Real-time threat intelligence, active investigations, and takedown operations from our detection systems.
Investigations, research, and takedown operations
An in-depth profile of private scam panel mechanics, the five offer swap algorithms, maFile phishing bundles, and why Steam's 'anti-scam' measures are a calculated business strategy.
897,000+ stolen accounts live on LZT Market across 16 platforms. $40M+ in criminal listings. $450M estimated victim liability. Five legal vectors. Interactive forensics. Live intelligence dashboard. Valve's decade of profitable blindness — documented.
Valve’s regional pricing, outsourced support, item economy, the CEVA Logistics breach, and the European legal response.
Coldcard, Trust Wallet and Libbitcoin produced valid wallet seeds from dangerously small keyspaces. Read the evidence and check how yours was generated.
Measurable DNS abuse response: proportionate action, transparent decisions, safeguards and rapid appeals.
Some readers attributed ultahostabuse.com to PhishDestroy based on its visual style. We found no evidence for that attribution. Its registrar-focused research remains an independent source and should be assessed on the evidence it publishes.
A cartel wants the money, refuses outside regulation, and ignores its own contracts. Three toothless Trustname breach notices, one “inadvertently” unblocked card-stealing domain, a 60-day grace period — and $155M a year for it. RegisterFly, EstDomains, Epik, NameSilo: same pattern.
NameSilo first defended xmrwallet. After the wallet had already closed, PhishDestroy argues that the remaining campaign protected the registrar itself: overlapping SEO topics, review manipulation patterns, paid PR distribution, and attempts to remove individual search results — documented with 27 source articles and archived evidence.
A live, evidence-based scoreboard built from every abuse report we send: confirmed-suspension rate, response times, repeat-report escalations, and how many reported domains each registrar never suspended. Deterministic, reproducible, MIT-licensed, updated daily.
Why we are retiring a word weaponized against the public interest — when ICANN (a $50M non-profit) and a decade-long wallet thief both call themselves “volunteers,” the word protects only the entities hiding behind it.
An op-ed: scammers are cheap, replaceable foot soldiers. The scam economy runs on registrars that sell silence — and an ICANN that won't enforce. $16B lost in 2024; phishing up 180% since 2021. Make impunity expensive.
Live dossier on NameSilo (IANA #1479). 5.27M domains scanned · 87.3% dead or parked · 183K malicious hidden behind their own privacy shield — filed with ICANN.
Full zone scan of NiceNIC (IANA #3765, China) — 349,376 domains, 18,927 confirmed malicious: phishing, carding, crypto drainers and gambling. IOC feeds + SIEM CSV.
Complete-zone scan of Trustname / Fewmoretaps OÜ (ICANN #4318) — 7,641 domains, 86% of all live content confirmed malicious. Phase II evidence package.
Full enumeration of ShortDot SA (Luxembourg) — 7 zones (.icu, .bond, .cyou, .sbs, .cfd, .buzz, .qpon), 6.2M domains and 51,670 brand-impersonation sites targeting Chase, Binance, MetaMask & Ledger. .bond ranks #3 worldwide for phishing. IOC feeds + daily updates.
Analyze domains, check wallets, scan URLs — all free, no registration.
