News & Updates

#CaseFile #Bait #Monero #Forensics

Behind the Investigation — How We Baited a Monero-Theft Cartel at the Cost of Our Twitter

Monero leaves no blockchain trail. So we hunted differently. We injected 21 million decoy seed phrases into xmrwallet, burned 200K+ tweets as bait on X, and filed 11–12 abuse complaints NameSilo ignored on schedule. Every Medium article they deindexed, every DMCA they filed against us, every Twitter ban they triggered — logged by the receiving platform, timestamped, subpoenable. Same requester, same speed, same platforms — for both NameSilo and xmrwallet. That behavioral fingerprint is the case. "They thought they were silencing us. They were building our case."

May 16, 2026 12 min read

Read the Full Case File → Twitter Ban Report xmrwallet Exposé

#Retaliation #NameSilo #X #ICANN

NameSilo Killed Our Twitter Because We Told the Truth About Them

@Phish_Destroy is banned on X. X's automated review: "no violation, account restored to full functionality." Account still gone. Two weeks earlier we exposed NameSilo sheltering a $20M+ crypto-theft operation with victims across multiple regions — now under active EU criminal investigation. Same playbook NameSilo ran for the scammer — weaponize a bureaucratic process — now running against us. Where's the paid gold-checkmark human support? Where's the unban the automation already granted? Where's our refund?

Apr 15, 2026 7 min read

Read the Full Story → Original Investigation

#Methodology #Legal #SeedPhrases #Defense

Seed Flooding: Why PhishDestroy Openly Disables Active Phishing Sites

We flood active phishing forms with fake seed phrases. It buries the real victim submissions under thousands of decoys, poisons the drainer's credential pool, and forces the operator to sink hours triaging worthless data — often enough to abandon the campaign. This article explains why it works, how we do it responsibly, and why it is not illegal: no unauthorized access (the form is public and explicitly asks for input), no damage to legitimate systems (the site has no legitimate users), no violation of CFAA/Computer Misuse Act (feeding a public form deceptive data submitted voluntarily is not hacking). Full methodology, legal analysis, and real takedown results inside.

Mar 31, 2026 9 min read

Read the Full Methodology →

#Investigation #Trustname #ICANN #Monero

Trustname.com Exposed: Inside a “Bulletproof” ICANN-Accredited Registrar Serving Scam Casinos

IANA #4318. €120 declared annual revenue. 1 employee. Negative equity. Deletion notice published. Two Belarusian owners. Six fake crypto casinos registered in a single week — one calling itself “Elon Musk’s Official Casino” — all hidden behind Trustname’s own offshore privacy proxies. The registrar literally calls itself bulletproof in its own DNS TXT record.

Apr 14, 2026 14 min read

Read Full Investigation →

#NewTool #TelegramOSINT #BotAnalyzer #StealerDetection

Telegram Bot Analyzer v2: Full Message Dump, User Intel & Content Analysis

Extract complete message history, identify users with account age estimation, detect stolen credentials, credit cards, crypto wallets, seed phrases and API keys. Branded intelligence reports with interactive charts.

Apr 3, 2026 Free Tool

Launch Tool →

#Investigation#SEO#Crypto

How Crypto Scammers Hijack Bing & DuckDuckGo Search Results

How crypto scammers exploit Yahoo SERP injection and PBN networks to rank phishing sites #1 on Bing and DuckDuckGo, stealing millions from search users.

Mar 30, 2026 12 min read

Read Investigation →

#Investigation #Monero #NameSilo #ICANN

The End of xmrwallet[.]com: A Decade-Long $2M Scam Destroyed — But Why Did NameSilo Lie to Protect the Thief?

A 10-year, $2M+ Monero theft operation — finally destroyed. Three registrars suspended the domains. NameSilo fabricated a cover story, called the scammer “the victim,” and helped suppress VirusTotal alerts. We proved 7 lies, filed with ICANN and law enforcement. The domain is dead. The registrar’s reputation should be too.

Mar 27, 2026 25 min read

Read Full Investigation → Evidence Repository

#Investigation #ICANN #VirusTotal #Registrars

When Abuse Reports Go Nowhere: How Registrars Become Silent Partners in Cybercrime

16 antivirus detections. 13 reports. 1,788 hours online. Real data from our abuse escalation log shows registrars ignoring evidence-packed reports while phishing domains stay active for months. Who in their abuse department overrules Kaspersky, ESET, and Fortinet?

Mar 22, 2026 12 min read

Read Investigation →

#Investigation #Ukraine #Banking #OSINT

Military Aid Phishing Network Exposed: 5 Ukrainian Banks Targeted, 3 Operators Identified

A fake military aid foundation targeting Ukrainian veterans. 5 banks cloned with real-time operator control. One misconfigured file on a shared server exposed the entire operation — operators identified via 6 Telegram API calls. Full behavioral analysis of 261 messages reveals a cross-border criminal enterprise.

Mar 25, 2026 15 min read

Read Investigation →

#Investigation #Phishing #OSINT #ReverseEngineering

Anatomy of Crypto Phishing: 8 Real Seed Phrase Stealers Reverse-Engineered

We intercepted live phishing traffic, reverse-engineered 8 seed phrase stealers, and traced data to Telegram bots, EmailJS, FormSubmit, custom C2 APIs, and PhaaS backends. 1,824+ stolen credentials. Total attacker cost: $0.

Mar 27, 2026 18 min read

Read Full Investigation →

#Investigation #TrustWallet #LiveChat #IDOR

Trust Wallet Phishing Panel Exposed: $239K Stolen, 1,900 Victims, 6 Operators Identified

Full takedown of a Russian-speaking scam operation running a fake Trust Wallet support panel with live chat, staking simulation, and multi-operator support. 1,900 victim sessions dumped via IDOR, 21 scammer wallets tracked, primary actor deanonymized.

Mar 01, 2026 25 min read

Read Investigation →

#Investigation #Firebase #Supabase #DaaS

Scammers Are Not Hackers: 4 Backends Dissected, All Trivially Compromised

4 live scam backends analyzed — Firebase with open Firestore rules, Supabase with full CRUD access, Express.js with zero auth, and a 19K-seed drainer campaign. All trivially deanonymizable.

Feb 18, 2026 18 min read

Read Investigation →

#Investigation #TRON #Drainer

BUYTRX Exposed: 55 Domains, Zero Auth APIs, and a TRON Approval Drainer Dissected

Full infrastructure teardown: 55+ phishing domains, unauthenticated APIs leaking victim data, on-chain drainer contracts, Google Ads funding, and Chinese-language operators exposed.

Feb 08, 2026 14 min read

Read Investigation →

#Investigation #Monero

xmrwallet.com Exposed: 10 Years of Stolen Keys & Hijacked Transactions

Forensic investigation: Monero web wallet leaks your private view key 40+ times per session via Base64 session tokens, then nullifies your transaction with raw_tx = 0. Operator identified.

Mar 16, 2026 14 min read

Read more →

#Investigation #Cloaking #TDS

Why We Ban "White Pages" and Redirects to Official Sites — The Cloaking Problem Explained

How scammers use cloaking, white pages, and TDS systems to hide phishing from security scanners while targeting real victims. 50,000+ sites analyzed.

Mar 29, 2026 12 min read

Read Investigation →

#Investigation #Tool #Keitaro

Keitaro TDS: 1,500 Panels Exposed and Zero Legitimate Uses Found

50,000+ sites scanned, 1,565 admin panels discovered, 0% legitimate use rate. Criminal clients include EvilCorp, LockBit, and VexTrio. Open-source detection tools released.

Dec 10, 2025 10 min read

Read Investigation →

#Investigation #ScamIntelLogs

Scam Teams Compared: MercuryTeam, WasabiSquad, and 717Team

The "middle class" of fraud exposed. Three teams, shared Google Spreadsheets, and proof that OSINT disruption works — 717Team archived after intelligence operations.

Oct 08, 2025 12 min read

Read Investigation →

#Investigation #Exposed #ScamIntelLogs

TheProject: Inside a $10M Scam Mentorship Empire

Not a scam tool — a scam university. $10M+ claimed, 5,000+ members trained since 2021. 730+ scammer usernames leaked. The upstream producer behind casino and drainer operations.

Sep 15, 2025 14 min read

Read Investigation →

#Investigation #Drainer

Crypto Drainer Toolkit: Inside the Angel Drainer Resellers

Code-level deep-dive into TRXDrop (50 forced signing retries, AI-generated code) and NiceCrypto (80% affiliate commission, 4-chain expansion). Full 9-step attack chain deconstructed.

Feb 19, 2026 15 min read

Read Investigation →

#Investigation #Casino #ScamIntelLogs

Fake Casino Epidemic: 5 Scam Panels Exposed From the Inside

383 verified victims across 30+ countries. Celebrity deepfakes, AI chatbots, and a meta-scam that steals from its own scammers. Four casino PaaS operations dissected.

Dec 22, 2025 18 min read

Read Investigation →

#Investigation #ICANN #Verdict

NiceNIC Verdict: Every Domain Reviewed, Zero Legitimate Uses Found

Follow-up investigation: 24.7 MB dataset reviewed, 5,000+ abuse tickets ignored, all NiceNIC domains now flagged as unsafe. Challenge: find a legitimate domain.

Feb 24, 2026 12 min read

Read Investigation →

#Investigation #ICANN #Exposed

NiceNIC Exposed: The ICANN Registrar Powering Global Cybercrime

Investigation into IANA 3765 with phishing score 1,141.74, $8.5M Trust Wallet heist, and open confession: "we are not against scamming."

Jan 13, 2026 18 min read

Read Investigation →

#Investigation #Exposed

DestroyScammers: Scammers Are Not Hackers

The dashboard proving that scammers are frightened mice. We expose crypto scammer infrastructure, collect evidence, and help victims fight back by refusing to stay silent.

12 min read

Read more →

#Investigation#Recovery

$100K Returned: Malvertising Crypto Scam Dismantled

We detected a Russian malvertising operation using stealer malware, restored wallet access, and returned $100K to the victim.

Aug 12, 2025 10 min read

Read Investigation →

#Investigation#Registrars

NameSilo, Webnic, NiceNic: Registrars Enabling Global Scams

How major domain registrars enable global phishing scams through weak abuse policies and slow response times.

Aug 10, 2025 12 min read

Read Investigation →

#Investigation#Mozilla

150+ Fake Mozilla Extensions: One Backend, One Network

150+ malicious Mozilla extensions sharing a single C2 backend on Nigerian infrastructure, all controlled by one operator.

Aug 26, 2025 9 min read

Read Investigation →

#Investigation#Steam

Steam BlockBlasters: Platform Negligence Exposed

How Valve enabled BlockBlasters to deploy crypto-drainer malware on Steam, stealing hundreds of thousands from gamers.

Oct 18, 2025 11 min read

Read Investigation →

#Metrics#Impact

Impact Metrics: 500K+ Phishing Threats Neutralized

Comprehensive breakdown of PhishDestroy operations: domains tracked, abuse reports filed, takedowns coordinated, and response times measured.

Jul 01, 2024 8 min read

Read more →

#Methodology#Compliance

Why PhishDestroy Uses Email-Only Abuse Reports

Legal compliance with CAN-SPAM, GDPR, and RFC 2142 standards for abuse reporting at scale.

Nov 2025 8 min read

Read Article →

#Manifesto #Values

Our Values & Personal Motives — Why We Work for Free

The brutal story behind PhishDestroy: our zero-profit model, personal motives, collaboration without money, and why that makes us more dangerous to scammers than any commercial project.

Mar 2025 8 min read

Read more →

#Training #Interactive

Introducing the PhishDestroy Cyber Lab

Train against real-world cyber threats in our interactive simulation chamber. Master the art of digital defense through hands-on experience.

Mar 2026 3 min read

Launch Lab →

#Automation #Release

PhishDestroy Bot 2.0: Automated Group Access & Advanced Takedown

Major update: automated access to private scammer groups, instant reporting, and faster disruption pipeline.

Jan 2026 6 min read

Read more →

#OpenSource #GitHub

GitHub Arsenal: Open-Source Tools for Fighting Cybercrime

Our toolkit for intel, OSINT, and takedowns is available to the community. Fork and contribute.

4 min read

Read more →

#Investigation #TON

Rublevka Exposure: Disrupting a Russian TON Scammer Network

We exposed the largest TON group: 4k+ members, internal chats, and identities — details inside.

Sep 28, 2025 16 min read

Read more →

#Guide #WalletSafety

Crypto Security Essentials

Essential protection against drainers, fake support, and common wallet traps.

Jun 2025 9 min read

Read more →

#Detection #AI

The Anatomy of a Takedown

From weeks to minutes: pipeline, partnerships, and low false-positive strategy.

Aug 07, 2025 11 min read

Read more →

#Privacy #PersonalSecurity

Digital Fortress Guide

Build a robust personal security stack with practical tools and habits.

Jul 2025 13 min read

Read more →

#Investigation #Phishing

Enemy One: Scammers Mad — $0 Takedowns, Priceless Tantrums

How takedowns at scale triggered scammer meltdowns. $0 costs, priceless chaos. Full breakdown of operations inside.

May 20, 2025 20 min read

Read more →

#Investigation #OrganizedCrime

Gambler Panel: Organized Crime Network Analysis

Deep dive into the gambler panel scam infrastructure. Tracing the network, exposing the operators, and documenting the evidence trail.

Nov 15, 2025 15 min read

Read Investigation →

#DeFi #HackTracker

DeFi Hack Explorer

Interactive archive of 1,920+ crypto heists totaling $36.5B. Filter by chain, sort by amount, analyze attack methods.

Oct 2025 Interactive Tool

Explore Hacks →

#Checklist #PersonalSecurity

Security Checklist for Users

A comprehensive, actionable checklist to verify your personal security setup covers all essentials — from passwords to wallet hygiene.

Sep 2025 Interactive Checklist

Open Checklist →

#Privacy #Tools

Privacy Arsenal

Curated collection of privacy-focused tools, browsers, VPNs, encrypted messaging, and security software.

Aug 2025 Tool Directory

Explore Arsenal →