Platform Health

132,672
Threats Tracked
Full historical set since 2019
70,618
Active Right Now
Live, online, still dangerous
58,621
Neutralised
Taken down or DNS-dead
594
New in Last 24h
Featured Exposé · Registrar Retaliation

NameSilo killed our Twitter — for telling the truth about a $20M+ scam they hosted

We published documented receipts of NameSilo sheltering the xmrwallet.com Monero-drainer operation for 10+ years. NameSilo's response: report and silence our @Phish_Destroy X account — while publicly defending the scam operator. Lying. Covering. Retaliating instead of mitigating — a textbook ICANN RAA §3.18 violation.

Forensic Pipeline

How a phishing domain dies

From single-pixel suspicion to court-ready public record. Seven stages, twenty-eight global partners, fourteen hours median time-to-takedown — all wired into one operations map.

7Pipeline stages
28+Vendor partners
14hMedian TTM
See the full pipeline
⌘K Look up any domain in our 146,954+ threat database
Detectedloading live feed…

Platform Directory

Everything else we built

Supporting tools, research dashboards, guides and experimental projects — grouped by purpose.

scan@phishdestroy:~$
scan@phishdestroy:~$ check --domain <target>
▸ instant verdict against 147K+ tracked domains
▸ backed by /v1/check API • 0 API key required

They call us Enemy #1

Relentless Attacks. Zero Effect.

Scammers continuously target our project and infrastructure to escape bans. One recent example is the enforced removal of our X/Twitter account used for posting reports. Attacks are constant and varied.

Outcome stays the same: we scan, flag, and kill domains before victims lose funds. Our takedowns cost $0. Their attempts burn money and time for no gain.

Since 2019
124,904 +

Domains reported

Since Jul 1, 2025
47,277 +

Active phishing domains preempted

Public Backup
123,243 +

Reports mirrored from X/Twitter

Zero-fee policy
$0

Paid to registrars or platforms for takedowns — ever

Warning: Crypto Scams Ahead

Knowledge is your best defense. Learn the most common deception tactics to avoid becoming the next victim.

Fake Returns / HYIP

RED

High-yield investment scams promise unrealistic ROI (1–5% daily) and pay early depositors with new investor money. When inflow stops, the platform vanishes overnight.

Red flags
Guaranteed daily ROIReferral pyramid (5-tier)Withdrawal lock / feesWhitepaper plagiarizedAnonymous founders
$4.6BPlusToken Ponzi
715KVictims (CN/KR)
2019Collapsed

Documented case

PlusToken — Asian-region Ponzi disguised as a wallet/exchange app. Operators promised 6-18% monthly returns, accumulated ≈200K BTC + 800K ETH, then vanished. 109 arrests in 2020; ~$2.9B in BTC seized & burned.

See real drainer cases

Impersonation

VIOLET

Operators mimic exchange support, project founders, KOLs or wallet vendors. Contact via cold DM, replies under viral tweets, or fake verified handles to push fake giveaways, support tickets or recovery flows.

Red flags
DM-first contactVerified-handle clone (zero-width chars)Bot-amplified reply chainsFake support formENS look-alike (vita1ik.eth)
$85MPink Drainer haul
21,000+Drained wallets
May 2024Operator retired

Documented case

Pink Drainer — phishing-as-a-service kit weaponized by impersonation crews. Posed as Coinbase / OpenSea / Discord moderators, lured users to signature pages disguised as 'security verifications'. Hit Evan Luthra, OpenAI's Mira Murati and 21K+ retail wallets before public retirement.

How scam teams operate

Sextortion

AMBER

Mass-spammed extortion emails citing a leaked password (from old breaches like Collection #1, LinkedIn 2012, Adobe 2013) and claiming compromising webcam footage exists. Demand $500–$2,000 in BTC within 24–72h.

Red flags
Spoofed sender = your own emailOld breached password in bodyBTC address with deadlineNo actual proof / videoGeneric 'I hacked you' template
7M+Emails / year (FBI IC3)
$19MReported losses 2023
~3%Pay rate

Documented case

Aaron Smith-Hicks / 'Webcam Hacker' wave (2018-2024) — same template recycled across 30+ language variants. Operators recycle BTC addresses; chain analysis shows ≈99% of recipients never had actual footage. Ignoring + deleting the mail is the documented mitigation.

Protect yourself now

Rug Pull

VIOLET

DeFi devs deploy a token, seed liquidity, hype it via paid KOLs and shillers, then drain the LP pool (or trigger a mint / blacklist / transfer-fee backdoor in the contract) and disappear. Token price → 0 in minutes.

Red flags
Anonymous / KYC-less teamLP locked <12 months or unlockedMint / blacklist / setTax in contractUnverified contract on EtherscanHoneypot — you can buy, can't sell
$2.8BStolen 2023 (Chainalysis)
~70%New tokens = rug
$3.38MSquid Game token

Documented case

Squid Game token / SQUID (Nov 2021) — capitalized on Netflix hype, used a honeypot contract that blocked all sells. After mooning +75,000%, devs swapped all liquidity for BNB and vanished. Wallet trail led to OKX deposit. 40K+ holders bagged a zero.

Exposed: wallet drainer panels

Blackmail / Extortion

RED

Operators threaten DDoS, doxx, fake CSAM planting, or 'leaked source code' to extort crypto from businesses and individuals. Most threats are bluffs leveraging fear of disruption.

Red flags
24h ransom deadlineXMR / privacy-coin demandNo proof of capability shownThreatens 'leak to clients/press'Recycled boilerplate text
$1.1BRansomware 2023 (Chainalysis)
25%Victims who pay
~5 BTCTypical demand

Documented case

DD4BC / Armada Collective copycats (2020-2024) — empty DDoS extortion against fintech, exchanges, casinos. Demand 5-50 BTC under threat of '500 Gbps attack'. Real DD4BC operators were arrested in 2016; every group using the name since is a copycat with no infrastructure.

What to do if threatened

Ransomware

RED

Operators breach via RDP, phishing or unpatched VPN, deploy encryption payload across the network, exfiltrate sensitive data, then demand BTC/XMR via TOR negotiation portal. Double-extortion = pay-or-leak.

Red flags
RDP brute-force on 3389Cobalt Strike beaconEncrypted .lockbit / .conti / .akira extTOR .onion negotiation portalSample leak on data-leak site
$1.1BPaid in 2023
$1.5MAvg payout
1,800+LockBit victims

Documented case

LockBit (2019-2024) — RaaS with 20% affiliate fee, hit Boeing, ICBC, UK Royal Mail, ≈1,800 confirmed victims, $120M+ ransom collected before Op Cronos seized the infrastructure (Feb 2024). Same actors rebranded as ALPHV / RansomHub.

Build your digital fortress

Phishing / Wallet Drainers

GREEN

Most common vector. Fake versions of wallets, DEXes, mint pages, claim portals. Victim connects wallet, signs a permit2 / setApprovalForAll / increaseAllowance transaction — drainer sweeps balance and ERC-20s instantly.

Red flags
Punycode domain (а→a Cyrillic)'WalletConnect' popup outside dApppermit / setApprovalForAll signatureDiscord / X DM 'support agent'Free mint / airdrop urgency
$87M+Inferno Drainer haul
137,000Drained wallets
Nov 2023Operator shutdown

Documented case

Inferno Drainer (2022-2023) — drainer-as-a-service used by 100+ phishing crews. Provided wallet-draining smart contracts + UI kit; took 20% cut. Spawned 1,000+ phishing sites/day. Public shutdown in November 2023 — but spinoffs (Angel, MS, Venom, Pussy, Rainbow Drainers) instantly took its place.

Inside a drainer panel

Don't Be Silent! Your Silence is Their Power.

If you've been a victim of a scam, reporting it is crucial. Filing a report on platforms like Chainabuse is a minimum first step. Ideally, you should report the incident to your local law enforcement. For expert guidance on legal matters or theft, we highly recommend contacting Seal911, a group of professionals who can provide sound advice for your situation.

Be extremely cautious of "recovery services" that contact you after a theft. Most are recovery scams trying to victimize you a second time.

Threat Surface

Where scammers hunt you

Every scam category above has a delivery channel. These are the 8 platforms where 95% of crypto-fraud attempts hit retail today.

Google Ads — brand searches

HIGH

Search 'metamask download' → top sponsored result is a lookalike domain. Google routinely approves these.

"Sponsored: Official MetaMask | metarnask[.]io" — appears ABOVE the real metamask.io. Click → seed-phrase entry page.
Red flags
  • Sponsored label = paid ad
  • Lookalike domain (а→a, rn→m)
  • Asks for seed phrase to 'restore'
Scam Sniffer: $58M lost via Google Ads phishing in H1 2024

Medium / Substack comments

MED

Under crypto-recovery articles, fake 'I recovered my funds via X' comments seed Telegram contact for recovery scams.

"I lost 12 ETH to a drainer, then @CryptoRecover_Mark on Telegram got 80% back in 3 weeks. He works with chain analysts."
Red flags
  • Always Telegram-only contact
  • Generic 'chain analyst' claim
  • 0-day-old comment account, no posts
PhishDestroy logs 300+ recovery-scam aliases across Medium comment streams

X (Twitter) reply guys

HIGH

Under big-account tweets (Vitalik, MetaMask, OpenSea), bots reply within seconds with clone avatars and fake giveaway links.

Within 4-12s of a @MetaMask tweet: "Limited 5,000 ETH community airdrop. Verify wallet: eth-airdrop[.]xyz" from @MetaMask_Official_ (underscore).
Red flags
  • Reply <30s after parent tweet
  • Cloned avatar + bio
  • Underscore / digit suffix in handle
~12% of replies under viral crypto news = bot impersonators

Discord 'support' DMs

HIGH

After you post in a project's Discord, scrapers DM you posing as moderator — link to 'ticket form' that asks for wallet signature.

"Hi from OpenSea Support 👋 Saw your wallet question. Open a ticket: opensea-tickets[.]com — we need to re-validate your wallet."
Red flags
  • Legit support NEVER DMs first
  • 'Re-validate wallet' = drain tx
  • Profile created days ago
Most-abused: NFT projects with public support channels

Telegram fake-support bots

HIGH

Bots in major project group-chats post 'support' contact as replies. Real support never operates via private DM.

In @MetaMaskOfficial chat: "For wallet recovery contact @MetaMask_HelpDesk_Bot — automated 24/7."
Red flags
  • 'HelpDesk' / 'Support' bot variants
  • Asks for seed phrase to 'restore'
  • Auto-deleted after 60s to evade logs
100+ fake support bots tracked across Telegram in 2024

YouTube tutorial comments

MED

Under 'how to use MetaMask' / 'best DeFi' videos: 'I made $X using…' + Telegram link to fake trading group or drainer mint.

"@CryptoMike234: Thanks to @ProSignals_Telegram I made $34K last month copy-trading. Min deposit 0.01 BTC."
Red flags
  • Pinned-comment hijack on stolen channels
  • Earnings 'screenshots' from Photoshop
  • Telegram-only contact
Especially aggressive on Spanish/Portuguese crypto channels

Reddit DMs after posting

MED

Post a question in /r/CryptoCurrency or /r/MetaMask → within hours, 'support' DMs arrive with lookalike form links.

"u/MetaMaskSupport_official: Hi, saw your post. Use the contact form: metamask-help[.]org — we respond in 2-4h."
Red flags
  • No legit project staffs Reddit DM
  • Underscore / number in username
  • 'Official' word in non-mod handle
Reddit DM phishing peaked Q4 2023 — 8K+ reports in /r/MetaMask alone

LinkedIn fake recruiters

GROWING

DPRK Lazarus + crews send 'recruiter' messages → Calendly → 'coding task' repo contains malware draining wallets and exfiltrating keys.

LinkedIn: "Senior engineer @ Robinhood, $280K + 0.5% equity. Quick screen — run this take-home repo to demo skills: github[.]com/eval-trade-engine"
Red flags
  • Recruiter email = gmail
  • Obfuscated build script in repo
  • Always crypto / fintech roles
Lazarus-linked ContagiousInterview campaign — $300M+ stolen 2023-2024

Common pattern: in every channel above, a real entity NEVER asks you to share a seed phrase, sign a transaction, or download an executable to "verify" anything. If that's the ask — it's a scam.

Read the full defense playbook

Trusted By Industry Leaders

Ecosystem Partners

Our threat intelligence is integrated into wallets, exchanges, and security tools protecting millions worldwide.

350K+
Domains Analyzed
54+
Security Vendors
17M+
Flagged Wallets

For Developers

Destroy API

Free, open, no API key. Real-time domain risk scoring across 891K+ threats.

Endpoints
5
Bulk Limit
500 /req
Auth
Open
Sync
Hourly
api.destroy.tools
$ curl "https://api.destroy.tools/v1/check?domain=suspicious-site.xyz"
{
"threat": true,
"risk_score": 85,
"severity": "critical",
"sources": ["destroylist", "community"],
"dns_active": true
}
Threat Scoring (0—100)
Critical 70—100 High 40—69 Medium 20—39 Low 1—19
Available Endpoints
API Endpoints
Method Endpoint Description
GET /v1/check?domain= Single check
POST /v1/check/bulk Bulk (500/req)
GET /v1/search?q= Keyword search
GET /v1/feed/{list} Full feeds
GET /v1/stats Live stats

Live Intelligence

Latest Detections

Real-time phishing threats detected and neutralized by our automated systems

Protect Yourself

Essential Security Resources

Emergency: I Was Scammed

Immediate steps if your crypto wallet was drained. Revoke approvals, secure remaining assets, and report the crime.

Get Help Now

Ultimate Security Checklist

Step-by-step guide to hardening your crypto security. Hardware wallets, 2FA settings, and browsing hygiene.

Open Checklist

Privacy Arsenal & Tools

Recommended privacy tools, secure browsers, VPNs, and operating systems to stay anonymous online.

Explore Tools
Security illustration showing threat neutralization

What we do

A Free Solution to Take Down Scammers

We provide a comprehensive, multi-layered approach to neutralizing online threats, from initial detection to full infrastructure takedown.

Cooperation with Authorities

We assist in identifying scam teams and filing actionable reports with law enforcement.

Threat Chain Tracing

We reconstruct threat chains across multiple domains, assets, and wallets.

Code Analysis & Auto-Detection

We build detection templates and automate code analysis to instantly block scams.

Support & Legal

Disclaimer and Frequently Asked Questions

Non-commercial, volunteer project. We are an open community focused on identifying, documenting, and disrupting phishing and scam infrastructure for public benefit.

  • Open by design. Where safe and lawful, indicators and scans are publicly accessible.
  • No user databases. We do not store personal data. For appeals and takedown status we use a ticket ID only.
  • No direct takedowns. We submit evidence to registrars, hosting providers, and trusted vendors; enforcement is their decision.
  • Safe for legitimate sites. Our passive scans and reports do not harm lawful resources.
  • No warranties. Content is provided "as is", without guarantees of completeness or fitness.
  • Lawful cooperation. For qualifying cases, artifacts may be shared with competent authorities.

  • Scanning. We perform safe, passive checks to collect artifacts and indicators.
  • Escalation. We request professional services to verify resources and ask registrars/hosts to review clients via abuse teams.
  • Investigations. We occasionally conduct hobby-level OSINT; results are published, shared with peers, or forwarded to authorities. We do not hoard private data. See our Gambler Panel investigation for an example. Browse all research on our News & Investigations page.
  • Collaboration. We are open to partnerships. Certain private tools and materials can be shared for defensive purposes on request.
  • Dashboards. Explore stolen funds across all chains via the DeFi Hack Explorer or investigate scam infrastructure with our Scam Intelligence Dashboard.

No whitelist or ignore list. We do not maintain any whitelist/ignore program. Duplicate suppression only prevents re-adding the same domain.

Appeal removes the domain. If an appeal is approved, the domain is removed from our database and from any places where we published it.

Ticket-only tracking. We do not store personal data. For status checks and takedown requests we use a ticket ID only.

  • Open access. The bot is open to everyone, which does not change its purpose: faster disruption of fraud.
  • No paid leniency. We have never asked for or accepted payment for unbans or favors. The process and database are open and verifiable.
  • Trusted reporters. Reputable users may report without pre-moderation and submit bulk complaints for speed.

Act fast and preserve evidence: URLs, TXIDs, wallet addresses, screenshots, timestamps, chat logs. File an official report. For prevention, read our Crypto Security Essentials guide.

  • United States: https://www.ic3.gov/
  • United Kingdom: https://www.actionfraud.police.uk/
  • Other countries: contact your national cybercrime unit or local police

Personal Recommendation

For any incident, I strongly recommend contacting the SEAL 911 Bot. This is a rapid response group of professionals who really know their stuff and can help in any situation.