from-stolen-accounts 897,000+ stolen accounts live on LZT Market across 16 platforms. $40M+ in criminal listings. $450M estimated victim liability. Five legal vectors. Interactive forensics. Live intelligence dashboard. Valve's decade of profitable blindness — documented. Fri, 14 Aug 2026 00:00:00 +0000 https://phishdestroy.io/steam-shadow-economy https://phishdestroy.io/steam-shadow-economy Valve’s regional pricing, outsourced support, item economy, the CEVA Logistics breach, and the European legal response. Wed, 12 Aug 2026 00:00:00 +0000 https://phishdestroy.io/seed-security-score https://phishdestroy.io/seed-security-score Coldcard, Trust Wallet and Libbitcoin produced valid wallet seeds from dangerously small keyspaces. Read the evidence and check how yours was generated. Thu, 06 Aug 2026 00:00:00 +0000 https://phishdestroy.io/dns-abuse-enforcement-framework https://phishdestroy.io/dns-abuse-enforcement-framework Measurable DNS abuse response: proportionate action, transparent decisions, safeguards and rapid appeals. Sun, 02 Aug 2026 00:00:00 +0000 https://phishdestroy.io/icann-155-million-illusion https://phishdestroy.io/icann-155-million-illusion A cartel wants the money, refuses outside regulation, and ignores its own contracts. Three toothless Trustname breach notices, one “inadvertently” unblocked card-stealing domain, a 60-day grace period — and $155M a year for it. RegisterFly, EstDomains, Epik, NameSilo: same pattern. Wed, 22 Jul 2026 00:00:00 +0000 https://phishdestroy.io/namesilo-investigation/ https://phishdestroy.io/namesilo-investigation/ NameSilo first defended xmrwallet. After the wallet had already closed, PhishDestroy argues that the remaining campaign protected the registrar itself: overlapping SEO topics, review manipulation patterns, paid PR distribution, and attempts to remove individual search results — documented with 27 source articles and archived evidence. Thu, 02 Jul 2026 00:00:00 +0000 https://phishdestroy.io/registrar-accountability/ https://phishdestroy.io/registrar-accountability/ A live, evidence-based scoreboard built from every abuse report we send: confirmed-suspension rate, response times, repeat-report escalations, and how many reported domains each registrar never suspended. Deterministic, reproducible, MIT-licensed, updated daily. Fri, 10 Jul 2026 00:00:00 +0000 https://phishdestroy.io/we-are-no-longer-volunteers https://phishdestroy.io/we-are-no-longer-volunteers Why we are retiring a word weaponized against the public interest — when ICANN (a $50M non-profit) and a decade-long wallet thief both call themselves “volunteers,” the word protects only the entities hiding behind it. https://phishdestroy.io/the-real-enemy-is-the-registrar https://phishdestroy.io/the-real-enemy-is-the-registrar An op-ed: scammers are cheap, replaceable foot soldiers. The scam economy runs on registrars that sell silence — and an ICANN that won't enforce. $16B lost in 2024; phishing up 180% since 2021. Make impunity expensive. Wed, 08 Jul 2026 00:00:00 +0000 https://phishdestroy.io/icann-cybercrime-economy-exposed https://phishdestroy.io/icann-cybercrime-economy-exposed Full enumeration of ShortDot SA (Luxembourg) — 7 zones (.icu, .bond, .cyou, .sbs, .cfd, .buzz, .qpon), 6.2M domains and 51,670 brand-impersonation sites targeting Chase, Binance, MetaMask & Ledger. .bond ranks #3 worldwide for phishing. IOC feeds + daily updates. https://phishdestroy.io/behind-the-investigation https://phishdestroy.io/behind-the-investigation Monero leaves no blockchain trail. So we hunted differently. We injected 21 million decoy seed phrases into xmrwallet, burned 200K+ tweets as bait on X, and filed 11–12 abuse complaints NameSilo ignored on schedule. Every Medium article they deindexed, every DMCA they filed against us, every Twitter ban they triggered — logged by the receiving platform, timestamped, subpoenable. Same requester, same speed, same platforms — for both NameSilo and xmrwallet. That behavioral fingerprint is the case. "They thought they were silencing us. They were building our case." Sat, 16 May 2026 00:00:00 +0000 https://phishdestroy.io/namesilo-killed-our-twitter https://phishdestroy.io/namesilo-killed-our-twitter @Phish_Destroy is banned on X. X's automated review: "no violation, account restored to full functionality." Account still gone. Two weeks earlier we exposed NameSilo sheltering a $20M+ crypto-theft operation with victims across multiple regions — now under active EU criminal investigation. Same playbook NameSilo ran for the scammer — weaponize a bureaucratic process — now running against us. Where's the paid gold-checkmark human support? Where's the unban the automation already granted? Where's our refund? Wed, 15 Apr 2026 00:00:00 +0000 https://phishdestroy.io/seed-flooding/ https://phishdestroy.io/seed-flooding/ We flood active phishing forms with fake seed phrases. It buries the real victim submissions under thousands of decoys, poisons the drainer's credential pool, and forces the operator to sink hours triaging worthless data — often enough to abandon the campaign. This article explains why it works, how we do it responsibly, and why it is not illegal: no unauthorized access (the form is public and explicitly asks for input), no damage to legitimate systems (the site has no legitimate users), no violation of CFAA/Computer Misuse Act (feeding a public form deceptive data submitted voluntarily is not hacking). Full methodology, legal analysis, and real takedown results inside. Tue, 31 Mar 2026 00:00:00 +0000 https://phishdestroy.io/trustname-bulletproof-exposed/ https://phishdestroy.io/trustname-bulletproof-exposed/ IANA #4318. €120 declared annual revenue. 1 employee. Negative equity. Deletion notice published. Two Belarusian owners. Six fake crypto casinos registered in a single week — one calling itself “Elon Musk’s Official Casino” — all hidden behind Trustname’s own offshore privacy proxies. The registrar literally calls itself bulletproof in its own DNS TXT record. Tue, 14 Apr 2026 00:00:00 +0000 https://phishdestroy.io/telegram-bot-analyzer/ https://phishdestroy.io/telegram-bot-analyzer/ Extract complete message history, identify users with account age estimation, detect stolen credentials, credit cards, crypto wallets, seed phrases and API keys. Branded intelligence reports with interactive charts. Fri, 03 Apr 2026 00:00:00 +0000 https://phishdestroy.io/seo-hijack/ https://phishdestroy.io/seo-hijack/ How crypto scammers exploit Yahoo SERP injection and PBN networks to rank phishing sites #1 on Bing and DuckDuckGo, stealing millions from search users. Mon, 30 Mar 2026 00:00:00 +0000 https://phishdestroy.io/xmrwallet-namesilo-exposed https://phishdestroy.io/xmrwallet-namesilo-exposed A 10-year, $2M+ Monero theft operation — finally destroyed. Three registrars suspended the domains. NameSilo fabricated a cover story, called the scammer “the victim,” and helped suppress VirusTotal alerts. We proved 7 lies, filed with ICANN and law enforcement. The domain is dead. The registrar’s reputation should be too. Fri, 27 Mar 2026 00:00:00 +0000 https://phishdestroy.io/registrar-abuse-response-failure https://phishdestroy.io/registrar-abuse-response-failure 16 antivirus detections. 13 reports. 1,788 hours online. Real data from our abuse escalation log shows registrars ignoring evidence-packed reports while phishing domains stay active for months. Who in their abuse department overrules Kaspersky, ESET, and Fortinet? Sun, 22 Mar 2026 00:00:00 +0000 https://phishdestroy.io/dopomogvoina-exposed https://phishdestroy.io/dopomogvoina-exposed A fake military aid foundation targeting Ukrainian veterans. 5 banks cloned with real-time operator control. One misconfigured file on a shared server exposed the entire operation — operators identified via 6 Telegram API calls. Full behavioral analysis of 261 messages reveals a cross-border criminal enterprise. Wed, 25 Mar 2026 00:00:00 +0000 https://phishdestroy.io/phishing-anatomy https://phishdestroy.io/phishing-anatomy We intercepted live phishing traffic, reverse-engineered 8 seed phrase stealers, and traced data to Telegram bots, EmailJS, FormSubmit, custom C2 APIs, and PhaaS backends. 1,824+ stolen credentials. Total attacker cost: $0. Fri, 27 Mar 2026 00:00:00 +0000 https://phishdestroy.io/trustwallet-panel-exposed https://phishdestroy.io/trustwallet-panel-exposed Full takedown of a Russian-speaking scam operation running a fake Trust Wallet support panel with live chat, staking simulation, and multi-operator support. 1,900 victim sessions dumped via IDOR, 21 scammer wallets tracked, primary actor deanonymized. Sun, 01 Mar 2026 00:00:00 +0000 https://phishdestroy.io/scam-infrastructure-exposed https://phishdestroy.io/scam-infrastructure-exposed 4 live scam backends analyzed — Firebase with open Firestore rules, Supabase with full CRUD access, Express.js with zero auth, and a 19K-seed drainer campaign. All trivially deanonymizable. Wed, 18 Feb 2026 00:00:00 +0000 https://phishdestroy.io/buytrx-drainer-exposed https://phishdestroy.io/buytrx-drainer-exposed Full infrastructure teardown: 55+ phishing domains, unauthenticated APIs leaking victim data, on-chain drainer contracts, Google Ads funding, and Chinese-language operators exposed. Sun, 08 Feb 2026 00:00:00 +0000 https://phishdestroy.io/xmrwallet-exposed https://phishdestroy.io/xmrwallet-exposed Forensic investigation: Monero web wallet leaks your private view key 40+ times per session via Base64 session tokens, then nullifies your transaction with raw_tx = 0. Operator identified. Mon, 16 Mar 2026 00:00:00 +0000 https://phishdestroy.io/cloaking-whitepages-explained https://phishdestroy.io/cloaking-whitepages-explained How scammers use cloaking, white pages, and TDS systems to hide phishing from security scanners while targeting real victims. 50,000+ sites analyzed. Sun, 29 Mar 2026 00:00:00 +0000 https://phishdestroy.io/keitaro-tds-exposed https://phishdestroy.io/keitaro-tds-exposed 50,000+ sites scanned, 1,565 admin panels discovered, 0% legitimate use rate. Criminal clients include EvilCorp, LockBit, and VexTrio. Open-source detection tools released. Wed, 10 Dec 2025 00:00:00 +0000 https://phishdestroy.io/scam-team-operations https://phishdestroy.io/scam-team-operations The "middle class" of fraud exposed. Three teams, shared Google Spreadsheets, and proof that OSINT disruption works — 717Team archived after intelligence operations. Wed, 08 Oct 2025 00:00:00 +0000 https://phishdestroy.io/theproject-scam-empire https://phishdestroy.io/theproject-scam-empire Not a scam tool — a scam university. $10M+ claimed, 5,000+ members trained since 2021. 730+ scammer usernames leaked. The upstream producer behind casino and drainer operations. Mon, 15 Sep 2025 00:00:00 +0000 https://phishdestroy.io/crypto-drainer-anatomy https://phishdestroy.io/crypto-drainer-anatomy Technical breakdown of wallet-draining phishing kits behind $1.93B stolen in H1 2025. Kill-chain, real exploits, DaaS economy, and recovery steps. Mon, 04 May 2026 00:00:00 +0000 https://phishdestroy.io/crypto-drainer-networks https://phishdestroy.io/crypto-drainer-networks Code-level deep-dive into TRXDrop (50 forced signing retries, AI-generated code) and NiceCrypto (80% affiliate commission, 4-chain expansion). Full 9-step attack chain deconstructed. Thu, 19 Feb 2026 00:00:00 +0000 https://phishdestroy.io/fake-casino-panels-exposed https://phishdestroy.io/fake-casino-panels-exposed 383 verified victims across 30+ countries. Celebrity deepfakes, AI chatbots, and a meta-scam that steals from its own scammers. Four casino PaaS operations dissected. Mon, 22 Dec 2025 00:00:00 +0000 https://phishdestroy.io/nicenic-verdict https://phishdestroy.io/nicenic-verdict Follow-up investigation: 24.7 MB dataset reviewed, 5,000+ abuse tickets ignored, all NiceNIC domains now flagged as unsafe. Challenge: find a legitimate domain. Tue, 24 Feb 2026 00:00:00 +0000 https://phishdestroy.io/nicenic-real https://phishdestroy.io/nicenic-real Investigation into IANA 3765 with phishing score 1,141.74, $8.5M Trust Wallet heist, and open confession: "we are not against scamming." Tue, 13 Jan 2026 00:00:00 +0000 https://phishdestroy.io/destroy-scammers https://phishdestroy.io/destroy-scammers The dashboard proving that scammers are frightened mice. We expose crypto scammer infrastructure, collect evidence, and help victims fight back by refusing to stay silent. https://phishdestroy.io/100k-returned-malvertising https://phishdestroy.io/100k-returned-malvertising We detected a Russian malvertising operation using stealer malware, restored wallet access, and returned $100K to the victim. Tue, 12 Aug 2025 00:00:00 +0000 https://phishdestroy.io/registrars-enabling-global-scams https://phishdestroy.io/registrars-enabling-global-scams How major domain registrars enable global phishing scams through weak abuse policies and slow response times. Sun, 10 Aug 2025 00:00:00 +0000 https://phishdestroy.io/moz-fake-extensions-paid-media https://phishdestroy.io/moz-fake-extensions-paid-media 150+ malicious Mozilla extensions sharing a single C2 backend on Nigerian infrastructure, all controlled by one operator. Tue, 26 Aug 2025 00:00:00 +0000 https://phishdestroy.io/steam-not-good-guy https://phishdestroy.io/steam-not-good-guy How Valve enabled BlockBlasters to deploy crypto-drainer malware on Steam, stealing hundreds of thousands from gamers. Sat, 18 Oct 2025 00:00:00 +0000 https://phishdestroy.io/impact-metrics https://phishdestroy.io/impact-metrics Comprehensive breakdown of PhishDestroy operations: domains tracked, abuse reports filed, takedowns coordinated, and response times measured. Mon, 01 Jul 2024 00:00:00 +0000