PhishDestroy Evidence Archive — Windows 98 Edition

🌐Main Archive
(Cyberpunk)

📊Investor
Presentation

💻NameSilo
Panel

📷Evidence
Gallery

🤖Bot Farm
Analysis

💣truth.exe

💾5.1M Domain
Dataset

🌍Languages
(10)

Summary Pyramid Prices ShortDot Laundering FAQ Investor Evidence Contact

PhishDestroy Evidence Archive — FULL REPORT

□

⚠ WARNING: This page contains facts about NameSilo, LLC (IANA #1479, Phoenix AZ). Facts may cause discomfort to shareholders, executives, and people who believe ICANN accreditation is a get-out-of-jail-free card. You have been warned. We haven't.

TL;DR: xmrwallet.com stole an estimated $100M+ in Monero over 8 years via server-side transaction hijacking. NameSilo, LLC publicly defended the operator, fabricated a "compromise" story, offered to remove VirusTotal detections, and used X Gold Checkmark to silence researchers. This archive contains 61 SHA-256 verified screenshots, court-ready PDFs, operator emails, ICANN filing, 130M+ domain analysis, and the operator's own farewell letter.

Archive Stats

Domains blocked	130,000+	Stolen & documented	$20M+
Platforms censored	7+	Claims disproven	0
Evidence screenshots	61 (SHA-256)	Court-ready PDFs	5
Domain dataset	5.18M rows (54MB)	Cached evidence	270+ files

Suppression Campaign

Platform	Status	What happened
Bing	DEAD	All phishdestroy.io results removed
Twitter / X	LOCKED	Gold Checkmark lock. X review: "no violation." Still locked.
GitHub	WON	False DMCA. Contested. Repos restored.
Google	WON	DMCA requests against search. Contested. Won.
IPFS/ENS	SAFE	No server. No host. No "report" button.
Trustpilot	DEAD	100+ victim reviews removed
YouTube	DEAD	Technical analysis videos reported & removed

How we found it: We were scrolling through 5.18M NameSilo domains. Row after row of gibberish: sdf8k3jx.sbs, x9wqm2.cfd. No IP, no email, no phone, no rank. We decided to count. NameSilo was 10pp above its closest competitor. 2x industry baseline. 615% spike. We didn't go looking for money laundering. The data showed it to us.

The NameSilo Pyramid — 5.18M Domains Deconstructed

□

Layer	Count	%	Status
Total domains	5,179,405	100%	What they claim
No DNS + parking stubs	2,882,774	56%	PHANTOM
Has real IP	2,296,631	44%	Maybe real
HTTP alive (responds)	~958,188	18.5%	Possibly legit
Real business	54,855	1.06%	Actual companies
Top-million traffic	17,875	0.35%	Real websites
Tranco top 10K	58	lol	That's it

Zero Traffic99.65%
of portfolio

Phishing Ratio1 : 1.3
legit : phishing

vs Top-10K387x
more scam than legit

Dirty Ratio by Comparison Base

Compare against	Ratio	Translation
Total (5.18M)	0.43%	"barely anything" ← what NameSilo claims
Live IP (2.3M)	0.98%	"almost 1%"
HTTP alive (958K)	2.34%	"every 43rd site"
Top-million (17.8K)	125.6%	"more scam than legit"
Real business (54.8K)	40.9%	"1 phishing for every 2.5 businesses"

The phantom domains are a statistical smokescreen. Dilute the denominator → hide the crime rate.

Price Comparison — "Low Cost Leader" Exposed

□

Source: tldes.com — 136 ICANN-accredited registrars, live prices.

#	.com Registrar	Register	Renew	Transfer
1	Spaceship	$2.90	$10.18	$8.17
3	GoDaddy	$5.19	$23.19	$13.19
6	Namecheap	$6.99	$14.98	$11.08
14	Dynadot	$8.99	$10.88	$10.49
23	Porkbun	$10.08	$11.08	$10.08
26	Cloudflare	$10.46	$10.46	$10.46
... 100+ registrars cheaper than NameSilo ...
~96	NameSilo 🤡	$15.56	$17.29	$9.80

#96 of 130Bottom 26%

vs Spaceship5.4x more expensive

Cheaper registrars95+

Their Comparison Page is Fraud

Competitor	NameSilo claims	Real price (tldes.com)	Inflated by
GoDaddy	$23.98	$5.19	4.6x
Name.com	$17.99	$11.24	1.6x

They also claim "Over 150+ Payment Options." We counted: 12 methods. 7 cards + 3 web wallets + Bitcoin + Account Funds. Inflated 12.5x.

Why would anyone choose NameSilo? Not price (#96). Not UX (Win98). Not support (ignored 20+ abuse reports). Not ICANN (everyone has it). The only explanation: most domains aren't bought by real customers.

ShortDot SA Partnership — Follow the Money

□

ShortDot SA (Luxembourg, 9 Rue Louvigny) owns: .sbs, .cfd, .icu, .cyou, .bond, .buzz, .qpon

On shortdot.bond/about, they name 6 partners out of 400+:

GoDaddy, Alibaba, GMO, Namecheap, NameSilo, Dynadot

Timeline

Apr 2024	ShortDot acquires .sbs from Australian SBS Corporation
Apr 2024	ShortDot acquires .cfd from DotCFD Registry Ltd
2024	NameSilo dead domains spike 615% (67K → 485K)
2025	Spike continues: 585K dead domains, 10K-17K/day

ShortDot sells .sbs/.cfd wholesale ~$0.30-0.50 | v NameSilo registers at $0.99 retail | + counts as "domain under management" | + inflates revenue in quarterly reports | + dilutes scam ratio v ShortDot reports "growing TLD adoption" | + justifies acquisition costs v Both grow. Both report metrics. Nobody checks.

NameSilo~11%
ShortDot TLDs

GoDaddy<0.2%
ShortDot TLDs

Anomaly55x
concentration gap

5 Questions That Demand Answers:
1. Who buys hundreds of thousands of .sbs/.cfd and never activates them?
2. Where is the money coming from? Show the payment records.
3. Does ShortDot know their TLDs are vehicles for phantom revenue?
4. Why did the 615% spike coincide exactly with ShortDot's acquisitions?
5. Is ShortDot receiving payment for these registrations? From whom?

⚠ PROSECUTION BRIEF — The Case for Money Laundering

□

Not a theory. Not speculation. A chain of evidence that leads to one conclusion.

1	STEAL — xmrwallet.com hijacks Monero transactions for 8+ years. ~$100M+ stolen. Funds in XMR — untraceable.
2	CONVERT — XMR → BTC via DEX/mixers/OTC. Untraceable step. Output: Bitcoin.
3	WASH — Buy domains at NameSilo. NameSilo accepts Bitcoin. No KYC. 10K-17K domains/day. $0.99 junk TLDs. Never activated. The purchase IS the purpose.
4	REPORT — NameSilo books as revenue. C$65.5M/year. "Fastest growing." Stock on CSE (URL). P/E 143.8x.
5	CASH OUT — Insiders sell shares. Kristaps Ronka (18.5%, ~17M shares). Clean money. Laundry complete.

The Bitcoin On-Ramp

NameSilo accepts Bitcoin. This is the on-ramp. Stolen XMR → BTC → domains → "revenue." Zero identity verification. No KYC. No bank. They don't even accept Monero — the BTC step IS the mixer.

The Math

Dead domains (2024)	485,000 (615% spike)
Dead domains (2025)	585,000 (10K-17K/day)
Avg cost per domain	$0.99 - $3.00 (junk TLDs)
Annual spend (low)	$579,150
Annual spend (mid)	$1,755,000
Cumulative dead total	1,668,355 domains
Total estimated spend	$3.2M - $12M+
Source of funds	UNKNOWN
Payment method	Bitcoin accepted. No KYC.

This is either the worst investment in internet history or money laundering. There is no third option.

10 Questions for the Investigation

For FBI, FinCEN, Arizona AG, CSE/OSC, ICANN — anyone with subpoena power.

01	Show the payment records for 585,000 dead domains. Who paid? Which wallets/cards/accounts?
02	How many purchases were in Bitcoin? Total BTC amount? Traced to mixers or illicit wallets?
03	How many unique customers buy 10K-17K dead domains/day? 10,000 buyers or 3 accounts?
04	Do any accounts belong to NameSilo employees/officers? Ronka? Andreola? Related entities?
05	What is the financial relationship with ShortDot SA? Revenue sharing? Volume commitment?
06	Subpoena the abuse ticket system. How many xmrwallet reports filed 2018-2026? Compare to "no reports received."
07	Who authorized the VirusTotal delisting offer? Routine practice or one-time?
08	Has NameSilo filed SARs with FinCEN? 585K anonymous domains/year = textbook suspicious activity.
09	What % of C$65.5M revenue comes from never-activated domains? Why wasn't this disclosed?
10	Trace the Bitcoin payments. Chainalysis/Elliptic can answer this. One subpoena. Do it.

Every question can be answered with a single subpoena.
The only reason they haven't been answered is that nobody has asked.

Inflation Pattern — Every Documented Lie

□

Their Claim	Reality	Method	Inflate
"5.8M active domains"	~958K active	Count phantoms	6.1x
"150+ payment options"	12 methods	Count card brands	12.5x
GoDaddy "$23.98"	$5.19	Use renewal price	4.6x
Name.com "$17.99"	$11.24	Use inflated price	1.6x
"No abuse reports"	100+ received	Delete and deny	∞
"Domain compromised"	Code never changed	Fabricate narrative	Fiction
"Low cost leader"	#96 of 130	Show inflated competitors	Fraud
"Fastest growing"	615% dead spike	Count phantoms as growth	Phantom

Lying is not their cover-up strategy. It's their business model.

Pre-Emptive FAQ — NameSilo's Response Playbook

□

We've dealt with enough registrars to know exactly what they'll say.

"We are an ICANN-accredited registrar."

Yes. You mentioned it in your abuse responses, Twitter, Wikipedia, and Q3 2025 SEDAR+ filing. Trustname.com (IANA #4318) is also accredited — with €120 in revenue and a deletion notice. ICANN accreditation is a commercial license, not a character reference.

"The domain was compromised."

We have SHA-256 hashes from before and after. The code never changed. The IP never changed. The operator himself never claimed compromise. You invented this story.

"We had received no abuse reports."

20+ from us alone with delivery receipts. Public posts on BitcoinTalk (2021) and Reddit (2018) mention filing reports. Real total likely 100+. Would you like us to publish the receipts?

"Dead domains are normal."

Correct. 15-21% is baseline. You're at 32.2% — 2x baseline. With a 615% spike. And 10K-17K/day bulk runs. Namecheap is at 32.6%. Explain the gap.

"njal.la is an independent reseller."

WHOIS says NameSilo, LLC. Not njal.la. Your internal arrangements don't override public registry data, ICANN rules, or the law.

"We will pursue legal action."

The operator threatened the same in February. It's May. We're on IPFS. Truth is an absolute defense. Sue us — this archive becomes court exhibit A through Z. Discovery will be fun.

[Silence]

Also an option. Every day of silence is another day the evidence sits on IPFS, indexed by search engines, read by investigators. Silence is not a strategy. It's a countdown.

NameSilo Technologies Corp. — Investor Data

□

Corporate Structure

Parent	NameSilo Technologies Corp.	British Columbia, Canada	CSE: URL / OTC: URLOF
Subsidiary	NameSilo, LLC	Phoenix, Arizona, USA	IANA #1479
CEO (Parent)	Paul Andreola
CEO (LLC)	Kristaps Ronka (18.5% owner, ~17M shares)

Q3 2025 Financials

Revenue	C$16.9M (+17.9%)	Market cap	C$133M
Net income	C$1.15M (+135%)	Shares	92.6M
Cash	C$2.4M	P/E	143.8x (industry: 21x)
Deferred rev	C$33M	Acquisitions	SewerVUE ($2.45M)

If you own shares: 81.5% of domains have never been a real website. "5.18M domains" is really ~958K active. Revenue growth may be phantom domain purchases. This is a securities fraud problem. CSE, OSC, and SEC should be asking questions.

Why Self-Buy Domains?

1. Money laundering	Stolen crypto → domains → "revenue." $3.2M/year.
2. Ranking inflation	More domains = "top 10 registrar" = more trust.
3. Revenue inflation	Phantom revenue → stock price → insiders sell.
4. Scam ratio dilution	5% abuse looks bad. Buy 2M dead → now it's 0.5%.

One move, four wins. Who's checking?

📊 View Full Investor Presentation (10 slides)

Evidence & Downloads

□

Key Downloads

File	Size	Description
namesilo-domains-5.1M.csv.gz	54 MB	Complete NameSilo domain dataset (5,179,405 rows)
ALL_EVIDENCE_HASHES.txt	TXT	SHA-256 hashes for all 61 evidence files
cached-evidence SHA256SUMS	TXT	270+ cached evidence files manifest
ANOMALY_REPORT.md	MD	130M+ domain analysis report
Court-Ready PDFs	PDF	ICANN complaint, evidence report, victim advisory
Operator Farewell	HTML	The operator's own admission (May 2026)

Evidence Categories

16 primary screenshots	Operator emails, NameSilo tweet (4 lies), X Support, VT delisting
11 additional screenshots	Victim reports, deleted GitHub issues, DNS maps, Trustpilot
26 tweet screenshots	Complete @Phish_Destroy archive before Gold Checkmark lock
270+ cached pages	Reddit, Wayback, VirusTotal, URLscan, SecurityTrails, victims

Verification: sha256sum -c SHA256SUMS.txt — every file's integrity is independently verifiable. If a hash doesn't match = tampering.

📷 Full Evidence Gallery 🤖 Bot Farm Analysis 🌐 Main Archive (Cyberpunk)

Contact PhishDestroy

□

Main site	phishdestroy.io
IPFS	phishdestroy.eth.limo (ENS)
Email	[email protected]
GitHub	github.com/phishdestroy
Twitter/X	@Phish_Destroy (locked by Gold Checkmark)
Telegram	t.me/phishdestroy

$0 received. Ever. Zero income. No sponsors. Funded by parents. Donations forwarded. If anyone claims PhishDestroy is financially motivated — good luck proving that.

About This Page

PhishDestroy Evidence Archive — Windows 98 Edition

Same evidence as the main archive. Same SHA-256 hashes. Same facts. Different aesthetics.

This page is our tribute to NameSilo's actual admin panel design, which their CEO Kristaps Ronka admitted needs a "complete UX overhaul" after seven years. We recreated the experience they give their customers — and applied it to the evidence they tried to suppress.

phishdestroy.eth — Permanent IPFS Archive — 2026