Threat Intelligence Hub

Phishing Intelligence & Investigations

Real-time threat intelligence, active investigations, and takedown operations from our detection systems.

Updated daily 193,000+ domains tracked Active takedowns
LIVE THREATS
193,000+Domains Tracked
27,000+Takedowns
24/7Monitoring
<15minAvg Response
Hacked? Do this first — emergency response for scam and drainer victims. Never share your seed phrase. SEAL 911.
Hacked? Do this first.Emergency response for scam & drainer victims — never share seed phrases.
Open Emergency Guide Contact SEAL 911 SEAL Docs

Latest Security Updates

Investigations, research, and takedown operations

Behind the Investigation — PhishDestroy case file on how NameSilo and xmrwallet built the case against themselves
#CaseFile#Bait#Monero#Forensics

Behind the Investigation — How We Baited a Monero-Theft Cartel at the Cost of Our Twitter

Monero leaves no blockchain trail. So we hunted differently. We injected 21 million decoy seed phrases into xmrwallet, burned 200K+ tweets as bait on X, and filed 11–12 abuse complaints NameSilo ignored on schedule. Every Medium article they deindexed, every DMCA they filed against us, every Twitter ban they triggered — logged by the receiving platform, timestamped, subpoenable. Same requester, same speed, same platforms — for both NameSilo and xmrwallet. That behavioral fingerprint is the case. "They thought they were silencing us. They were building our case."

May 16, 2026 12 min read
Read the Full Case File → Twitter Ban Report xmrwallet Exposé
NameSilo Killed Our Twitter — Twitter/X bird strangled by NameSilo cable
#Retaliation#NameSilo#X#ICANN

NameSilo Killed Our Twitter Because We Told the Truth About Them

@Phish_Destroy is banned on X. X's automated review: "no violation, account restored to full functionality." Account still gone. Two weeks earlier we exposed NameSilo sheltering a $20M+ crypto-theft operation with victims across multiple regions — now under active EU criminal investigation. Same playbook NameSilo ran for the scammer — weaponize a bureaucratic process — now running against us. Where's the paid gold-checkmark human support? Where's the unban the automation already granted? Where's our refund?

Apr 15, 2026 7 min read
Read the Full Story → Original Investigation
Seed Flooding — digital battlefield where defenders flood phishing forms with fake seed phrases
#Methodology#Legal#SeedPhrases#Defense

Seed Flooding: Why PhishDestroy Openly Disables Active Phishing Sites

We flood active phishing forms with fake seed phrases. It buries the real victim submissions under thousands of decoys, poisons the drainer's credential pool, and forces the operator to sink hours triaging worthless data — often enough to abandon the campaign. This article explains why it works, how we do it responsibly, and why it is not illegal: no unauthorized access (the form is public and explicitly asks for input), no damage to legitimate systems (the site has no legitimate users), no violation of CFAA/Computer Misuse Act (feeding a public form deceptive data submitted voluntarily is not hacking). Full methodology, legal analysis, and real takedown results inside.

Mar 31, 2026 9 min read
Read the Full Methodology →
Trustname.com Bulletproof Registrar Investigation — IANA 4318
#Investigation#Trustname#ICANN#Monero

Trustname.com Exposed: Inside a “Bulletproof” ICANN-Accredited Registrar Serving Scam Casinos

IANA #4318. €120 declared annual revenue. 1 employee. Negative equity. Deletion notice published. Two Belarusian owners. Six fake crypto casinos registered in a single week — one calling itself “Elon Musk’s Official Casino” — all hidden behind Trustname’s own offshore privacy proxies. The registrar literally calls itself bulletproof in its own DNS TXT record.

Apr 14, 2026 14 min read
Read Full Investigation →
Telegram Bot Analyzer v2 — Full Dump, User Intel & Content Analysis
#NewTool#TelegramOSINT#BotAnalyzer#StealerDetection

Telegram Bot Analyzer v2: Full Message Dump, User Intel & Content Analysis

Extract complete message history, identify users with account age estimation, detect stolen credentials, credit cards, crypto wallets, seed phrases and API keys. Branded intelligence reports with interactive charts.

Apr 3, 2026 Free Tool
Launch Tool →
SEO Hijack: Crypto scammers exploit Bing & DuckDuckGo
#Investigation#SEO#Crypto

How Crypto Scammers Hijack Bing & DuckDuckGo Search Results

How crypto scammers exploit Yahoo SERP injection and PBN networks to rank phishing sites #1 on Bing and DuckDuckGo, stealing millions from search users.

Mar 30, 2026 12 min read
Read Investigation →
NameSilo Shields $2M Monero Theft — xmrwallet.com Investigation Final
#Investigation#Monero#NameSilo#ICANN

The End of xmrwallet[.]com: A Decade-Long $2M Scam Destroyed — But Why Did NameSilo Lie to Protect the Thief?

A 10-year, $2M+ Monero theft operation — finally destroyed. Three registrars suspended the domains. NameSilo fabricated a cover story, called the scammer “the victim,” and helped suppress VirusTotal alerts. We proved 7 lies, filed with ICANN and law enforcement. The domain is dead. The registrar’s reputation should be too.

Mar 27, 2026 25 min read
Read Full Investigation → Evidence Repository
When Abuse Reports Go Nowhere — The Industry's Wall of Silence (niceNIC, Tucows, GlobalDomainGroup, Apiname, Porkbun, Dynadot, Endurance)
#Investigation#ICANN#VirusTotal#Registrars

When Abuse Reports Go Nowhere: How Registrars Become Silent Partners in Cybercrime

16 antivirus detections. 13 reports. 1,788 hours online. Real data from our abuse escalation log shows registrars ignoring evidence-packed reports while phishing domains stay active for months. Who in their abuse department overrules Kaspersky, ESET, and Fortinet?

Mar 22, 2026 12 min read
Read Investigation →
Ukrainian Military Aid Phishing Network Exposed
#Investigation#Ukraine#Banking#OSINT

Military Aid Phishing Network Exposed: 5 Ukrainian Banks Targeted, 3 Operators Identified

A fake military aid foundation targeting Ukrainian veterans. 5 banks cloned with real-time operator control. One misconfigured file on a shared server exposed the entire operation — operators identified via 6 Telegram API calls. Full behavioral analysis of 261 messages reveals a cross-border criminal enterprise.

Mar 25, 2026 15 min read
Read Investigation →
Anatomy of Crypto Phishing — 8 Real Seed Phrase Stealers Reverse-Engineered
#Investigation#Phishing#OSINT#ReverseEngineering

Anatomy of Crypto Phishing: 8 Real Seed Phrase Stealers Reverse-Engineered

We intercepted live phishing traffic, reverse-engineered 8 seed phrase stealers, and traced data to Telegram bots, EmailJS, FormSubmit, custom C2 APIs, and PhaaS backends. 1,824+ stolen credentials. Total attacker cost: $0.

Mar 27, 2026 18 min read
Read Full Investigation →
Trust Wallet Phishing Panel Exposed
#Investigation#TrustWallet#LiveChat#IDOR

Trust Wallet Phishing Panel Exposed: $239K Stolen, 1,900 Victims, 6 Operators Identified

Full takedown of a Russian-speaking scam operation running a fake Trust Wallet support panel with live chat, staking simulation, and multi-operator support. 1,900 victim sessions dumped via IDOR, 21 scammer wallets tracked, primary actor deanonymized.

Mar 01, 2026 25 min read
Read Investigation →
Scammers Are Not Hackers: 4 Backends Dissected
#Investigation#Firebase#Supabase#DaaS

Scammers Are Not Hackers: 4 Backends Dissected, All Trivially Compromised

4 live scam backends analyzed — Firebase with open Firestore rules, Supabase with full CRUD access, Express.js with zero auth, and a 19K-seed drainer campaign. All trivially deanonymizable.

Feb 18, 2026 18 min read
Read Investigation →
BUYTRX Exposed: TRON Approval Drainer Dissected
#Investigation#TRON#Drainer

BUYTRX Exposed: 55 Domains, Zero Auth APIs, and a TRON Approval Drainer Dissected

Full infrastructure teardown: 55+ phishing domains, unauthenticated APIs leaking victim data, on-chain drainer contracts, Google Ads funding, and Chinese-language operators exposed.

Feb 08, 2026 14 min read
Read Investigation →
xmrwallet.com Exposed: 10 Years of Stolen Monero Keys
#Investigation#Monero

xmrwallet.com Exposed: 10 Years of Stolen Keys & Hijacked Transactions

Forensic investigation: Monero web wallet leaks your private view key 40+ times per session via Base64 session tokens, then nullifies your transaction with raw_tx = 0. Operator identified.

Mar 16, 2026 14 min read
Read more →
Why We Ban White Pages — Cloaking Explained
#Investigation#Cloaking#TDS

Why We Ban "White Pages" and Redirects to Official Sites — The Cloaking Problem Explained

How scammers use cloaking, white pages, and TDS systems to hide phishing from security scanners while targeting real victims. 50,000+ sites analyzed.

Mar 29, 2026 12 min read
Read Investigation →

Explore Our Free Tools

Analyze domains, check wallets, scan URLs — all free, no registration.

All Tools Security Checklist Privacy Arsenal Emergency Help