In our assessment, NameSilo's conduct is consistent with either direct operation of or financial partnership in the xmrwallet.com theft. No alternative explanation we identified accounts for this pattern of behavior.
After everything that happened — after the public exposé with 11K views, after 4 statements vs evidence with the operator's own emails, after ICANN filing, after law enforcement referral, after 3 other registrars suspending the same domains on the same evidence — the site is still live.
Ask yourself: what legitimate registrar would endure this level of public humiliation and regulatory risk for one client? What company would publicly commit to removing VirusTotal detections for a known drainer? What abuse department would fabricate a "compromise" story that contradicts the operator's own emails?
None — unless they own it or profit from it directly.
NameSilo, LLC (IANA #1479) is either the owner of xmrwallet.com, or a direct financial partner in a $100M+ theft operation. In our assessment, no other explanation accounts for their behavior. A client-registrar relationship does not produce this level of protection.
And there is a Russian intelligence trail here.
The infrastructure patterns, the operational security methodology, the CIS-marketplace freelance orders, the DDoS-Guard hosting, the suppression playbook — this is not a solo Canadian "volunteer" running a hobby project. This is an operation with institutional backing. The Russian connection is obvious to anyone who has worked in CIS cybercrime investigation. We have evidence. Investigators will receive it upon request.
🇷🇺 NameSilo is “American” — staffed by Russian cybercrime veterans
click to collapse
NameSilo LLC is registered in Phoenix, Arizona. NameSilo Technologies Corp is listed on the Canadian Securities Exchange. But the actual engineering team is a Russian/CIS outsourcing operation spread across Russia, Belarus, Ukraine, Serbia, Argentina, and Latvia. At least 13+ Russian-speaking employees identified in the current and recent team:
🚨 Mikhail Chudinov — DevOps (full infrastructure access)
Location: Argentina (crypto-haven relocation)
Previous: Head of IT at SuperKopilka (Russian financial pyramid, collapsed 2017) for ~10 years. Also: COO at AtomX.online (crypto project), Poker Club Manager at Red Rock. Self-described “crypto enthusiast.”
This person holds DevOps keys to all NameSilo infrastructure. His resume: financial pyramid + poker + crypto.
🇷🇺 Ivan Borzenkov — PHP Backend Developer
Location: Bryansk, Russia. Phone: +7 920 602-0... (RU)
Previous: TrafficStars (adult/affiliate ad network, Latvia, grey adtech), Skyeng, AdMe.ru
GitHub: ivan1986 (Russia, Bryansk)
🇷🇺 Vladimir Voskov — Project Development Manager
Location: Moscow, Russia
Previous: Zyfra Company (Russian industrial automation, state contracts), «АНО Ассоциация участников технологических кружков». Education: Нетология (2021-2022)
Project manager sitting in Moscow, managing a US domain registrar.
🇷🇸 Tatiana Labutina — Senior Project Manager
Location: Belgrade, Serbia (post-2022 Russian relocation hub)
Previous: ForexClub Libertex (Russian forex broker, regulatory scandals), Social Quantum (Russian gamedev, St. Petersburg), Avatarico (Russian 3D startup)
🇧🇾 Aleksey Podashevskiy — Frontend Developer
Location: Belarus (sanctioned jurisdiction)
Working for a US registrar from Belarus raises serious compliance questions.
🇷🇺 Konstantin Gorokhov — Backend Developer
Location: Miami, FL (relocated from Russia)
Previously CS Specialist at NameSilo (2019-2021), promoted to backend
🇺🇦 Volodymyr Pohodaiev — Software Engineer
Location: New York (relocated)
Previous: Adsimilate Marketing (affiliate marketing, grey area), FinditQuick.com
The pattern: An “American” company whose DevOps engineer built IT infrastructure for a Russian financial pyramid. Whose PHP developer came from an adult ad network. Whose project managers sit in Moscow and Belgrade. Whose frontend developer works from sanctioned Belarus. Managed by a CEO in Miami (Kristaps Ronka) and owned by a Canadian shell (Brisio Innovations, CSE:BZI).
This is not an American technology company. This is a CIS outsourcing operation with a US mailing address. And it explains everything: why abuse reports are ignored (the team doing the ignoring shares the operator’s language and culture), why the suppression playbook matches Russian cybercrime patterns, why a DMCA request about xmrwallet was filed from Russia, and why 20+ complaints from international victims and security researchers produced zero action.
When you staff your “American registrar” with people whose previous jobs include financial pyramids, adult ad networks, and Russian state-connected companies — you get exactly the kind of registrar that protects a $100M+ phishing operation and calls it “customer service.”
A note to NameSilo — we are not playing your games
We see the xmrwallet.com domain transfer away from NameSilo. Do they think another registrar will inherit their problems? That moving the domain erases 10 years of complicity? We already know how NameSilo operates — they spend 85% of their Google Ads budget bidding on competitors’ names (GoDaddy, Namecheap), and their staff replies to tweets where users tag other registrars. Poaching customers by name while hiding behind a Russian outsourcing team — this is how they do business.
Transferring xmrwallet.com will not work. Every file in this archive is SHA-256 signed with timestamps. Every domain snapshot, every WHOIS record, every abuse report response, every dead domain count — captured and hashed before they started moving. Their actions now are not cleanup — they are additional evidence of consciousness of guilt.
Even if they transfer xmrwallet.com to another registrar. Even if they give away every laundering domain for free. Even if they activate every dead domain with a parking page. Our questions remain the same. Our files remain the same. Our hashes remain the same.
Who bought 1.67 million domains that were never used? Where did the money come from? Why did you publicly defend a $100M+ theft operation? Why does your DevOps engineer have a financial pyramid on his resume? These questions don’t go away because you moved a domain. They get louder.
🔐 How we know about the FSB connection — the full story
click to expand
We've known xmrwallet.com was a phishing operation for a long time. An acquaintance of ours lost money there. We tried to get the site taken down — multiple times, over several years. You now know their methods because we've demonstrated them on ourselves and documented every step.
During this period, we wrote to websites that hosted paid promotional articles about xmrwallet — the Kwork-ordered SEO spam. We asked them to verify the claims in the articles, or at minimum remove the false information so people would stop falling for the scam. Most ignored us. One replied.
The reply came from a personal email address. The kind you can look up. We did. Not through any sophisticated OSINT — through a basic Telegram bot. The kind anyone can use. The result was unambiguous: the person's name, position, and employer came back instantly. The employer was the FSB.
The response was in Russian. It was rude. He threatened to "take our servers" and asked where we keep "the backups." We told him: under his mother's pillow. He didn't reply after that. We don't know what backups he was referring to. We found it funny. The article is still live on that site.
That's the FSB connection. Not speculation. Not pattern analysis. A direct response from a person whose employment at a Russian intelligence agency is publicly verifiable through their own operational security failure — using a personal email tied to their real identity. Classic. They suppress researchers and threaten server seizures, but can't be bothered to use a clean email address.
And if the FSB needs a backup of this archive too — it's on IPFS now. Immutable. Decentralized. No pillow required.
We will not name the website, the person, or provide the email address publicly. This information is available to law enforcement upon request. Contact [email protected].
A message to every moderator, every trust & safety employee, every platform admin who deleted a victim's post, locked an account, or removed a warning about xmrwallet.com:
We ask you to publicly explain why you did it. What rule was broken? What policy was violated? You deleted truth, silenced victims, aided $100M+ theft. That is not moderation — that is complicity. Every deletion is logged. Every removed review is traceable. Every locked account has a paper trail. Investigators can and will request those records.
To ICANN Contractual Compliance:
We submitted the full case file on March 18, 2026. Every screenshot. Every email. Every hash. Every lie debunked. Every victim documented. Every suppression attempt logged. You have it all. NameSilo, LLC (IANA #1479) — your accredited registrar — is actively protecting a Russian-linked scam operation that stole $100M+. The site is still live. The domain is still active. The operator posted a farewell letter and the site is STILL UP. Are you comfortable with this? Is this what ICANN accreditation means? A registrar can publicly lie, help a scammer remove security detections, use paid platform access to silence researchers — and keep their accreditation? We are waiting for your answer. The victims are waiting. The evidence is public. The world is watching.
A message from a victim — and a question about ICANN accreditation:
One of the victims contacted NameSilo and was told something along the lines of their "ICANN license" protecting them. Let's be absolutely clear about what ICANN accreditation is and what it is not:
ICANN accreditation is a license to register domain names. It is not a license to commit fraud. It is not a license to cover up money laundering. It is not a license to protect scam operators. It is not a shield against criminal prosecution. It is not a supreme court ruling that permits NameSilo to help a thief steal $100 million. It does not grant immunity from law enforcement, civil lawsuits, or regulatory action.
An ICANN-accredited registrar is more accountable, not less. The RAA (Registrar Accreditation Agreement) explicitly requires abuse handling. NameSilo signed this agreement. NameSilo violates it every day that xmrwallet.com remains active.
To victims: do not let anyone tell you that "ICANN accreditation" protects a registrar from consequences. It doesn't. Sue them. File criminal complaints. Report to your national cybercrime unit. Report to the Arizona Attorney General. NameSilo is a US company in Phoenix, AZ. They are subject to US law, regardless of what ICANN accreditation they hold. A driver's license doesn't protect you from a murder charge.
The ICANN Accreditation Theater
Here is something that genuinely baffles us. In every single abuse response, in every reply to every complaint, NameSilo cites their ICANN accreditation. Every time. Like a mantra. Like a prayer. Like a magic spell that makes abuse reports disappear.
"As an ICANN-accredited registrar..." — yes, and? Do you understand how absurd this sounds to anyone who works in this industry? Let us translate this into terms everyone can understand:
"We are ICANN-accredited" = "We have an SSL certificate"
"We are ICANN-accredited" = "We have a Cloudflare account"
"We are ICANN-accredited" = "We paid a deposit and filled out a form"
"We are ICANN-accredited" ≠ "We are above the law"
"We are ICANN-accredited" ≠ "We cannot be sued"
"We are ICANN-accredited" ≠ "Our crimes are sanctioned"
ICANN accreditation is a commercial license. You pay a deposit. You fill out paperwork. You agree to follow the RAA (Registrar Accreditation Agreement). That's it. It does not make you a regulator. It does not make you untouchable. It is not a fund that covers the actions of fraudsters you protect. It is not a judicial shield. An SSL certificate on a phishing site doesn't make it legitimate — phishers buy SSL certificates every day, including the expensive EV ones. A Cloudflare account doesn't make you safe — every malware distributor has one. And ICANN accreditation doesn't make you honest — it just means you paid the fee.
And it gets better. NameSilo doesn't just cite ICANN accreditation in abuse responses — they put it in their financial filings. In the Q3 2025 earnings release filed on SEDAR+ (November 28, 2025), the company describes itself as: "As an accredited ICANN registrar, Namesilo is one of the fastest-growing domain registrars in the world." This is in an earnings report. For investors. On a securities filing platform. Instead of disclosing that 81.5% of their "domains under management" are phantom registrations with zero traffic, they lead with ICANN accreditation. It's not just a reflex at this point — it's a securities disclosure strategy. Wrap the phantom numbers in the ICANN badge and hope nobody checks. We checked. Source: Stockwatch →
By the time an ICANN complaint is reviewed, processed, and acted upon, the scam domain has already expired, the money is gone, and the victims have given up. The process is slow by design. Filing an ICANN complaint is like calling the fire department after the building has burned down, been demolished, and turned into a parking lot. This is not a check. This is not oversight. This is theater.
Case in point: Trustname.com (IANA #4318) — an ICANN-accredited registrar. "Fastest growing independent registrar." Our investigation found: Estonian tax filings showing €120 in revenue, one employee, negative equity, and a company deletion notice. Both owners are Belarusian. The registrar openly markets bulletproof hosting, serves scam casinos, 18+ content, illegal pharmacies, and fraud operations. ICANN-accredited. Does that accreditation make them legitimate? Does it protect the victims of the scam casinos they host? Of course not. It just means they filled out the same form NameSilo did.
Maybe we should buy ICANN accreditation too. Then we can write it everywhere:
"Hi, this is PhishDestroy. ACCREDITED BY ICANN, CREDENTIALED BY DOMAIN CCK, PAYMENT PROCESSED BY A REGISTRAR AND A HOSTING PROVIDER."
Sounds impressive, right? Sounds like it means something? It doesn't. And when NameSilo writes it in every response to every abuse report they ignore — it doesn't mean anything either. Except that they think it does. And that delusion is part of the problem.
RAA Section 3.18 — the clause NameSilo pretends doesn't exist.
The Registrar Accreditation Agreement — the document NameSilo signed — includes Section 3.18, which explicitly requires registrars to investigate and respond to abuse reports. Not ignore them. Not delete them. Not fabricate cover stories. Not offer to clean VirusTotal detections for the reported domain. Investigate. Respond. Act. We started citing RAA 3.18 in every single report we file. NameSilo's response? The same ICANN accreditation mantra. They invoke the very authority whose rules they violate — in the same sentence where they violate them. It would be comedy if people weren't losing millions.
Maybe NameSilo has a special ICANN — a private edition, issued by the grandfathers from Lubyanka? A bespoke accreditation where 3.18 reads: "The registrar shall ignore all abuse reports, help the scammer clean his record, and cite this accreditation as justification." Because that's how they behave. They use the ICANN badge the way a corrupt cop uses a police badge — not to enforce the law, but to break it with impunity.
ICANN is not the police. It's the DMV.
ICANN was created in 1998 when the internet was an academic project, not a battlefield. Its mandate is technical stability — making sure .com resolves the same in Tokyo, Berlin, and Moscow. It coordinates the root DNS zone, distributes IP addresses (IANA), and maintains protocol standards. Without ICANN, the internet fragments. That's why it exists. Not to police fraud. Not to protect victims. Not to investigate money laundering.
The RAA is a contract, not a law. Violating RAA 3.18 is breach of contract, not a crime. ICANN's ultimate sanction — revoking accreditation — takes years, creates precedent they fear, and risks thousands of domains in limbo. They won't do it. NameSilo uses a DMV certificate as an alibi in a murder trial. ICANN accreditation doesn't protect you from securities fraud, money laundering, or aiding a $100M theft. The real enforcers are FinCEN, SEC, FBI, and the Arizona Attorney General. ICANN is a decoration.
This is not the first time. Artists Against 419 (2018).
Before xmrwallet, before PhishDestroy, another organization tried. In 2018, Artists Against 419 filed ICANN Compliance complaint UNY-783-11184, accusing NameSilo of being a "bullet-proof registrar" for scammers. Their evidence: reseller QHoster (linked to NameSilo) was responsible for 60% of malicious domains they tracked. NameSilo's response: "We are not a hosting provider" and "We cannot determine the legality of content." ICANN's response: closed the complaint. Reason: the registrar "did not receive the report" or the issues "were outside ICANN's scope."
That was 2018. It's 2026. Nothing changed. The same registrar. The same abuse pattern. The same ICANN non-response. An ICANN Notice of Breach will not fix NameSilo — because abuse is not a bug in their business. Abuse IS the business. You don't send a code-violation notice to a building that was designed to be a front. You send law enforcement.
Why ICANN can't act — and why DOJ won't
Abuse, phishing, scam protection, money laundering, FSB connections — all outside ICANN's mandate. They say so themselves. RAA 3.18 requires "investigating abuse," but ICANN has no investigators, no courts, no power to force-close domains, and no mechanism to verify that a registrar actually investigates. For ICANN, "we received the letter and replied" = compliance. Whether the reply says "we'll remove it" or dismisses the complaint entirely — ICANN doesn't read it.
NiceNIC, Trustname, NameSilo — all technically compliant: pay fees? Yes. Submit data escrow? Yes. WHOIS works? Yes (via PrivacyGuardian). Their business model is ignoring abuse. But ICANN can't punish that, because ICANN doesn't evaluate the content of abuse responses. For bullet-proof registrars outside the US, ICANN's only option is revoking accreditation — a process that takes years and leaves thousands of domains in limbo. ICANN fears technical collapse more than it fears fraud.
NameSilo is a special case. It's a US company in Phoenix, Arizona — subject to US law (Arizona AG, FBI, FinCEN, SEC). ICANN shouldn't need to handle this. This is DOJ's job. But DOJ is silent too:
ICANN — fears losing a "top 10 registrar" with 5M+ domains. Market weight matters.
DOJ — busy with Doppelganger, LabHost (NameSilo domains were seized, but LLC not named as defendant).
NameSilo — pays fees, submits escrow, doesn't violate technical RAA clauses. Formally clean.
Result — everyone has jurisdiction, nobody acts. The gap between "technically compliant" and "actively criminal" is where NameSilo lives.
This is not a single abuse incident that ICANN can address with a Notice of Breach. This is a systemic business model built on enabling cybercrime — phishing, crypto drainers, darknet services, and what the financial data strongly suggests is money laundering at scale. ICANN compliance letters don't fix that. Federal prosecution does.
njal.la is NameSilo. Period.
NameSilo's favorite defense: "That's our reseller, njal.la. We have no control." WHOIS says otherwise. Look up any njal.la domain — the WHOIS registrar field reads NameSilo, LLC. Not njal.la. Not some independent entity. NameSilo. Whatever internal partnership or reseller agreement they have is their private business. To the outside world — to ICANN, to law enforcement, to victims, to WHOIS — these are NameSilo domains under NameSilo's accreditation and NameSilo's responsibility.
Njalla is a legitimate privacy-focused registrar founded by Peter Sunde (of Pirate Bay). It serves journalists, activists, and privacy-conscious users. But its privacy features — registrant shielding, no public WHOIS, minimal paper trail — were systematically exploited to register crypto scam domains and drainers under NameSilo's accreditation. When abuse reports arrived, NameSilo pointed to njal.la; njal.la pointed to privacy. The domains stayed up. The money disappeared. The privacy shield became an abuse shield. Their internal arrangements do not override WHOIS data, ICANN rules, or the law. You cannot outsource your ICANN obligations to a privacy reseller and then claim innocence when domains under your accreditation steal $100 million.
How other registrars compare — from someone who scans hundreds of thousands of domains.
We are not theorists. We scan, analyze, and report domains at scale — hundreds of thousands of them. We work with registrars every day. Here is what we see:
WebNic (~800K domains)
Improving. They now have a real abuse handler — an actual human who reads reports and takes action. He doesn't yet realize their IPs are being blocked by Cloudflare (sends screenshots of "site not working" instead of "phishing"), but there is visible progress. A registrar that is trying to get better.
NiceNIC (Russian, not Chinese)
Hopeless. Will only improve when they cease to exist. A registrar whose business model is built on not responding to abuse. But even NiceNIC never publicly defended a scammer on Twitter. Even NiceNIC never offered to clean VirusTotal for a drainer. Even they have limits.
NameSilo (IANA #1479)
Invented its own ICANN. Created its own WHOIS. Plays by its own rules. Uses accreditation as a weapon, not an obligation. Even Russian registrars like Reg.ru stopped doing what NameSilo does around 2021. NameSilo is still doing it in 2026. They are not a rogue registrar. In our assessment, they are a criminal enterprise with an ICANN badge.
We are not ICANN experts. We are not lawyers. But we destroy 500,000+ phishing domains and can see what entire regulatory bodies apparently cannot: a registrar that invents its own laws, hides behind its own resellers, cites its accreditation as a defense while violating its accreditation's core requirements, and launders money through phantom domain registrations.
To U.S. federal and state authorities — particularly the State of Arizona:
NameSilo, LLC (Phoenix, AZ) is a US-incorporated company protecting a CIS-linked criminal operation that stole an estimated $100M+ from victims worldwide. The evidence is public, the ICANN filing is on record, the operator is identified, the lies are debunked, and the suppression campaign is documented.
This is not a business dispute. This is a US company facilitating ongoing international fraud. The infrastructure patterns — CIS-marketplace freelance orders, DDoS-Guard hosting through Russian-jurisdiction providers, operational methodology consistent with state-adjacent cybercrime — are textbook.
FBI, DOJ Cyber Division, Arizona Attorney General, FinCEN — the evidence package is ready. Contact us and we will provide everything, including materials not published here.
For the FBI specifically: NameSilo fabricated public statements, suppressed security researchers, and offered to remove VirusTotal detections for a known drainer. European authorities have requested information from X/Twitter regarding related cases and received no response — we know this from direct communication with both victims and a competent authority in an EU member state (details cannot be disclosed under EU data protection law). Ask NameSilo why. Ask them who. Ask them how much. Ask before the evidence trail goes cold — though we have ensured most of it cannot be deleted anymore.
If a registrar can say "we received no complaints" while the internet's own memory proves otherwise — if they can delete the evidence using DMCA requests and face zero consequences — then what is the point of regulators? ICANN accreditation becomes a rubber stamp and abuse handling becomes theater.
Subpoena their abuse ticket system. Compare it to what they claimed publicly. The gap between those numbers is the measure of their complicity.
Open Challenge
Prove that a single word we published is false —
and we will take everything down ourselves.
One word. One claim. One screenshot. Show us what's wrong.
0
factual rebuttals received
in 10 years of operation & months of investigation
Across hundreds of pages of evidence, dozens of victim reports, and 61 SHA-256 verified screenshots — not the operator, not NameSilo, not X, not anyone has produced a single factual rebuttal. Not one.
But if everything we say is true — then DO SOMETHING.
They are stealing millions. Right now. Today. The site is live. The domain is active. Victims are losing money while you read this. Act now.
We did not spend months of our lives building this archive, and victims did not lose millions of dollars, so that a Russian-speaking scammer could post one lie on Twitter and then cry that we saved it. NameSilo wrote 4 false sentences from an official corporate account. We archived them. They got upset that the archive exists. Their entire defense is not "it's false" — it's that the archive exists at all.
That's not how this works. You said it. We saved it. The world can read it. Deal with it.
NameSilo's response playbook — and our pre-written answers
We've dealt with enough registrars to know exactly what they'll say. Here's the script, and here's why it doesn't work.
🎙 "We are an ICANN-accredited registrar."
Yes, we know. It's a commercial license, not a character reference. Trustname.com (IANA #4318) is also accredited with €120 revenue.
🎙 "The domain was compromised."
SHA-256 hashes show code/IP never changed. Operator never claimed compromise. You invented this story.
🎙 "We had received no abuse reports."
20+ reports from us, 100+ total from public posts (BitcoinTalk 2021, Reddit 2018).
🎙 "Dead domains are normal in our industry."
Baseline is 15-21%. You're at 32.2% (2x baseline), with 615% YOY spike and 10K-17K/day bulk runs. Explain the gap.
🎙 "njal.la is an independent reseller."
WHOIS says NameSilo, LLC. Your internal arrangements don't override public data or law. Njalla domains are your responsibility.
🎙 "We will pursue legal action."
Operator threatened this in Feb. We're on IPFS. Claims are sourced, SHA-256 verified. Truth is defense. Sue us — this archive becomes court exhibit A-Z.
🎙 [Silence]
Also an option. Evidence sits on decentralized network. Silence is not a strategy. It's a countdown.
NameSilo & the SEO Grandpa playbook — same tricks:
NameSilo buys reputation the same way the xmrwallet operator does — different budget, same playbook. Forbes Advisor "review" ($50,000+ placement). Yahoo Finance press releases (labeled "paid"). Wikipedia article (flagged as promotional). Trustpilot bot farm (92% manipulation probability). Both use PR Newswire (Cision) for press releases. Both have almost zero organic web presence. The detailed fact-check of Forbes, Trustpilot data analysis, and BBB complaints are in the evidence section below.
