Destroylist: Phishing & Scam Domain Blacklist

• Quick Start
• Live Statistics
• Data Feeds
• Root Lists
• Content-Verified Feeds
• Threat Intelligence API
• About Destroylist
• Workflow & Remediation
• Fraud Victims Info
• Appeals Process
• Connect With Us
• Join the Fight

Badge values are exact feed-entry counts. The API reports normalized unique domains, so its values can be lower after URL, www and duplicate normalization. See the machine-readable dns/metrics.json definitions.

Getting 429 errors? Use the jsDelivr CDN links below — they bypass GitHub rate limits.

Via jsDelivr CDN (recommended, no rate limits):

Redis one-liner — load the full list into a Redis set (atomic swap, zero-downtime reload):

curl -s https://cdn.jsdelivr.net/gh/phishdestroy/destroylist@main/rootlist/formats/primary/redis.txt | redis-cli --pipe

Then check any domain in O(1): SISMEMBER destroylist:primary evil-domain.com

Hosts → Pi-hole, /etc/hosts, Windows · AdBlock → uBlock Origin, AdGuard · Dnsmasq → dnsmasq DNS · Unbound → pfSense, OPNsense · RPZ → BIND, Knot DNS · Redis → redis-cli --pipe bulk load

Tip: Root domains only — no subdomains, hosting providers excluded

All Roots — clean root domains (no infra) · Live Only — DNS-verified active · Services Only — hosting platform subdomains (Vercel, Pages.dev, Netlify, etc.)

Note: Real HTTP content verification — not just DNS, but actual phishing page detection

Download links: see Data Feeds above

Warning: Cloaking Alert: Scammers use cloaking to hide phishing from bots — showing blank/fake pages to scanners. Domain NOT in content list ≠ safe! Use Primary or Community full lists for complete protection.

%%{init: {"themeVariables":{"background":"transparent","primaryBorderColor":"#c52237","lineColor":"#c52237","clusterBkg":"transparent","clusterBorder":"#898999","edgeLabelBackground":"transparent","fontFamily":"system-ui, sans-serif"},"flowchart":{"curve":"basis","htmlLabels":true}}}%%
flowchart LR
  Request["Client Request<br/>(Single / Bulk)"] e1@--> API["Live API<br/>api.destroy.tools"]
  API e2@--> Engine["Threat Engine<br/>(Risk Score 0-100)"]
  Engine e3@--> DB[("Destroylist DB<br/>1M+ Threats")]
  DB e4@--> Engine
  Engine e5@--> Response["JSON Response<br/>(Severity & Status)"]

  classDef client fill:transparent,stroke:#898999,stroke-width:2px;
  classDef api fill:transparent,stroke:#c52237,stroke-width:2px;
  classDef db fill:transparent,stroke:#898999,stroke-width:2px,stroke-dasharray: 5 5;
  classDef animate stroke:#c52237,stroke-width:2px,stroke-dasharray:10 5,stroke-dashoffset:900,animation:dash 22s linear infinite;
  classDef animateDark stroke:#898999,stroke-width:2px,stroke-dasharray:10 5,stroke-dashoffset:900,animation:dash 22s linear infinite;

  class Request client;
  class API,Engine,Response api;
  class DB db;
  class e1,e2,e3,e5 animate;
  class e4 animateDark;

Per-IP quotas: 300 data units/minute; intelligence routes have 30 units/minute and 1,000/day. Request costs vary by endpoint. On HTTP 429, respect Retry-After. Current limits and response schemas.

Listed-domain results include a risk score (0–100) and the API's severity verdict. Signals include curated and community listings, DNS/HTTP liveness, multiple sources and naming patterns. Unlisted domains can return separate heuristic signals; a missing listing is not a safety guarantee.

Use the returned threat, severity and flags fields. The current OpenAPI specification defines each response shape.

cURL

curl "https://api.destroy.tools/v1/check?domain=suspicious-site.xyz"

Python

import requests
domain = "example.com"
r = requests.get("https://api.destroy.tools/v1/check", params={"domain": domain}, timeout=30)
r.raise_for_status()
result = r.json()
if result["threat"]:
    print(f"BLOCKED: {result['severity']} (score: {result['risk_score']})")

JavaScript

const domain = "example.com";
const r = await fetch(`https://api.destroy.tools/v1/check?domain=${encodeURIComponent(domain)}`);
if (!r.ok) throw new Error(`API returned HTTP ${r.status}`);
const data = await r.json();
if (data.threat) console.warn("PHISHING:", data.severity, data.risk_score);

Bulk Check

curl -X POST "https://api.destroy.tools/v1/check/bulk" \
  -H "Content-Type: application/json" \
  -d '{"domains":["site1.com","site2.xyz","site3.top"]}'

Pi-hole — Settings > Blocklists > paste the Hosts URL
AdGuard Home — Filters > DNS Blocklists > Add blocklist > paste the AdBlock URL
uBlock Origin — Settings > Filter lists > Import > paste the AdBlock URL
pfSense — Services > DNS Resolver > paste the Unbound URL
BIND/Knot — Add the RPZ URL as a response-policy zone

# Plain domain list
curl -fsSL https://raw.githubusercontent.com/phishdestroy/destroylist/main/rootlist/formats/primary_active/domains.txt -o domains.txt

# Hosts format (Pi-hole, /etc/hosts)
curl -fsSL https://raw.githubusercontent.com/phishdestroy/destroylist/main/rootlist/formats/primary_active/hosts.txt -o hosts_blocklist.txt

# AdBlock format (uBlock Origin, AdGuard)
curl -fsSL https://raw.githubusercontent.com/phishdestroy/destroylist/main/rootlist/formats/primary_active/adblock.txt -o adblock.txt

# Dnsmasq
curl -fsSL https://raw.githubusercontent.com/phishdestroy/destroylist/main/rootlist/formats/primary_active/dnsmasq.conf -o dnsmasq_blocklist.conf

# Unbound (pfSense / OPNsense)
curl -fsSL https://raw.githubusercontent.com/phishdestroy/destroylist/main/rootlist/formats/primary_active/unbound.conf -o unbound_blocklist.conf

# RPZ (BIND / Knot)
curl -fsSL https://raw.githubusercontent.com/phishdestroy/destroylist/main/rootlist/formats/primary_active/rpz.zone -o rpz_blocklist.zone

import requests
blocklist = requests.get('https://raw.githubusercontent.com/phishdestroy/destroylist/main/list.json').json()
is_malicious = "suspicious-domain.com" in blocklist

curl -s https://raw.githubusercontent.com/phishdestroy/destroylist/main/list.txt | grep -q "suspicious-domain.com" && echo "BLOCKED"

%%{init: {"themeVariables":{"background":"transparent","primaryBorderColor":"#c52237","lineColor":"#c52237","clusterBkg":"transparent","clusterBorder":"#898999","edgeLabelBackground":"transparent","fontFamily":"system-ui, sans-serif"},"flowchart":{"curve":"basis","htmlLabels":true}}}%%
flowchart LR
  Discover["DISCOVER<br/>30+ Parsers"] e1@--> Report["REPORT<br/>50+ Vendors"]
  Report e2@--> Legal["LEGAL<br/>ICANN Compliance"]
  Legal e3@--> Publish["PUBLISH<br/>Real-time Feed"]

  classDef box fill:transparent,stroke:#898999,stroke-width:2px;
  classDef animate stroke:#c52237,stroke-width:2px,stroke-dasharray:10 5,stroke-dashoffset:900,animation:dash 22s linear infinite;

  class Discover,Report,Legal,Publish box;
  
  class e1,e2,e3 animate;

We utilize a distributed network of 30+ proprietary parsers to identify malicious domains at their earliest stage:

• Advanced Heuristics: Continuous monitoring of Google Ads (Malvertising), SEO-manipulated search results, and trending social media campaigns on Twitter (X), YouTube, and Telegram
• Infrastructure Analysis: Leveraging dnstwist and typosquatting detection to catch look-alike domains targeting established brands
• Community Intelligence: Real-time ingestion of community-reported threats via our Telegram Bot and partner intelligence feeds

Once a threat is confirmed, we submit data to over 50 industry-leading vendors:

Cloudflare        Google Safe Browsing      Microsoft Security      VirusTotal
Netcraft          ESET                      Bitdefender             Norton Safe Web
Avira             PhishTank                 Dr.Web                  Yandex Safe Browsing
URLScan.io        PolySwarm                 SiteReview              Urlquery
PhishStats        PhishReport               IsItPhish               ThreatCenter

• Abuse Notifications: Formal alerts to domain registrars and hosting providers
• Forensic Evidence Disclosure: Complete evidence packages including metadata, screenshots, and PDF reports
• ICANN Compliance Support: Reports aligned with ICANN standards
• Conditional Re-Detection Logic: Follow-up reports only while the threat remains active, never sooner than 48 hours after the previous report (current reporting policy)

• Open Database: Real-time commits to this GitHub repository
• Live Monitoring: Visual intelligence at phishdestroy.io/live
• Social Broadcasting: Automated alerts on Twitter, Telegram, and Mastodon

DestroyList aims to disable malicious domains: scams, phishing, and other illicit sites to enhance internet safety.

1. Scan it across cybersecurity platforms for threat intelligence.
2. Send an official complaint to the registrar and the hosting provider (via WHOIS), including scan results, screenshots, and a request for client investigation. The complaint also notifies them about inclusion in our public database.

ICANN's 2013 RAA §3.18.1 requires registrars to take reasonable and prompt steps to investigate and respond appropriately to abuse reports. The 24-hour review requirement in §3.18.2 applies to well-founded reports of illegal activity from law enforcement, consumer-protection and other qualifying authorities, sent to the registrar's dedicated contact.

We work hard to eliminate threats quickly. Every malicious domain is analyzed, documented, reported, and published transparently.

However, when a domain receives 10–30+ abuse reports and a registrar still ignores them for months, the situation changes: the registrar is no longer a passive party.

It effectively provides infrastructure for illegal activity.

Some registrars behave as if their internal policies somehow override ICANN requirements and national laws — as if phishing and fraud are "allowed" as long as they personally decide not to act.

We document this publicly so that anyone can see: threats persist not because they were unnoticed, but because the responsible providers simply chose to do nothing.

DestroyList is an open-source, non-commercial volunteer project.

Private individuals may request the number of abuse reports we have sent for a specific domain, but only through public channels:

• via GitHub issues
• via commit history: https://github.com/phishdestroy/destroylist/commits/main/

We do not respond to private e-mail requests from individuals about report counts.

This is a legal requirement for transparency and equal access to information.

Official government or law-enforcement requests may be answered privately.

If you were defrauded by a domain already listed here, check its addition date using the commit history or via our Telegram/Mastodon channels.

If the fraud happened after the domain was already listed, the registrar's or host's delay may indicate they share responsibility for the loss. Future potential victims can also see this negligence documented publicly.

Registrars and hosts that tolerate scam operations may reasonably be expected to assist victims or their legal representatives.

Network security · Threat research · AI/ML training · Trend analysis · Automation

Point-in-time history — every state of the list is reconstructable:

Tip: Historical Vault (500K+ domains, 5+ years archived): contact@phishdestroy.io

• Official Website: phishdestroy.io
• Telegram Report Bot: @PhishDestroy_bot
• Telegram Channel: @destroy_phish
• Mastodon: @phishdestroy
• Twitter/X: @Phish_Destroy
• Medium Blog: phishdestroy.medium.com
• Email Contact: contact@phishdestroy.io
• API Portal: api.destroy.tools
• Ban Service: ban.destroy.tools

We welcome contributions:

• Fresh threat intelligence & new blocklist sources
• Detection algorithm improvements
• Integration guides for new platforms
• Translations & documentation