█ Append-only blacklist · since 1 July 2025

Live phishing threat feed.
Every detected scam domain, logged as we see it.

Name: Live Threat Feed | PhishDestroy
Creator: PhishDestroy
License: https://creativecommons.org/licenses/by/4.0/

The PhishDestroy live phishing threat feed is an append-only public record of recently detected phishing domains and malicious infrastructure. DNS resolvers, browser extensions and threat-intelligence pipelines use the same raw evidence.

Download JSON feed → Browse threats Report via bot

167 Threats Today since midnight

3,298 Threats This Week 7-day rolling

14,346 Threats This Month 2026-08

180,969 Total Threats Tracked full platform database

█ Daily threat activity

Last 30 days, by detection volume.

peak: 27.07 · 1,572 detections

Today Daily count

11.07 · 371

12.07 · 437

13.07 · 435

14.07 · 400

15.07 · 479

16.07 · 325

17.07 · 376

18.07 · 282

19.07 · 276

20.07 · 671

21.07 · 372

22.07 · 758

23.07 · 471

24.07 · 402

25.07 · 192

26.07 · 325

27.07 · 1,572 ← peak

28.07 · 617

29.07 · 283

30.07 · 600

31.07 · 527

01.08 · 325

02.08 · 450

03.08 · 563

04.08 · 848

05.08 · 270

06.08 · 341

07.08 · 392

08.08 · 267

09.08 · 167 (in progress)

11.07 19.07 26.07 02.08 09.08

Daily average 478

Peak (30d) 1,572

7-day momentum -51%

Registrars involved 1,360

01 / Featured investigations · this week

Why the registrars bury our reports.

all investigations
/news →

Retaliation 15 Apr 2026

Investigation · NameSilo

NameSilo killed our Twitter because we told the truth about them.

Two PhishDestroy X accounts locked under three shifting justifications. X's own automation cleared us in writing — the ban held anyway. Two weeks earlier we had documented NameSilo sheltering a $20M+ Monero-theft operation now under active EU criminal investigation.

9 min read · PhishDestroy Research Read exposé →

Registrar 14 Apr 2026

Investigation · Trustname (IANA #4318)

Trustname.com: "bulletproof" registrar with €120 in declared revenue.

An ICANN-accredited registrar that calls itself bulletproof in its own DNS TXT record. Estonian shell company, €120 revenue, one employee, Belarusian owners — and a week of fresh fake-Elon crypto-casino domains hidden behind its in-house privacy proxies.

14 min read · PhishDestroy Research Read exposé →

02 / Append log · DestroyList

The blacklist scrolls whether you watch or not.

Source: github.com/phishdestroy/destroylist
Format: append-only · CC-BY-4.0

scan@phishdestroy:~/destroylist$

LIVE uptime 404 d

scan@phishdestroy:~$ git log --follow list.json | head
▸ append-only blacklist · once added, an entry is never edited or removed
▸ 150,126 live-feed records since 01.07.2025 · sync interval ≈ 14s
scan@phishdestroy:~$ tail -f scan_results | jq

[2026-08-09 12:40:06]+ varka.topNICENIC INTERNATIONAL GROUP CO., LIMITED

[2026-08-09 12:33:42]+ apextrade-markets.ltdOwnRegistrar, Inc.

[2026-08-09 12:24:55]+ stervonvault.proHOSTINGER operations, UAB

[2026-08-09 12:21:40]+ lizsbs.shopGlobal Domain Group LLC

[2026-08-09 12:21:17]+ jup-hubbs.comNICENIC INTERNATIONAL GROUP CO., LIMITED

[2026-08-09 12:21:09]+ boomchange.comInternet Domain Service BS Corp

[2026-08-09 12:19:54]+ optionsclubpro.comGransy, s.r.o.

[2026-08-09 12:19:45]+ diamondprimecap.comNameSilo, LLC

[2026-08-09 12:19:43]+ nationwideskilledtrade.netTuringSign Inc. d/b/a Cosmotown

[2026-08-09 12:19:41]+ centralcapitalexchange.comUltahost, Inc.

[2026-08-09 12:19:39]+ echelonxdigitalmarket.comRealtime Register B.V.

[2026-08-09 12:19:15]+ netfinondo.comNameSilo, LLC

[2026-08-09 12:19:11]+ brickvaultmarkets.liveHOSTINGER operations, UAB

[2026-08-09 12:19:08]+ bluecentralexchange.comRealtime Register B.V.

[2026-08-09 12:19:05]+ apexpromarkets.orgDynadot Inc

[2026-08-09 12:18:57]+ bixerytrades.comNameSilo, LLC

Last entry: +varka.top · 2026-08-09 10:40 UTC Showing 16 of 150,126 live-feed records · Browse full database →

03 / Infrastructure analytics

Where the infrastructure hides — and what it costs users.

Rolling 30-day window
Auto-refresh 60s

Hall of shame · registrars

7 / 1,360

NICENIC INTERNATIONAL GROUP CO., LIMITED

24,260

Cloudflare, Inc.

15,267

PDR Ltd. d/b/a PublicDomainRegistry.com

6,348

Gname.com Pte. Ltd.

5,163

NameSilo, LLC

4,819

GoDaddy.com, LLC

4,647

DYNADOT LLC

4,395

Top TLDs · by detections

7 of 528 TLDs · by detection count

.com52,782

.dev12,481

.app8,848

.xyz7,666

.io7,089

.net4,678

.org4,191

04 / Latest entries

The dossier — raw, unfiltered, append-only.

Showing 16 of 150,126 live-feed records
Sorted by detection time

grep ›

Filters apply to loaded entries. Load more to expand results.

Live phishing threat feed.Every detected scam domain, logged as we see it.

NameSilo killed our Twitter because we told the truth about them.

Trustname.com: "bulletproof" registrar with €120 in declared revenue.

Found one we have not logged yet?

Live phishing threat feed.
Every detected scam domain, logged as we see it.