News & Updates

Real-time threat intelligence, active investigations, and takedown operations from our detection systems.

LIVE THREATS
— domains tracked
— takedowns
24/7 monitoring
<15min avg response
Emergency guide cover
BREAKING

Important Information for Victims or Those Seeking Protection

If you suspect your computer has been compromised, follow the immediate-response steps. Avoid "recovery" scams, never share seed phrases, and verify helpers via on-chain signature.

Open Emergency Guide → Contact SEAL 911 SEAL Docs

Latest Security Updates

Investigations, research, and takedown operations

NameSilo Killed Our Twitter — Twitter/X bird strangled by NameSilo cable
#Retaliation #NameSilo #X #ICANN

NameSilo Killed Our Twitter Because We Told the Truth About Them

@Phish_Destroy is banned on X. X's automated review: "no violation, account restored to full functionality." Account still gone. Two weeks earlier we exposed NameSilo sheltering a $20M+ crypto-theft operation with victims across multiple regions — now under active EU criminal investigation. Same playbook NameSilo ran for the scammer — weaponize a bureaucratic process — now running against us. Where's the paid gold-checkmark human support? Where's the unban the automation already granted? Where's our refund?

Apr 15, 2026 7 min read
Read the Full Story → Original Investigation
Trustname.com Bulletproof Registrar Investigation — IANA 4318
#Investigation #Trustname #ICANN #Monero

Trustname.com Exposed: Inside a “Bulletproof” ICANN-Accredited Registrar Serving Scam Casinos

IANA #4318. €120 declared annual revenue. 1 employee. Negative equity. Deletion notice published. Two Belarusian owners. Six fake crypto casinos registered in a single week — one calling itself “Elon Musk’s Official Casino” — all hidden behind Trustname’s own offshore privacy proxies. The registrar literally calls itself bulletproof in its own DNS TXT record.

Apr 14, 2026 14 min read
Read Full Investigation →
Telegram Bot Analyzer v2 — Full Dump, User Intel & Content Analysis
#NewTool #TelegramOSINT #BotAnalyzer #StealerDetection

Telegram Bot Analyzer v2: Full Message Dump, User Intel & Content Analysis

Extract complete message history, identify users with account age estimation, detect stolen credentials, credit cards, crypto wallets, seed phrases and API keys. Branded intelligence reports with interactive charts.

Apr 3, 2026 Free Tool
Launch Tool →
SEO Hijack: Crypto scammers exploit Bing & DuckDuckGo
#Investigation#SEO#Crypto

How Crypto Scammers Hijack Bing & DuckDuckGo Search Results

How crypto scammers exploit Yahoo SERP injection and PBN networks to rank phishing sites #1 on Bing and DuckDuckGo, stealing millions from search users.

Mar 30, 2026 12 min read
Read Investigation →
NameSilo Shields $2M Monero Theft — xmrwallet.com Investigation Final
#Investigation #Monero #NameSilo #ICANN

The End of xmrwallet[.]com: A Decade-Long $2M Scam Destroyed — But Why Did NameSilo Lie to Protect the Thief?

A 10-year, $2M+ Monero theft operation — finally destroyed. Three registrars suspended the domains. NameSilo fabricated a cover story, called the scammer “the victim,” and helped suppress VirusTotal alerts. We proved 7 lies, filed with ICANN and law enforcement. The domain is dead. The registrar’s reputation should be too.

Mar 27, 2026 25 min read
Read Full Investigation → Evidence Repository
When Abuse Reports Go Nowhere — The Industry's Wall of Silence (niceNIC, Tucows, GlobalDomainGroup, Apiname, Porkbun, Dynadot, Endurance)
#Investigation #ICANN #VirusTotal #Registrars

When Abuse Reports Go Nowhere: How Registrars Become Silent Partners in Cybercrime

16 antivirus detections. 13 reports. 1,788 hours online. Real data from our abuse escalation log shows registrars ignoring evidence-packed reports while phishing domains stay active for months. Who in their abuse department overrules Kaspersky, ESET, and Fortinet?

Mar 22, 2026 12 min read
Read Investigation →
Ukrainian Military Aid Phishing Network Exposed
#Investigation #Ukraine #Banking #OSINT

Military Aid Phishing Network Exposed: 5 Ukrainian Banks Targeted, 3 Operators Identified

A fake military aid foundation targeting Ukrainian veterans. 5 banks cloned with real-time operator control. One misconfigured file on a shared server exposed the entire operation — operators identified via 6 Telegram API calls. Full behavioral analysis of 261 messages reveals a cross-border criminal enterprise.

Mar 25, 2026 15 min read
Read Investigation →
Anatomy of Crypto Phishing — 8 Real Seed Phrase Stealers Reverse-Engineered
#Investigation #Phishing #OSINT #ReverseEngineering

Anatomy of Crypto Phishing: 8 Real Seed Phrase Stealers Reverse-Engineered

We intercepted live phishing traffic, reverse-engineered 8 seed phrase stealers, and traced data to Telegram bots, EmailJS, FormSubmit, custom C2 APIs, and PhaaS backends. 1,824+ stolen credentials. Total attacker cost: $0.

Mar 27, 2026 18 min read
Read Full Investigation →
Trust Wallet Phishing Panel Exposed
#Investigation #TrustWallet #LiveChat #IDOR

Trust Wallet Phishing Panel Exposed: $239K Stolen, 1,900 Victims, 6 Operators Identified

Full takedown of a Russian-speaking scam operation running a fake Trust Wallet support panel with live chat, staking simulation, and multi-operator support. 1,900 victim sessions dumped via IDOR, 21 scammer wallets tracked, primary actor deanonymized.

Mar 01, 2026 25 min read
Read Investigation →
Scammers Are Not Hackers: 4 Backends Dissected
#Investigation #Firebase #Supabase #DaaS

Scammers Are Not Hackers: 4 Backends Dissected, All Trivially Compromised

4 live scam backends analyzed — Firebase with open Firestore rules, Supabase with full CRUD access, Express.js with zero auth, and a 19K-seed drainer campaign. All trivially deanonymizable.

Feb 18, 2026 18 min read
Read Investigation →
BUYTRX Exposed: TRON Approval Drainer Dissected
#Investigation #TRON #Drainer

BUYTRX Exposed: 55 Domains, Zero Auth APIs, and a TRON Approval Drainer Dissected

Full infrastructure teardown: 55+ phishing domains, unauthenticated APIs leaking victim data, on-chain drainer contracts, Google Ads funding, and Chinese-language operators exposed.

Feb 08, 2026 14 min read
Read Investigation →
xmrwallet.com Exposed: 10 Years of Stolen Monero Keys
#Investigation #Monero

xmrwallet.com Exposed: 10 Years of Stolen Keys & Hijacked Transactions

Forensic investigation: Monero web wallet leaks your private view key 40+ times per session via Base64 session tokens, then nullifies your transaction with raw_tx = 0. Operator identified.

Mar 16, 2026 14 min read
Read more →
Why We Ban White Pages — Cloaking Explained
#Investigation #Cloaking #TDS

Why We Ban "White Pages" and Redirects to Official Sites — The Cloaking Problem Explained

How scammers use cloaking, white pages, and TDS systems to hide phishing from security scanners while targeting real victims. 50,000+ sites analyzed.

Mar 29, 2026 12 min read
Read Investigation →
Keitaro TDS: 1,500 Panels Exposed
#Investigation #Tool #Keitaro

Keitaro TDS: 1,500 Panels Exposed and Zero Legitimate Uses Found

50,000+ sites scanned, 1,565 admin panels discovered, 0% legitimate use rate. Criminal clients include EvilCorp, LockBit, and VexTrio. Open-source detection tools released.

Dec 10, 2025 10 min read
Read Investigation →
Scam Teams Compared: MercuryTeam, WasabiSquad, 717Team
#Investigation #ScamIntelLogs

Scam Teams Compared: MercuryTeam, WasabiSquad, and 717Team

The "middle class" of fraud exposed. Three teams, shared Google Spreadsheets, and proof that OSINT disruption works — 717Team archived after intelligence operations.

Oct 08, 2025 12 min read
Read Investigation →
TheProject: $10M Scam Mentorship Empire
#Investigation #Exposed #ScamIntelLogs

TheProject: Inside a $10M Scam Mentorship Empire

Not a scam tool — a scam university. $10M+ claimed, 5,000+ members trained since 2021. 730+ scammer usernames leaked. The upstream producer behind casino and drainer operations.

Sep 15, 2025 14 min read
Read Investigation →
Crypto Drainer Toolkit: Angel Drainer Resellers Exposed
#Investigation #Drainer

Crypto Drainer Toolkit: Inside the Angel Drainer Resellers

Code-level deep-dive into TRXDrop (50 forced signing retries, AI-generated code) and NiceCrypto (80% affiliate commission, 4-chain expansion). Full 9-step attack chain deconstructed.

Feb 19, 2026 15 min read
Read Investigation →
Fake Casino Epidemic: 5 Scam Panels Exposed
#Investigation #Casino #ScamIntelLogs

Fake Casino Epidemic: 5 Scam Panels Exposed From the Inside

383 verified victims across 30+ countries. Celebrity deepfakes, AI chatbots, and a meta-scam that steals from its own scammers. Four casino PaaS operations dissected.

Dec 22, 2025 18 min read
Read Investigation →
NiceNIC Verdict: Zero Legitimate Uses Found
#Investigation #ICANN #Verdict

NiceNIC Verdict: Every Domain Reviewed, Zero Legitimate Uses Found

Follow-up investigation: 24.7 MB dataset reviewed, 5,000+ abuse tickets ignored, all NiceNIC domains now flagged as unsafe. Challenge: find a legitimate domain.

Feb 24, 2026 12 min read
Read Investigation →
NiceNIC Exposed: ICANN Registrar Powering Cybercrime
#Investigation #ICANN #Exposed

NiceNIC Exposed: The ICANN Registrar Powering Global Cybercrime

Investigation into IANA 3765 with phishing score 1,141.74, $8.5M Trust Wallet heist, and open confession: "we are not against scamming."

Jan 13, 2026 18 min read
Read Investigation →
DestroyScammers: Scammers Are Not Hackers
#Investigation #Exposed

DestroyScammers: Scammers Are Not Hackers

The dashboard proving that scammers are frightened mice. We expose crypto scammer infrastructure, collect evidence, and help victims fight back by refusing to stay silent.

12 min read
Read more →
$100K Returned: Malvertising
#Investigation#Recovery

$100K Returned: Malvertising Crypto Scam Dismantled

We detected a Russian malvertising operation using stealer malware, restored wallet access, and returned $100K to the victim.

Aug 12, 2025 10 min read
Read Investigation →
Registrars Enabling Scams
#Investigation#Registrars

NameSilo, Webnic, NiceNic: Registrars Enabling Global Scams

How major domain registrars enable global phishing scams through weak abuse policies and slow response times.

Aug 10, 2025 12 min read
Read Investigation →
150+ Fake Mozilla Extensions
#Investigation#Mozilla

150+ Fake Mozilla Extensions: One Backend, One Network

150+ malicious Mozilla extensions sharing a single C2 backend on Nigerian infrastructure, all controlled by one operator.

Aug 26, 2025 9 min read
Read Investigation →
Steam BlockBlasters
#Investigation#Steam

Steam BlockBlasters: Platform Negligence Exposed

How Valve enabled BlockBlasters to deploy crypto-drainer malware on Steam, stealing hundreds of thousands from gamers.

Oct 18, 2025 11 min read
Read Investigation →
Impact Metrics
#Metrics#Impact

Impact Metrics: 500K+ Phishing Threats Neutralized

Comprehensive breakdown of PhishDestroy operations: domains tracked, abuse reports filed, takedowns coordinated, and response times measured.

Jul 01, 2024 8 min read
Read more →
Why Email-Only Abuse Reports
#Methodology#Compliance

Why PhishDestroy Uses Email-Only Abuse Reports

Legal compliance with CAN-SPAM, GDPR, and RFC 2142 standards for abuse reporting at scale.

Nov 2025 8 min read
Read Article →
Our Values & Personal Motives — Why PhishDestroy Works for Free
#Manifesto #Values

Our Values & Personal Motives — Why We Work for Free

The brutal story behind PhishDestroy: our zero-profit model, personal motives, collaboration without money, and why that makes us more dangerous to scammers than any commercial project.

Mar 2025 8 min read
Read more →
PhishDestroy Cyber Security Lab Interface
#Training #Interactive

Introducing the PhishDestroy Cyber Lab

Train against real-world cyber threats in our interactive simulation chamber. Master the art of digital defense through hands-on experience.

Mar 2026 3 min read
Launch Lab →
PhishDestroy Bot 2.0
#Automation #Release

PhishDestroy Bot 2.0: Automated Group Access & Advanced Takedown

Major update: automated access to private scammer groups, instant reporting, and faster disruption pipeline.

Jan 2026 6 min read
Read more →
GitHub Arsenal
#OpenSource #GitHub

GitHub Arsenal: Open-Source Tools for Fighting Cybercrime

Our toolkit for intel, OSINT, and takedowns is available to the community. Fork and contribute.

4 min read
Read more →
Rublevka Exposure
#Investigation #TON

Rublevka Exposure: Disrupting a Russian TON Scammer Network

We exposed the largest TON group: 4k+ members, internal chats, and identities — details inside.

Sep 28, 2025 16 min read
Read more →
Crypto Security
#Guide #WalletSafety

Crypto Security Essentials

Essential protection against drainers, fake support, and common wallet traps.

Jun 2025 9 min read
Read more →
Takedown Anatomy
#Detection #AI

The Anatomy of a Takedown

From weeks to minutes: pipeline, partnerships, and low false-positive strategy.

Aug 07, 2025 11 min read
Read more →
Digital Fortress
#Privacy #PersonalSecurity

Digital Fortress Guide

Build a robust personal security stack with practical tools and habits.

Jul 2025 13 min read
Read more →
Enemy One — Scammers Mad: $0 Takedowns, Priceless Tantrums
#Investigation #Phishing

Enemy One: Scammers Mad — $0 Takedowns, Priceless Tantrums

How takedowns at scale triggered scammer meltdowns. $0 costs, priceless chaos. Full breakdown of operations inside.

May 20, 2025 20 min read
Read more →
Gambler Panel: Organized Crime Network Analysis
#Investigation #OrganizedCrime

Gambler Panel: Organized Crime Network Analysis

Deep dive into the gambler panel scam infrastructure. Tracing the network, exposing the operators, and documenting the evidence trail.

Nov 15, 2025 15 min read
Read Investigation →
DeFi Hack Explorer
#DeFi #HackTracker

DeFi Hack Explorer

Interactive archive of 1,920+ crypto heists totaling $36.5B. Filter by chain, sort by amount, analyze attack methods.

Oct 2025 Interactive Tool
Explore Hacks →
Security Checklist
#Checklist #PersonalSecurity

Security Checklist for Users

A comprehensive, actionable checklist to verify your personal security setup covers all essentials — from passwords to wallet hygiene.

Sep 2025 Interactive Checklist
Open Checklist →
Privacy Arsenal
#Privacy #Tools

Privacy Arsenal

Curated collection of privacy-focused tools, browsers, VPNs, encrypted messaging, and security software.

Aug 2025 Tool Directory
Explore Arsenal →

Explore Our Free Tools

Analyze domains, check wallets, scan URLs — all free, no registration.

All Tools Security Checklist Privacy Arsenal Emergency Help