{
  "snapshot_date": "2026-05-12T15:39:32.014784+00:00",
  "purpose": "Frozen snapshot of all key claims and data points. If NameSilo alters public records, DNS, domain portfolio, or financial filings after this date, this snapshot (committed to git and IPFS) proves the original state.",
  "namesilo_domain_portfolio": {
    "source": "namesilo-domains-5.1M.csv.gz (SHA-256: 126a19f688000fcd...)",
    "total_domains": 5179405,
    "snapshot_note": "Domain list obtained from public WHOIS/zone file analysis",
    "breakdown": {
      "no_dns_resolution": {
        "count": 1669111,
        "pct": 32.2
      },
      "sedo_parking": {
        "count": 569364,
        "pct": 11.0
      },
      "cloudflare_enterprise_bulk": {
        "count": 486278,
        "pct": 9.4
      },
      "shopify_unconfigured": {
        "count": 84558,
        "pct": 1.6
      },
      "bulk_shared_ip_1000plus": {
        "count": 478355,
        "pct": 9.2
      },
      "cloudflare_proxy_ambiguous": {
        "count": 667489,
        "pct": 12.9
      },
      "potentially_active": {
        "count": 1224250,
        "pct": 23.6
      }
    },
    "provably_dead_pct": 54.2,
    "dead_including_bulk_pct": 63.5,
    "majestic_ranked": {
      "top_1k": 1,
      "top_10k": 24,
      "top_100k": 430,
      "top_1m": 7037,
      "pct_with_any_rank": 0.14
    },
    "with_contact_email": {
      "count": 210184,
      "pct": 4.06
    },
    "no_signals_at_all": {
      "count": 4969221,
      "pct": 95.9
    }
  },
  "namesilo_financials": {
    "source": "NameSilo Q3 2025 earnings release (Nov 28, 2025), public SEDAR filings",
    "revenue_cad": "C$65.5M (reported 2025)",
    "market_cap_cad": "~C$133M (~US$98M)",
    "pe_ratio": 143.8,
    "industry_avg_pe": 21,
    "phantom_revenue_estimate": "$50.8M from dead registrations",
    "note": "If NameSilo restates financials or adjusts domain counts after this date, this snapshot proves the pre-investigation numbers"
  },
  "namesilo_public_statements": {
    "statement_1": {
      "date": "2026-03-13",
      "platform": "X/Twitter (@NameSilo verified org)",
      "text": "Our Abuse team conducted an in-depth review... the domain was compromised a few months ago... Prior to that, we had received no abuse reports... [working with the registrant to remove the website from VT reports]",
      "screenshot": "evidence/03-namesilo-statement-mar13.png",
      "sha256": "ad29e1d3d4803ff37c88ef860bef6de9e62f6ce533657f2e5c5460eb2e0b8ebf",
      "ghostarchive": "https://ghostarchive.org/archive/CXXZ0"
    },
    "statement_2": {
      "date": "2026-05-11",
      "platform": "X/Twitter (@NameSilo verified org)",
      "url": "https://x.com/namesilo/status/2053874303037219046",
      "text": "Your claims are false, libelous and defamatory. NameSilo takes action and reviews all abuse reports submitted to us. If you have any such cases, please submit them to abuse@namesilo.com. Otherwise, please contact the website host or registrant directly. And halt your falsehoods towards us or we will be forced to undergo legal action.",
      "views": 315,
      "replies": 106,
      "likes": 7,
      "retweets": 0
    }
  },
  "operator_statements": {
    "email_feb16": {
      "from": "royn5094@protonmail.com (N.R.)",
      "date": "2026-02-16",
      "key_quote": "There is no phishing going on with xmrwallet.com... we don't store seeds or keys, everything is done in your browser locally",
      "screenshot": "evidence/01-operator-email-feb16.png",
      "sha256": "919b5ee4c0f3a889381c644b557736d35625c69abaddd0ec7a8251eb514b0111"
    },
    "email_feb17": {
      "key_quote": "Feel free to subpoena the domain registrar for my information",
      "note": "Written 25 days BEFORE NameSilo's public defense of the operator"
    }
  },
  "xmrwallet_technical": {
    "raw_tx_discard": "raw_tx_and_hash.raw = 0 \u2014 client transaction discarded, server substitutes",
    "session_key_leak": "Private view key transmitted 40+ times per session via session_key parameter",
    "google_trackers": "4 Google trackers in a 'privacy' wallet: GTM, UA, GA4, DoubleClick",
    "hosting": "DDoS-Guard CDN, IQWeb custom hosting ($550+/month), Belize bullet-proof IPs",
    "registrar_suspensions": [
      "Tucows (xmrwallet.cc)",
      "NICENIC (xmrwallet.biz)",
      "Gandi (xmrwallet.me)"
    ],
    "namesilo_action": "Public defense of operator, offered to scrub VirusTotal detections"
  },
  "trustpilot_snapshots": {
    "namesilo_reviews": {
      "file": "namesilo-trustpilot-all.json",
      "count": 2480
    },
    "namecheap_reviews": {
      "file": "namecheap-trustpilot-all.json",
      "count": 2480,
      "note": "Control group"
    },
    "xmrwallet_reviews": {
      "file": "xmrwallet-trustpilot-all.json",
      "count": 80
    },
    "deleted_victim_reviews": "100+ victim reviews removed from Trustpilot"
  },
  "twitter_bot_evidence": {
    "file": "xmrwallet-twitter-evidence.json",
    "bot_tweets": 41,
    "unique_bot_accounts": 32,
    "scrape_date": "2026-05-11"
  },
  "what_they_will_try_to_change": {
    "1_domain_redistribution": "Move dead domains to active IPs, point parked domains at placeholder sites to lower dead% \u2014 our CSV snapshot is frozen at 5,179,405 domains with their original DNS state",
    "2_delete_tweets": "Remove the May 11 legal threat tweet and/or March 13 defense tweet \u2014 both are in GhostArchive, Wayback, and git",
    "3_trustpilot_cleanup": "Restore some victim reviews or add fake positive reviews \u2014 our scrape of 2480+80 reviews is timestamped",
    "4_financial_restatement": "Adjust reported revenue or domain counts in next quarterly filing \u2014 SEDAR originals are public record, our snapshot captures pre-change numbers",
    "5_operator_domain_moves": "Transfer xmrwallet.com away from NameSilo to create distance \u2014 WHOIS history in SecurityTrails data is already archived in cached-evidence/",
    "6_github_takedown": "DMCA the ipfs-archive repo \u2014 content is on IPFS (phishdestroy.eth.limo), 10+ mirror locations, Codeberg, GitLab",
    "7_seo_article_removal": "Remove the 50+ paid articles promoting xmrwallet \u2014 Wayback Machine copies exist",
    "8_matthagan22": "Delete account or change profile \u2014 tweet screenshot already preserved"
  }
}