NameSilo Killed Our Twitter Because We Told the Truth About Them

The Receipts: X Contradicts Itself in Writing

Two official emails from X Support. Same account. Same appeal. Opposite rulings. The second one is the more recent. Read them in order.

Email #2 is the more recent ruling. It explicitly reverses Email #1. It says — in writing, on X’s own letterhead — that the account has been restored to full functionality. The account is not restored. The paid subscription continues to bill. There is no third email walking back Email #2. X’s most recent commitment to us is simply not being honored.

Why This Happened

On March 27 we published The End of xmrwallet[.]com: NameSilo Lied to Protect a Crypto Thief. The investigation was reproducible: PHP endpoint dumps, archived statements, 15+ documented victims. Three peer registrars (India, Malaysia, China) reviewed the same evidence and killed their xmrwallet domains in days. Only NameSilo defended the scammer.

What happened next matters. The order matters:

1. The scammer emailed us directly first — before any NameSilo public statement, before any appeal was filed. His email told us to “sue the registrar.” That is not a sentence a solo scammer writes to a researcher chasing him. That is a sentence someone writes when they already know the registrar will back them up. We have never seen that reaction from any other scammer we have documented.
2. NameSilo then issued a public statement containing two provable falsehoods, quoted verbatim and archived in our Medium investigation:
   • “Domain was compromised a few months ago” — contradicted by the fact that the operator’s own theft code was still running in production at the time of NameSilo’s statement.
   • “Prior to that, we had received no abuse reports” — contradicted by our delivery receipts for multiple prior abuse reports with full technical evidence.
   The same statement also said: “Registrant is working to get delisted from VT reports,” which confirms NameSilo explicitly endorsed the operator’s attempt to remove VirusTotal detections while the theft code was live.
3. In the same statement, NameSilo dismissed our research as unserious and publicly offered to help the operator get security-vendor detections (VirusTotal, Fortinet) removed — while the theft code was still active.
4. We responded factually to that public statement. No harassment. No spam. No doxing. We corrected the record in the same venue NameSilo chose.
5. Seven days later, two PhishDestroy X accounts were locked. Reason cited: “payment.” Subscriptions were paid. The reason shifted on Apr 14 to “inauthentic behaviors.” After appeal the reason shifted again to “no violation, restored.” The lock, and the unreturned payments, did not shift at all.

Are NameSilo and the Scammer Connected?

The xmrwallet[.]com operator answered abuse reports with confidence, tweeted alongside the registrar with coordinated talking points, and never moved the domain in ten years of complaints. That is not how nervous scammers behave. That is how scammers with an arrangement behave.

In more than a hundred phishing-operator cases we’ve documented, we have never seen this specific sequence before:

The operator’s infrastructure is not that of a hobbyist. According to our Medium investigation, xmrwallet[.]com is hosted on $550/month bulletproof hosting via IQWeb FZ-LLC (registered in Belize), behind DDoS-Guard (Russia). That is a professional, prepared, abuse-resistant stack — not a one-off scam page. A single operator running prepared bulletproof infrastructure while also having his registrar publicly issue a defense statement on his behalf is, at minimum, an unusually coordinated operation.

We cannot prove a relationship from outside NameSilo’s books. Only their internal records could. But on the visible evidence, two explanations remain: either the operator is the most self-confident crypto scammer of the last decade and correctly bet that his registrar would shield him on instinct — or there is an undisclosed relationship between them. The first deserves public scrutiny. The second deserves a subpoena. Law enforcement in EU jurisdictions is now working the underlying case.

Direct Evidence: What NameSilo Said Publicly vs. What Actually Happened

The paragraphs above describe a pattern. This section documents the specific factual contradictions between NameSilo’s public statements and our own first-hand records. We are not asking anyone to believe us on faith — every item below is verifiable against third-party archives, delivery receipts, and the Wayback Machine.

The Scrubbing Pattern: Accounts, Not Just Comments

During our three-year investigation we watched, in real time, the suppression layer operate on three different platforms. The pattern was consistent enough that we began archiving before publishing, every time.

• GitHub. Entire accounts that posted issues or comments referencing xmrwallet[.]com were removed — not individual comments, not threads, the full accounts. We have Wayback captures of issue threads where the commenter’s profile now 404s. Anyone conducting an inquiry can ask GitHub, under proper legal process, how many user accounts with posts mentioning xmrwallet were closed between 2018 and 2026, and for what stated reason. We expect the number to be non-trivial.
• Trustpilot. Dozens of truthful negative reviews were removed over successive waves. The removals clustered with each public complaint cycle, consistent with coordinated reporting rather than organic moderation. Again, Trustpilot’s internal deletion log, under subpoena, is the definitive record.
• X (Twitter). Critical replies to the scam-adjacent accounts disappeared at a rate difficult to explain by normal platform policy. After our @Phish_Destroy account was ultimately banned on a shifting justification (see the email receipts above), the pattern clicked into place. The same suppression playbook used against individual complainants for years was now being run against a research account.

We want to be precise: we are not alleging telepathy. We are alleging a documented chronology. Post. Get archived. Get deleted. Repeat, across three platforms, for the same target, for a decade, while the registrar never moves the domain. That chronology does not require a conspiracy theory. It requires a public records request.

If You Are a Victim of xmrwallet[.]com — Please Come Forward

We know there are more of you. We have been contacted privately by people who lost funds and who were afraid to go on the record while the operator was still active and while his registrar was still publicly defending him. The situation has now changed. The operation is exposed, the infrastructure is documented, and law enforcement in EU jurisdictions is working the underlying case.

To the institutions that can actually compel disclosure — ICANN Compliance, EU GDPR authorities, Canadian Anti-Fraud Centre (the operator is Canadian), the relevant tax authorities, and any court with jurisdiction over NameSilo’s operating entity: the primary-source material is preserved and available on request. Delivery receipts, Wayback captures, Medium write-up, domain-report infrastructure graph, and victim testimony with signed consent. We are not holding back evidence. We are holding it in a form you can actually use.

Calling black white does not make it white. A decade of public evidence, 20+ documented abuse notices, a bulletproof-hosted theft machine, coordinated account deletions across three platforms, a banned research account, and a named operator whose identity is already public — this is not a PR problem. It is a jurisdictional problem. We are confident the public record already contains enough to resolve it.

The Victims: Who Actually Got Harmed

NameSilo’s implicit argument, by reaching for a platform abuse button instead of a retraction, is “we didn’t like being exposed.” Fair enough. People rarely like being exposed. But put the two harms on one scale.

The Permanent Record

Silencing a Twitter account does not remove the evidence. Everything germane to this case is archived:

• Every public NameSilo statement defending the xmrwallet operator — Wayback Machine, Archive.today, our GitHub evidence repository.
• Screenshots of the live theft code in production, with timestamps.
• 8 PHP endpoints reverse-engineered and published.
• The full abuse-report conversation chain.
• Our entire X timeline mirrored on Mastodon, Bluesky, Medium, Telegram, GitHub, IPFS.
• Hourly snapshots of phishdestroy.io itself, 14-day retention, installed specifically so nothing we wrote can quietly disappear.

If any one mirror is silenced, the content lives on the other seven. The architecture is older than NameSilo. It will outlast them.

Was This Fair? Five Questions for Everyone Reading

These are not rhetorical. Read the evidence above, then answer for yourself — privately, on your timeline, or while deciding whether to keep or move your domains.

1. Is it fair to ban a security researcher for publicly responding to a registrar’s own public statement? The registrar started the conversation. The researcher replied with facts. Only one side got silenced.
2. Is it acceptable for a registrar’s public statement to dismiss documented research as unserious while simultaneously offering to help a scam operator remove security detections? Both happened in one NameSilo statement. Victims are not mentioned anywhere in it.
3. Is it acceptable for X to explicitly withdraw its own lock justification in writing (“no violation, restored”) and keep the ban in force anyway? X’s own most recent ruling says the account should be live.
4. Is it acceptable for a paid verification subscription to continue billing while the underlying account is locked? If the service is not being delivered, is that a product — or a contract breach?
5. What does an ICANN-accredited registrar’s “good standing” mean if an accredited registrar can weaponize a third-party platform’s abuse channels to silence the researcher documenting their abuse-response failure? This is a compliance question, and it is being added to the existing RAA § 3.18 filing.

If Any Answer Was “No, This Is Not Fair”

Here are three concrete, zero-cost things, in ascending order of impact.

1. Share it publicly

Quiet disapproval does nothing. Visible pressure does. One click, pre-filled:

2. Ask the parties by name

Tag them. Silent disapproval does nothing. Visible questions from readers get noticed.

• @NameSilo — is the @Phish_Destroy ban related to your public statement offering to help the xmrwallet operator get detections removed?
• @X / @XSupport / @elonmusk — Email #2 says “restored to full functionality.” The account is locked. Which ruling is operative?
• @ICANN — does RAA § 3.18 cover registrar retaliation against researchers?
• @Tucows — is platform-abuse retaliation against researchers compatible with your OpenSRS reseller standards?

3. Move your domains (this is the one that hurts)

Companies respond to revenue loss, not tweets. Transfers take about fifteen minutes. Our registrar statistics page lists registrars with clean abuse-response records. Every moved domain is a renewal-number datapoint NameSilo’s leadership will see next quarter.

If you are an organization — crypto project, bug-bounty platform, journalism outlet, threat-intel company — with any domain at NameSilo: consider what it means to fund the registrar that sheltered a $20M+ theft operation and then silenced the researcher who documented it. You can make that move publicly. It carries weight.

Final Word

You don’t get to protect a $20M+ theft operation for ten years, lie about it in public, retaliate against the researcher who caught you — and have the whole thing quietly forgotten. Especially not while EU law enforcement is working the case.

We are not asking you to take our word. Every factual claim above is linked, documented, timestamped, archived off-site, and reproducible. We are asking you to look at the evidence, answer the five questions for yourself, and act on your own answer. That is what fair looks like — a reader who reads the evidence and decides. It is also exactly the thing that silencing is designed to prevent.

PhishDestroy is volunteer-driven threat intelligence. Zero payments, zero sponsorships, zero favors. We publish what we find. NameSilo had us banned for it.

Original investigation: phishdestroy.io/xmrwallet-namesilo-exposed
Medium investigation (primary source): phishdestroy.medium.com/xmrwallet-com-2953f35b8a79
Evidence repo: github.com/PhishDestroy