Flagship
Everything else orbits these. Real-time data, open APIs, deep analysis, on-chain intelligence — free and unlimited.
Stream of phishing detections as they happen — domain, brand, registrar, cloaking flags. Refreshed continuously.
Watch the feed →Per-domain dossiers: WHOIS, DNS, TLS, VirusTotal, cloaking, kit fingerprint, abuse-report history. Searchable.
Browse reports →Check a domain, pull a feed, bulk-scan 500/req. 834K+ threat records, CC-BY licensed, zero cost.
Read API docs →Paste any URL — get VirusTotal consensus, drainer-kit fingerprint, cloaking test, SSL chain, screenshot.
Analyze now →Drainer addresses, rug-pull wallets, linked infrastructure across EVM + Solana. Flagged, searchable, exportable.
Search wallets →Community-curated threat feed on GitHub. Auto-updated domain blocklist for firewalls, DNS filters, browser extensions.
View on GitHub →Platform Directory
Supporting tools, research dashboards, guides and experimental projects — grouped by purpose.
They call us Enemy #1
Scammers continuously target our project and infrastructure to escape bans. One recent example is the enforced removal of our X/Twitter account used for posting reports. Attacks are constant and varied.
Outcome stays the same: we scan, flag, and kill domains before victims lose funds. Our takedowns cost $0. Their attempts burn money and time for no gain.
Domains reported
Active phishing domains preempted
Reports mirrored from X/Twitter
Paid to registrars or platforms for takedowns — ever
Knowledge is your best defense. Learn the most common deception tactics to avoid becoming the next victim.
If you've been a victim of a scam, reporting it is crucial. Filing a report on platforms like Chainabuse is a minimum first step. Ideally, you should report the incident to your local law enforcement. For expert guidance on legal matters or theft, we highly recommend contacting Seal911, a group of professionals who can provide sound advice for your situation.
Be extremely cautious of "recovery services" that contact you after a theft. Most are recovery scams trying to victimize you a second time.
Every scam category above has a delivery channel. These are the 8 platforms where 95% of crypto-fraud attempts hit retail today.
Search 'metamask download' → top sponsored result is a lookalike domain. Google routinely approves these.
"Sponsored: Official MetaMask | metarnask[.]io" — appears ABOVE the real metamask.io. Click → seed-phrase entry page.
Under crypto-recovery articles, fake 'I recovered my funds via X' comments seed Telegram contact for recovery scams.
"I lost 12 ETH to a drainer, then @CryptoRecover_Mark on Telegram got 80% back in 3 weeks. He works with chain analysts."
Under big-account tweets (Vitalik, MetaMask, OpenSea), bots reply within seconds with clone avatars and fake giveaway links.
Within 4-12s of a @MetaMask tweet: "Limited 5,000 ETH community airdrop. Verify wallet: eth-airdrop[.]xyz" from @MetaMask_Official_ (underscore).
After you post in a project's Discord, scrapers DM you posing as moderator — link to 'ticket form' that asks for wallet signature.
"Hi from OpenSea Support 👋 Saw your wallet question. Open a ticket: opensea-tickets[.]com — we need to re-validate your wallet."
Bots in major project group-chats post 'support' contact as replies. Real support never operates via private DM.
In @MetaMaskOfficial chat: "For wallet recovery contact @MetaMask_HelpDesk_Bot — automated 24/7."
Under 'how to use MetaMask' / 'best DeFi' videos: 'I made $X using…' + Telegram link to fake trading group or drainer mint.
"@CryptoMike234: Thanks to @ProSignals_Telegram I made $34K last month copy-trading. Min deposit 0.01 BTC."
Post a question in /r/CryptoCurrency or /r/MetaMask → within hours, 'support' DMs arrive with lookalike form links.
"u/MetaMaskSupport_official: Hi, saw your post. Use the contact form: metamask-help[.]org — we respond in 2-4h."
DPRK Lazarus + crews send 'recruiter' messages → Calendly → 'coding task' repo contains malware draining wallets and exfiltrating keys.
LinkedIn: "Senior engineer @ Robinhood, $280K + 0.5% equity. Quick screen — run this take-home repo to demo skills: github[.]com/eval-trade-engine"
Common pattern: in every channel above, a real entity NEVER asks you to share a seed phrase, sign a transaction, or download an executable to "verify" anything. If that's the ask — it's a scam.
Read the full defense playbookTrusted By Industry Leaders
Our threat intelligence is integrated into wallets, exchanges, and security tools protecting millions worldwide.
For Developers
Free, open, no API key. Real-time domain risk scoring across 891K+ threats.
| Method | Endpoint | Description |
|---|---|---|
| GET | /v1/check?domain= | Single check |
| POST | /v1/check/bulk | Bulk (500/req) |
| GET | /v1/search?q= | Keyword search |
| GET | /v1/feed/{list} | Full feeds |
| GET | /v1/stats | Live stats |
Live Intelligence
Real-time phishing threats detected and neutralized by our automated systems
Protect Yourself
Immediate steps if your crypto wallet was drained. Revoke approvals, secure remaining assets, and report the crime.
Get Help NowStep-by-step guide to hardening your crypto security. Hardware wallets, 2FA settings, and browsing hygiene.
Open ChecklistRecommended privacy tools, secure browsers, VPNs, and operating systems to stay anonymous online.
Explore Tools
What we do
We provide a comprehensive, multi-layered approach to neutralizing online threats, from initial detection to full infrastructure takedown.
We assist in identifying scam teams and filing actionable reports with law enforcement.
We reconstruct threat chains across multiple domains, assets, and wallets.
We build detection templates and automate code analysis to instantly block scams.
Hall of Shame
Hacker's Cry
Yo, it's Morgan, your PinkDrainer king with the Pinkboy! password! Chillin' at some address - until the UK cops crashed my party! They've got me locked up, but ha, I'm still hugging my glittery crypto stash tight - good luck prying it from my pink fingers! 2 stars for the arrest, you pesky hunters!
Hacker's Rant
Oh, behold Inferno Drainer, ghost who vanished then strutted back! 'big hits' were just backdoor thefts - turns out, Angel Drainer sold me off ages ago and played puppet master, tricking his crew with my name! Now I'm toast, and my crypto's gone - well done, you sly hunters, 4 skulls for the expose!
Hacker's Meltdown
Well, hello there, it's Phishlab - aka Pakulichev, the coding genius! Sold my MS Drainer code for $1,500 to 200 clowns who leaked, resold, and wrecked havoc! Now my masterpiece's racked up $60 million+ in damage, and I'm sitting here with peanuts in my pocket - brilliant move, eh? Time to cry into my empty wallet while you lot laugh!
Hacker's Whine
Hey, it's your crew CrazY Evil, still ruling the scam scene! Angel Drainer's our real-life bro since way back - we even collabed, dropping Russian rap about scams, loving to smear the beats! But he bailed - hated how we snatch all the profit and leave workers no control, unlike his tidy Drainer setup. He's chilling in Some Hot country, sipping tea, while we keep the chaos rolling - catch us if you can!
Hacker's Panic
Ha! It's AceDrainer, the pop-up wizards still on the loose! We hacked those animation libraries, flooding crypto apps with sneaky pop-ups - draining wallets like champs! Sure, our domains are getting auto-banned left and right, but we're dodging you lot for now. Keep trying, you clever detectors - 2 bans for your effort!
Hacker's Beg
Ha! It's C*** D** Loy, aka SmolGoblin, the UA scam king! Ripped off 1,000+ suckers worldwide, pocketing over $10 million - heck, one some country fool lost $2.7 million ($20M at today's rate)! Phishing, laundering via some exchange, spreading "Stealername" malware, and cruising in my Maybach S580, Tesla Model X, BMW M4 Competition, and Porsche 911! Czech cops are sniffing around. Nah, I'll race 'em instead! Catch me if you can, you legal nerds!
Hacker's Surrender
Yo, it's the late CryptoLove crew, once the love bandits of crypto! Thought our phishing game was unstoppable - until RussianPanda swooped in like a ninja bear! He torched our domains, drained our wallets, and left us crying in the dust. Game over, you sly panda bastard - 5 skulls for the knockout, we're donezo!
Scammer's Delusion
Hey hey, it's your boy from Gambler Panel! I totally don't steal from my own workers - pinky promise! I'm basically a charity, right? Just scamming the entire CIS and half the world, no biggie. Love my "найсник" and party supplies more than my own projects! And those designs with rainbows and pride flags? Dead serious, not trolling at all! Big thanks to PhishDestroy for banning all my worker domains - really helps with my reputation! As a truly gifted leader, I'm proud that my panels rack up 15+ VirusTotal detections. That's called quality!
Product's Confession
Huge thanks to PhishDestroy for the thorough audit and that lovely GitHub script that detects Keitaro on any site! Our beloved TDS product is mostly used for phishing, scam, malware distribution, and cloaking - but hey, we call it "traffic management"! Zero login page protection out of the box? That's a feature, not a bug! We're the #1 cause of domain bans worldwide and we love it. Money and lockers are our true passion - definitely a legal company that absolutely doesn't collect black market traffic data!
Disclaimer: All characters in this section are fictional and presented in a humorous, parody style for entertainment purposes only. They are not connected to any real individuals. Inspired by public nicknames and open cases, with no personal data or direct accusations included.
Support & Legal
Non-commercial, volunteer project. We are an open community focused on identifying, documenting, and disrupting phishing and scam infrastructure for public benefit.
No whitelist or ignore list. We do not maintain any whitelist/ignore program. Duplicate suppression only prevents re-adding the same domain.
Appeal removes the domain. If an appeal is approved, the domain is removed from our database and from any places where we published it.
Ticket-only tracking. We do not store personal data. For status checks and takedown requests we use a ticket ID only.
Act fast and preserve evidence: URLs, TXIDs, wallet addresses, screenshots, timestamps, chat logs. File an official report. For prevention, read our Crypto Security Essentials guide.
For any incident, I strongly recommend contacting the SEAL 911 Bot. This is a rapid response group of professionals who really know their stuff and can help in any situation.
