We Destroy Phishing

Comprehensive threat intelligence feed. 500,000+ domains blocked since 2019.
Real-time protection for your security infrastructure.

⚡ Get the Lists 🔗 Visit Website

Primary Network

…Total Threats

…Active Now

Community Network

…Total Reported

…Verified Live

Threat Velocity (24h)

…+Primary

…+Community

...

Primary Feed

Real-time

...

Active Now

DNS Verified

...

Community

Every 2h

...

Live Feed

DNS Verified

Download Formats

Ready-to-use blocklists. Integrate in seconds.

📄

Plain Text

One domain per line. Universal.

domain.com

Primary Pri. Live Community Com. Live

🛡️

Hosts File

Pi-hole, Windows, System level.

0.0.0.0 domain.com

Primary Pri. Live Community Com. Live

🚫

AdBlock Plus

uBlock Origin, AdGuard extensions.

||domain.com^

Primary Pri. Live Community Com. Live

🌐

Dnsmasq

Routers (OpenWRT) & Servers.

address=/d.com/0.0..

Primary Pri. Live Community Com. Live

🗄️

Redis

SET commands. In-memory blocklist cache.

SADD blocklist domain.com

Primary Pri. Live Community Com. Live

🔒

RPZ Zone

DNS Firewall. BIND, PowerDNS, Knot.

domain.com CNAME .

Primary Pri. Live Community Com. Live

⚓

Unbound

Unbound DNS resolver. Local NXDOMAIN.

local-zone: "d.com" always_nxdomain

Primary Pri. Live Community Com. Live

Data Feeds

Raw JSON for developers. Auto-updated.

🔥 Primary

Main List

Complete curated blocklist. Real-time.

⚡ Active

Active Domains

DNS-verified live only. 24h update.

👥 Community

Aggregated

From 12+ sources. 2h update.

⚡ Com. Live

Community Live

Community DNS verified. 24h update.

🌳 Roots

Root Domains

No subdomains. Roots only.

✅ Allow

Allowlist

Verified legitimate domains.

Historical Archives

Weekly & monthly full-list snapshots. Git history pruned to keep the repo fast — archives live in GitHub Releases.

The working tree once grew past 60 GB. To keep clone times reasonable, point-in-time dumps were rotated out of git and published as release assets: YYYY-Www.json (every Monday) and YYYY-MM.json (1st of month).

Threat Intelligence API

Free, open, no API key required. Real-time domain threat scoring for your apps.

⚡ Single Check

GET /v1/check?domain=suspicious.xyz

Risk score 0-100 with severity levels
Keyword detection (metamask, wallet, airdrop...)
Subdomain → parent domain matching
Multi-source confirmation flags

📦 Bulk Check

POST /v1/check/bulk (500/req)

Check up to 500 domains per request
Per-domain threat analysis
Summary with threat/clean counts
JSON request & response

🔍 Search & Feeds

GET /v1/search?q=metamask

Search blocklisted domains by substring
Full domain feeds: primary, community, active
Live stats & sync status
Hourly sync from destroylist

770K+

Domains

0-100

Risk Score

1h

Sync Cycle

Integrated Intelligence

MetaMask

Official Ethereum wallet phishing detection list protecting millions of users worldwide

MetaMask/eth-phishing-detect

ScamSniffer

Real-time Web3 anti-scam platform protecting users from crypto phishing and scams

scamsniffer/scam-database

Polkadot JS

Official Polkadot ecosystem phishing list protecting Substrate-based blockchain users

polkadot-js/phishing

Codeesura

Community-driven anti-phishing extension with curated list of malicious crypto sites

codeesura/Anti-phishing-extension

Crypto Firewall

Comprehensive cryptocurrency security project with extensive domain blacklists

chartingshow/crypto-firewall

OpenPhish

Public phishing intelligence feed with continuously updated threat data

openphish/public_feed

Security Alliance (SEAL)

Web3 security coalition & education alliance maintaining shared blocklists

security-alliance/blocklists

SPMedia

Crypto scam and phishing threat intelligence feed with active monitoring

spmedia/Crypto-Scam-Threat-Intel

Phishing.Database

Massive collection of verified phishing domains from multiple sources

Ultimate-Hosts-Blacklist

Enkrypt

Multi-chain crypto wallet's phishing detection for Ethereum, Polkadot & more

enkryptcom/phishing-detect

ChainPatrol

Real-time Web3 security alerts and threat intelligence platform

app.chainpatrol.io

SEAL

Security & Education Alliance - community-driven initiative protecting crypto users

security-alliance

+ Many more sources integrated into our threat intelligence pipeline

View All Tools & Sources

How We Destroy Threats

🔥 Active Threat Neutralization

We don't just collect - we destroy. Unlike passive blocklists, we actively take down malicious infrastructure
Direct reporting to registrars, hosting providers, and network operators for immediate domain suspension
Automated abuse complaints filed within minutes of threat detection
Collaboration with law enforcement for high-severity campaigns

🎯 Multi-Source Intelligence Gathering

Google Ads monitoring: Continuous scanning of paid search results for malicious ads impersonating crypto services
Social media crawling: Twitter, Discord, Telegram monitoring for phishing campaigns
DNS monitoring: Real-time tracking of new domain registrations matching phishing patterns
Community submissions: User-reported threats verified by our team within hours
Honeypots & traps: Decoy wallets and services to catch scammers in action

⚡ Real-Time Processing

New threats added to blocklists within 15 minutes of verification
Automated DNS verification ensures domains are actively malicious before listing
GitHub Actions-powered CI/CD for instant list updates
Multiple list formats (JSON, TXT, DNS) updated simultaneously

Since 2019, we've successfully neutralized over 500,000 threats across 25+ networks, preventing millions of dollars in potential losses to crypto users worldwide.

Our mission: Destroy phishing infrastructure before it destroys your crypto.

We Destroy Phishing

Primary Network

Community Network

Threat Velocity (24h)

Download Formats

Plain Text

Hosts File

AdBlock Plus

Dnsmasq

Redis

RPZ Zone

Unbound

Data Feeds

Main List

Active Domains

Aggregated

Community Live

Root Domains

Allowlist

Mirrors & Distribution

jsDelivr

HuggingFace

OTX AlienVault

Historical Archives

📅 Weekly Snapshots

🗓️ Monthly Snapshots

📊 Daily Diffs

Threat Intelligence API

⚡ Single Check

📦 Bulk Check

🔍 Search & Feeds

Integrated Intelligence

How We Destroy Threats

🔥 Active Threat Neutralization

🎯 Multi-Source Intelligence Gathering

⚡ Real-Time Processing

Community Contributors