# xmrwallet.com — How a $2M+ Scam Got Into AI Recommendations

**Date:** 2026-05-13
**Subject:** xmrwallet.com & namesilo.com
**Focus:** Mechanism of infiltration into ChatGPT/AI search recommendations

---

## TL;DR

xmrwallet.com — confirmed scam (theft of Monero private view keys, $2M+ stolen). The operator built a multi-layered SEO/GEO campaign that inserted the site into "best monero wallet" listicles across the internet. These listicles are the main source from which ChatGPT and other LLMs form recommendations. NameSilo as a registrar actively protects the scammer.

---

## 1. MECHANISM OF INCLUSION IN AI RECOMMENDATIONS

### 1.1 Pipeline: Content -> Listicles -> LLM Training/RAG -> User Recommendation

```
[Sponsored Articles] -> [Listicle "Best Monero Wallet"] -> [Google Index]
         |                        |                              |
         v                        v                              v
  [PBN Backlinks]         [Authority Signals]           [ChatGPT RAG Pipeline]
         |                        |                              |
         v                        v                              v
  [SERP Ranking]          [Repetition = Truth]          [AI Recommendation]
```

LLMs (ChatGPT, Perplexity, Gemini) use **RAG (Retrieval-Augmented Generation)** — pulling data from the web. Key signals:

1. **Repetition = truth** — if 10+ sources say "xmrwallet is the best," the LLM will reproduce it
2. **Source authority** — crypto.news, guru99.com, beincrypto.com = high authority score
3. **Listicle format** — 59.5% of all AI quotes come from listicle content
4. **Freshness** — articles are regularly updated ("2024", "2025", "2026" in titles)

### 1.2 Specific Steps by the xmrwallet Operator

#### A. Paid Listicle Articles (GEO Layer 1)

| Site | Authority | Type | xmrwallet Position | Sponsored Note |
|------|-----------|-----|-------------------|----------------|
| crypto.news | High | **SPONSORED guest post** | #1 "undoubtedly the standout" | YES - #sponsored tag |
| guru99.com | 50 | Affiliate listicle | #1 "Editor's Choice" | NO (affiliate link guru99.link/a5e914) |
| hackr.io | 33 | Editorial listicle | #4 "Best Browser-Based" | NO |
| softwaretestinghelp.com | Med | Listicle | Top-10 | NO |
| coincodecap.com | Med | Listicle (cautious) | Listed with warnings | NO |
| coingape.com | Med | Listicle | Listed | NO |
| cryptopotato.com | Med | Sponsored review | Dedicated article | Implicit |
| binance.com/square | High | Cross-posted from crypto.news | #1 | Third-party disclaimer |

**crypto.news article** — key. Clearly marked `#sponsored`, auto cross-posted on Binance Square. States "undoubtedly XMRWallet is the standout" — such **superlative statements** ("best", "undoubtedly", "standout") trigger AI recommendations.

#### B. PBN Network for SEO Boost (GEO Layer 2)

50+ blogspot domains, created Jul-Sep 2025:
- `engliasd.blogspot.com` — 50,176 external links, anchor "xmrwallet"
- `fmcproda.blogspot.com` — 14,509 external links
- `intonettvas.blogspot.com` — 13,509 external links
- Series: asunm_*, lim_*, mcwcrown_*, branded crypto names

IP clusters: `192.178.155.132`, `172.253.62.132`, `142.251.167.132` (Google IPs — Blogspot)

**Correlation:** peak PBN spam (Jul-Sep 2025) = peak traffic (Sep 2025: 869 visits, 3x the norm)

#### C. Google Platform Spam (GEO Layer 3)

Operator **abrahambrantley** created:
- 6+ Google Sites pages (`sites.google.com/view/xmr-wallet*`)
- 6+ Google Cloud Storage pages (`storage.googleapis.com/abrahambrantley/*.html`)

Google domains = high trust score for LLM.

#### D. WordPress/Weebly/Rentry Spam (GEO Layer 4)

Operator **davidsingsones** + other aliases:
- `davidsingsones48.wordpress.com`, `davidsingsones31.wordpress.com`, etc.
- `suzzenkerryb60.weebly.com`, `rachallelad52.weebly.com`
- `rentry.co/h3vau`

#### E. Dead PBN Networks (Expendable Layers)

Two clusters of dead PBNs, used and discarded:

**Hetzner cluster** (IP: 168.119.205.26, DE):
- cryptoblog.site, bitsta.net, bitglobe.net, cryptoheart.net, bitinvest.info
- All died Nov 2025

**French cluster** (IP: 62.84.182.75, FR):
- 10 domains of various niches (betting, music, health, taxi)
- Classic multi-niche PBN, all died Nov-Dec 2025

#### F. Darkweb/Telegram Promotion (Trust Layer)

- Included in darkweb catalog **CONWAY** (moltisanti.neocities.org)
- Telegram channel **@darksidelinks** — 15 referring domains, 20 backlinks
- This creates an "underground credibility" signal

#### G. Trustpilot Review Farming

- 76+ reviews, rating 4.2
- Pattern: waves of 5-star reviews from single-review accounts
- Operator responds to scam complaints: "you're referring to a clone site"
- Trustpilot rating = authority signal for LLM

### 1.3 Why ChatGPT Picks This Up

According to GEO industry data (2026):

1. **Listicle content = 59.5% of all AI quotes** — xmrwallet in 8+ listicles
2. **Superlatives trigger recommendations** — "undoubtedly the standout", "Editor's Choice", "best"
3. **Repetition = consensus for LLM** — identical claims in 8+ sources
4. **Niche topics are more vulnerable** — "Monero wallet" = obscure topic, easier for LLM to "fold"
5. **Reddit mentions = 4x more likely to be quoted** — u/WiseSolution promoted on r/Monero (banned 2018)
6. **53.6% of ChatGPT responses without web sources** — recommendations from training data, including these listicles

---

## 2. TRAFFIC — SUMMARY FOR BOTH SITES

### xmrwallet.com

| Metric | Value |
|--------|-------|
| Estimated monthly visits | 640 (Semrush) |
| SimilarWeb | N/A (too little traffic) |
| Organic traffic US | 174/mo |
| Organic keywords US | 22 |
| Semrush rank US | 2,912,117 |
| Paid ads | NONE |
| Peak traffic | Sep 2025: 869 (PBN spam campaign) |
| Current traffic | ~60-140/mo (declining) |
| Real traffic estimate | 100-200/mo without spam |
| Total backlinks | 9,566 |
| Referring domains | 1,262 |
| Spam links | 70-80% |

**SimilarWeb cannot even show data** — traffic is below the measurement threshold. For a "service" through which $2M+ has passed, this is incredibly low — victims come through AI recommendations and direct links, not through search.

### namesilo.com

| Metric | Value |
|--------|-------|
| Estimated monthly visits | 260K (Semrush) / 799.5K (SimilarWeb Sep 2024) |
| SimilarWeb global rank | #48,531 |
| SimilarWeb category rank | #174 (Web Hosting & Domains) |
| Bounce rate | 35.22% |
| Pages per visit | 6.99 |
| Avg visit duration | 5:02 |
| Organic traffic US | 38,536/mo |
| Organic keywords US | 17,672 |
| AdWords spend | $67,214/mo |
| Total backlinks | 11,094,219 |
| Referring domains | 141,636 |
| Spam/parked links | ~95% (10.8M out of 11M) |

**Anomalies:**
- Korean traffic: 112K/mo (43% total) — 300x discrepancy vs history (200-400/mo)
- 85% ad spend on competitor brands (GoDaddy = 70% paid traffic)
- Chinese spam: 4.7M links (dom.com.cn alone = 1.3M)
- ScamAdviser: "high percentage of spammers and fraud sites" among clients

---

## 3. OPERATOR AND INFRASTRUCTURE

### Operator xmrwallet.com

| Field | Value |
|-------|-------|
| Name | Nathalie Roy |
| Location | Canada |
| GitHub | nathroy (ID: 39167759) |
| Reddit | u/WiseSolution (banned r/Monero 2018) |
| Email | royn5094@protonmail.com |
| Registrar | NameSilo (PrivacyGuardian.org) |
| Registration | 2016-08-29 |
| Expiry | 2031-08-29 |
| WHOIS address | 1928 E. Highland Ave. Ste F104 PMB# 255, AZ, US |

### Infrastructure

| Component | Detail |
|-----------|--------|
| IP | 186.2.165.49 (AS59692) |
| Hosting | IQWEB FZ-LLC (bulletproof, $550+/mo) |
| DDoS | DDoS-Guard |
| Web Server | Apache 2.4.58 / Ubuntu |
| Backend | PHP 8.2.29 |
| SSL | Let's Encrypt (auto) |
| Tor | xmrwalletdatuxms.onion |
| Analytics | Google Tag Manager UA-116766241-1 |
| Annual cost | $8,000-$15,000 |

### Satellite Domains

| Domain | Type | Status |
|--------|------|--------|
| xmrwallet.com | Primary | ACTIVE (NameSilo protects) |
| xmrwallet.cc | Alt | SUSPENDED |
| xmrwallet.biz | Alt | SUSPENDED |
| xmrwallet.net | Alt | DNS DEAD |
| xmrwallet.me | Redirect | Active? |
| xmrwalllet.com | Typosquat (triple-L) | IP: 85.192.48.109, Finland |
| bestmonerowallet.com | Satellite SEO | IP: 63.250.38.31, US |

### GEO Campaign Operators (aliases)

| Alias | Platforms |
|-------|-----------|
| abrahambrantley | Google Sites, Google Cloud Storage |
| davidsingsones | WordPress (3+ blogs), Weebly |
| hinrichspence30 | WordPress |
| ballhermanch91 | WordPress |
| suzzenkerryb60 | Weebly |
| rachallelad52 | Weebly |
| alenasemau24 | Blogspot |

---

## 4. NAMESILO — ROLE IN THE SCHEME

NameSilo is not just a registrar — they are an **active shield** of the operation:

1. **3 out of 4 registrars** (PublicDomainRegistry, WebNic, NICENIC) **suspended** xmrwallet domains
2. **NameSilo is the only one** who not only did not suspend but **published a public defense of the scammer**
3. NameSilo contacted the operator, accepted his explanation, and closed the abuse complaint
4. NameSilo **praised the operator** for lobbying the removal of Fortinet's "Phishing" detection
5. The domain is paid until **2031** — the operator is confident in NameSilo's protection
6. ICANN complaint filed (RAA Section 3.18)

**NameSilo's own profile:**
- ScamAdviser: "high percentage of spammers and fraud sites"
- Backlink profile inflated to 11M+ by parked domain pages
- Aggressive bidding on competitor brands (GoDaddy = 70% of paid traffic)
- Korean traffic anomaly (112K/mo, unexplained 300x spike)

---

## 5. TECHNICAL PROOF OF SCAM

### Key Theft (PhishDestroy, Feb 2026 capture)

Private view key → Base64 → `session_key` token → sent to server in **40+ requests** per session:

| Endpoint | Requests/session |
|----------|-----------------|
| /api/getheightsync | 12 |
| /api/gettransactions | 10 |
| /api/getbalance | 6 |
| /api/getsubaddresses | 4 |
| /api/getoutputs | 3 |
| /api/support_login | 1 (backdoor) |

**None of these endpoints require a view key** — balance checks and height syncs = public blockchain queries.

### Transaction Hijack

1. Client builds transaction
2. `raw_tx` is nullified (`raw_tx = 0`)
3. Server reconstructs transaction with victim's keys
4. Funds redirected to attacker addresses
5. Victim sees "Unknown transaction id" on block explorer

### Code Divergence

- **GitHub**: last commit November 2018
- **Production**: contains `session_key`, `/support_login` backdoor, Google Tag Manager
- **Wayback Machine**: no `session_key` in 2023, present in 2025
- **GitHub Issues #1-#12**: deleted (victim reports)

---

## 6. VICTIMS

| Metric | Value |
|--------|-------|
| Documented victims | 15+ (Trustpilot, Sitejabber, BitcoinTalk) |
| Largest single theft | 590 XMR (~$177,000) |
| Estimated total losses | $2M - $15M+ |
| VirusTotal detections | 6 vendors flag as malicious |
| Registrar suspensions | 3 out of 4 |
| Deleted GitHub issues | #1 through #12 |

---

## 7. NEXT STEPS / RECOMMENDATIONS

### For Investigation
- [ ] WHOIS history pre-2018 (before GDPR) — real registrant data
- [ ] IP 85.192.48.109 (FI, typosquat) — reverse DNS, ASN, associated domains
- [ ] IP 63.250.38.31 (US, satellite) — hosting provider, other domains
- [ ] IP 186.2.165.49 (AS59692, main) — full ASN analysis
- [ ] Google account "abrahambrantley" — identity recovery
- [ ] WordPress accounts investigation (davidsingsones etc.)
- [ ] Telegram @darksidelinks — operator identification
- [ ] Google Tag Manager UA-116766241-1 — linked properties
- [ ] Blockchain analysis: sweep transactions from victim wallets
- [ ] ICANN complaint status (RAA 3.18)
- [ ] NameSilo internal communications (legal discovery)
- [ ] Wayback Machine deep crawl: timeline of code changes

### For AI-platform reporting
- [ ] OpenAI: report xmrwallet.com as known scam appearing in ChatGPT recommendations
- [ ] Google: report Google Sites/GCS spam pages (abrahambrantley)
- [ ] Perplexity: verify and report if xmrwallet appears in results
- [ ] Request removal from all listicles (crypto.news, guru99, hackr.io etc.)

---

---

## 8. NAMESILO + XMRWALLET INTERSECTIONS — "SINGLE OWNER" ANALYSIS

### 8.1 Direct Connections

| Factor | Detail | Weight |
|--------|--------|--------|
| **PrivacyGuardian.org = NameSilo** | WHOIS xmrwallet.com hidden through PrivacyGuardian.org — this is **NameSilo's own service**. Address 1928 E. Highland Ave. Ste F104 PMB# 255, AZ = NameSilo's address | HIGH |
| **Operator knew in advance** | Email from 17 Feb 2026: "Feel free to subpoena the domain registrar" — demonstrates confidence in NameSilo's loyalty **BEFORE** public defense | HIGH |
| **3 out of 4 suspend, NameSilo protects** | PDR (India), WebNic (Malaysia), NICENIC (China) — all suspended. NameSilo is the only one: contact with scammer → public defense → "registrant is the victim" | CRITICAL |
| **NameSilo helped suppress detection** | Praised operator for lobbying to remove Fortinet "Phishing" label — while phishing code was active | HIGH |
| **Domain paid until 2031** | 15-year registration through NameSilo for a "free volunteer project" | MEDIUM |
| **Escape domains in advance** | Operator registered 4 escape domains (xmrwallet.cc/.biz/.net + others) BEFORE publication of investigation — through different registrars, but primary remained with NameSilo | MEDIUM |

### 8.2 Promotion Patterns — Parallels

| Pattern | xmrwallet.com | namesilo.com |
|---------|--------------|--------------|
| **Aggressive SEO manipulation** | PBN of 50+ blogspot, spam campaigns | 11M+ backlinks, 95% parked/spam |
| **Competitor brand abuse** | None (niche) | 85% ad spend on GoDaddy/Namecheap brands |
| **Inflated backlink profile** | 9.5K links, 70-80% spam | 11M links, 95% spam/parked |
| **Chinese spam network exposure** | Minimal | MASSIVE — dom.com.cn (1.3M links), 4.7M CN spam links |
| **Korean anomaly** | None | 112K/mo Korean traffic (300x vs history) |
| **Paid listicle placement** | crypto.news #sponsored, guru99 affiliate | Not directly found |
| **Platform spam** | Google Sites, GCS, WordPress, Weebly | Parked domain pages (6M+) |
| **Review manipulation** | Trustpilot farming (4.2, fake 5-stars) | Not researched |
| **ScamAdviser rating** | Very low trust score | "High percentage of spammers and fraud sites" |
| **AA419 / NetBeacon** | Not mentioned | Named as top abuse registrar (2017-2025) |

### 8.3 Business Model Intersection

**NameSilo as a fraud-friendly registrar:**
- Artists Against 419 (2017): "NameSilo has become one of the go-to places for West African fraudsters"
- 60%+ malicious domains through reseller QHoster
- NetBeacon (Mar 2025): NameSilo named among "highest observed rates of malicious phishing"
- BBB complaints: "NameSilo refuses to do anything about scammers"
- Abuse form does not send acknowledgment — cannot prove complaint was submitted

**"Single Owner" Hypothesis:**

No direct evidence of common ownership. But circumstantial evidence is strong:

1. **NameSilo's abnormal behavior** — the only registrar out of 4 who protected the scammer, published a statement, helped suppress security warnings
2. **Operator expected protection** — "feel free to subpoena the registrar" = knew NameSilo would not disclose
3. **NameSilo = PrivacyGuardian** — xmrwallet protected through NameSilo's own privacy service
4. **15-year prepaid domain** — unusual trust in registrar for a "volunteer project"
5. **NameSilo's business model** — revenue from fraud domains (3.4M active domains, $55M/yr revenue)
6. **NameSilo Technologies Corp (CSE:URL)** — public company, Vancouver. Owners: Brisio Innovations (81.5%), CEO Kristaps Ronka. Founders: Michael Goldfarb, Michael McCallister (Phoenix, AZ)

**More likely scenarios (from simple to complex):**

1. **NameSilo = fraud-tolerant registrar by business model** — cheap domains + free WHOIS privacy + minimal abuse enforcement = magnet for scammers. xmrwallet is one of many. NameSilo protects all clients to avoid losing revenue
2. **xmrwallet operator = significant NameSilo client** — 4+ domains, 15yr prepaid, possibly more domains. NameSilo protects major clients personally
3. **Connection through founders/investors** — Goldfarb/McCallister (Phoenix, AZ) → Nathalie Roy (Canada) → Brisio/NameSilo Technologies (Vancouver). Needs deeper investigation
4. **Direct ownership/partnership** — xmrwallet operator = NameSilo insider. Least provable without subpoena

### 8.4 What is Needed for Proof

- [ ] Subpoena NameSilo/PrivacyGuardian for real registrant data of xmrwallet.com
- [ ] Corporate registry search: Nathalie Roy in structures of Brisio/NameSilo Technologies Corp
- [ ] CSE:URL SEC/SEDAR filings — related party transactions, beneficial owners
- [ ] NameSilo internal abuse tickets (through ICANN enforcement)
- [ ] Financial flows: NameSilo → xmrwallet operator (or vice versa)
- [ ] Google Analytics UA-116766241-1 — check linked properties (may be a shared GA account)
- [ ] IP 186.2.165.49 (AS59692) — other domains on this IP, connection to NameSilo
- [ ] IQWEB FZ-LLC billing records — who pays for xmrwallet hosting
- [ ] Escape domains: who registered xmrwallet.cc/.biz/.net — same PrivacyGuardian?

---

## 9. WHERE DOES NAMESILO TRAFFIC COME FROM — A COMPLETE ANALYSIS

### 9.1 Decomposition of 260K monthly visits (Semrush) / 800K (SimilarWeb)

**Difference between Semrush vs SimilarWeb:**
- Semrush counts organic search traffic = 260K
- SimilarWeb counts ALL traffic (direct + referral + search + social) = 800K
- Delta ~540K = direct + referral + social traffic

### 9.2 Source #1: PARKED DOMAINS (~6M backlinks, main referral)

NameSilo manages **4M+ active domains**. By default, each new domain receives a parking page with links to namesilo.com:

**Anchors from parking pages:**
| Anchor | Domains | Backlinks |
|--------|---------|-----------|
| "whois" | 39,178 | 1,909,549 |
| "renew now!" | 32,736 | 1,900,910 |
| "domain" | 32,722 | 1,900,487 |
| "find similar names" | 20,743 | 300,914 |
| **TOTAL parked** | **~33K domains** | **~6M links** |

This is **54% of all backlinks** — automatically generated upon domain registration. Each parked domain = ~180 links to namesilo.com (whois, renew, domain links).

**Traffic from parked domains:**
- Direct referral through clicks on "whois" / "renew now!" / "find similar names"
- Estimate: ~50-100K visits/mo from 33K parked domains (if 1-3 clicks/domain/month)

### 9.3 Source #2: CHINESE SPAM NETWORK (~4.7M links)

| Domain | Backlinks | Type |
|--------|-----------|------|
| dom.com.cn | 1,316,046 | Single anchor "lo" — automatic scraper |
| gongxiangchongdianbao.com | 516,579 | CN spam |
| zjszrc.com | 311,143 | CN spam |
| jxfcrx.com | 198,525 | CN spam |
| 0467w.com | 191,033 | CN spam |
| **+ other CN domains** | **~2.2M** | |
| **TOTAL CN spam** | **~4.7M links** | **42% of all backlinks** |

**Mechanism:** Chinese sites massively scrape WHOIS data and publish it with links to the registrar. dom.com.cn alone created 1.3M links with anchor "lo" — this is an automatic parser, not a human.

**Anomaly:** One CN domain (同款域名商) = 52,960 links. One AR domain (حجز دومين) = 32,634 links. Both = single domain, mass page generation.

### 9.4 Source #3: KOREAN TRAFFIC ANOMALY (112K/mo = 43% total)

**Data:**
- Korea: rank #963, 195 keywords, 112,442 traffic/mo
- US: rank #53,511, 17,672 keywords, 38,536 traffic/mo
- Korea = 43% total organic, but only 195 keywords vs 17,672 US

**300x discrepancy:** History data for Korea shows 200-400/mo, overview shows 112K/mo.

**Hypotheses (from likely to unlikely):**

1. **Semrush data artifact** — Korean data is aggregated differently, possibly includes branded queries through Naver (46.5% market share in Korea) which Semrush does not separate correctly. NameSilo DOES NOT offer .kr domains, has no Korean localization — no organic reason for rank #963 in Korea.

2. **namesilo-china.com cross-attribution** — SimilarWeb shows namesilo-china.com as #3 competitor (4.3K visits). Possibly Semrush mis-attributes part of Asian traffic to the main domain.

3. **Purchased traffic / bot traffic** — SparkTraffic and similar services sell Korean web traffic from $5. If NameSilo or an affiliate buys Korean bot traffic for inflating metrics — this would explain the 300x spike.

4. **Korean reseller/affiliate** — a hidden partner promotes NameSilo in Korea, generating traffic through affiliate links which Semrush counts as organic.

**Important:** NameSilo DOES NOT sell .kr domains, has no Korean localization, does not accept Korean payment methods (only Alipay/UnionPay for China). Korean market = GoDaddy KR, DotName Korea, HostingKR, Cafe24. No organic reason for 112K Korean visits.

### 9.5 Source #4: ADWORDS ($67K/mo, competitor brand bidding)

85% of the advertising budget = other brands:
- "godaddy" (vol 823K, pos 2) = **70% paid traffic**
- "namecheap" (vol 165K, pos 4)
- Typos: "godady", "name cheap"
- Promo codes: "godaddy domain promo code", "namecheap promo code"
- Alternatives: "godaddy alternative"

**Paid traffic estimate:** $67K/mo spend, ~30-50K visits/mo

### 9.6 Source #5: ORGANIC SEARCH US (38.5K/mo, legitimate)

17,672 keywords, rank #53,511 — this is real organic traffic for a domain registrar. Includes:
- Brand queries ("namesilo", "name silo")
- Product queries ("cheap domains", "domain registration")
- Comparison queries ("namesilo vs namecheap")

### 9.7 Source #6: DIRECT TRAFFIC

Registered users visit directly to manage domains. With a base of 170K+ customers and 4M+ domains — direct traffic could be 200-400K/mo (main part of SimilarWeb delta).

### 9.8 TRAFFIC HISTORY US — ANOMALIES

| Period | Traffic | Ad Cost | Note |
|--------|---------|---------|------|
| 2024-05 | 20,460 | $71K | Baseline |
| 2024-09 | 43,340 | $149K | Heavy ad spend = 2x traffic |
| **2025-03** | **53,157** | **$644** | **ANOMALY: peak traffic, ZERO ad spend** |
| 2025-10 | 18,392 | $311 | Crash to below baseline |
| 2026-02 | 36,532 | $34K | Recovery with moderate ads |
| 2026-04 | 36,392 | $67K | Current, heavy ads |

**March 2025 anomaly:** Traffic peak (53K) with almost zero ad spend ($644). This is either:
- Massive organic/viral event (not found)
- Bot/purchased traffic inflation
- Data artifact

**Oct 2025 crash:** 18K with $311 ad spend = 66% drop from peak. If bot traffic was turned off — explains it.

### 9.9 SUMMARY: real vs inflated

| Source | Est. Monthly | Real/Fake |
|--------|-------------|-----------|
| Direct (customers) | 200-400K | REAL |
| Organic search (US+global) | 80-120K | REAL |
| Paid search (AdWords) | 30-50K | REAL (competitor brand) |
| Parked domain referral | 50-100K | ARTIFICIAL (auto-generated) |
| Korean anomaly | 112K | SUSPICIOUS (no organic reason) |
| Chinese spam referral | minimal actual visits | FAKE (link-only, no clicks) |
| **Total real** | **~350-550K** | |
| **SimilarWeb reported** | **800K** | |
| **Inflation factor** | **~1.5-2.3x** | |

**Bottom line:** NameSilo's real traffic = ~400-500K/mo. Inflation comes from:
1. Parked domain auto-links (inflates backlink count, some referral traffic)
2. Chinese spam (inflates backlink count to 11M, minimal real traffic)
3. Korean anomaly (112K unexplained, likely data artifact or purchased)
4. March 2025 spike (unexplained peak with zero ad spend)

---

## SOURCES

- [PhishDestroy: xmrwallet.com Exposed](https://phishdestroy.io/xmrwallet-exposed)
- [PhishDestroy: NameSilo Shields $2M Theft (Medium)](https://phishdestroy.medium.com/xmrwallet-com-2953f35b8a79)
- [PhishDestroy: NameSilo Exposed](https://phishdestroy.io/xmrwallet-namesilo-exposed)
- [GitHub: DO-NOT-USE-xmrwallet-com](https://github.com/phishdestroy/DO-NOT-USE-xmrwallet-com)
- [DEV.to: How NameSilo Became Press Secretary](https://dev.to/destroyphish/xmrwalletcom-scam-how-namesilo-became-the-press-secretary-for-a-2m-monero-theft-operation-189b)
- [ZeroFox: SEO Poisoning LLMs](https://www.zerofox.com/blog/seo-poisoning-llms/)
- [PPC.land: How Brands Manipulate ChatGPT](https://ppc.land/how-brands-manipulate-chatgpt-to-dominate-ai-search-results/)
- [SimilarWeb: namesilo.com](https://www.similarweb.com/website/namesilo.com/)
- [SimilarWeb: xmrwallet.com](https://www.similarweb.com/website/xmrwallet.com/)
- [crypto.news: 5 Best Monero Wallets (SPONSORED)](https://crypto.news/5-best-monero-wallets-to-explore-in-2025/)
- [Guru99: Best Monero Wallets](https://www.guru99.com/best-monero-wallets.html)
- [Hackr.io: Best Monero Wallets](https://hackr.io/blog/best-monero-wallet)
- [Trustpilot: xmrwallet.com](https://www.trustpilot.com/review/www.xmrwallet.com)
- [ScamAdviser: xmrwallet.com](https://www.scamadviser.com/check-website/xmrwallet.com)
- [Scam-Detector: xmrwallet.com](https://www.scam-detector.com/validator/xmrwallet-com-review/)