About PhishDestroy: Mission, Team & Methodology

A note before anything else: we are not looking for gratitude, recognition, PR, or reach. Visibility matters to us for exactly two reasons — pressuring registrars who ignore ordinary abuse emails, and permanently documenting their real position when they choose inaction.

Our adversaries

Our opponents are scammers. We often call them incompetent and unoriginal — and we stand by that. But we never underestimate their resources. The infrastructure that profits from scams commands significant money and reach, and a cornered rat will do anything: stolen funds get spent on takedowns of evidence sites, attacks on researchers, disinformation, smear attempts, fabricated accusations, and outright lies.

Why zero money — not one dollar

PhishDestroy is, and always will be, strictly non-commercial: no profit, no advertising, no paid services, no donations tied to outcomes. This is not idealism — it is a survival requirement.

• Our style is aggressive and direct. Any financial dependency would be weaponized against us instantly.
• Nobody notices when we're right, but every false positive would be amplified against us. Commercial interests would turn every mistake into an existential threat.
• Independence is our only real armor. When a registrar like NameSilo threatens lawsuits, we don't weigh it against $60M in revenue — we just update our IPFS mirror and keep working.

Radical transparency

We aim to be maximally open in everything — our reports, our detection logic, our appeals process, appeal volumes and outcomes. We know all of it will eventually be used against us by registrars trying to justify their inaction. Fine. Let the record speak.

We make mistakes, and we are not afraid to admit them. We are not one person — we are a shared mission: the destruction of phishing and scam infrastructure, whether it's run by Russian, Nigerian, or Turkish crews. Nationality is irrelevant. Fraud is fraud.

The real value: evidence

We believe our core contribution is the evidence base. Something as simple as a site scan, a Web Archive snapshot, or a report submitted to an antivirus vendor carries real power:

• It can become evidence for law enforcement.
• It can become an IOC template for the security community.
• It can help unmask a criminal's identity.
• It can prove a registrar knew a site was malicious — and chose to violate its ICANN agreement anyway.

Victims deserve to see that the registrar was informed and ignored the threat.

“Scammers use you against competitors”

Do scammers report their rivals to us? Probably — we can't be certain. But think it through. When a scam site enters our pipeline we don't just block it: we fingerprint it, run domain-permutation analysis (dnstwist), and feed it into automated parsers covering SEO poisoning, Google Ads abuse, and other distribution channels. So yes — using us to destroy your competitor is an excellent choice. But when you deploy an identical site to take their place, you land in the same database. The logic holds either way.

Abuse of our system — and how we fixed it

There were real problems. “Takedown-for-hire” services abused our pipeline to attack gambling sites and stresser competitors. We rebuilt the system and banned those users:

• We don't claim expertise in legitimate gambling — but scam gambling gets blocked.
• Reports on gambling sites are only processed if backed by antivirus detections or partner blocklist entries.
• Users who repeatedly submit only such sites receive warnings, then a ban.

The logic has matured significantly. Neither an admin nor a trusted user can submit, say, Coinbase and have it processed. We've built a strong AI layer and a substantial library of threat fingerprints, and the system keeps learning — it sees the gaps that existed and works to close them. Scammers will always attempt bypasses. That's expected.

Measurable impact

Even measured purely in burned domain costs, the damage we've inflicted on scam operations is substantial. More importantly: the era of phishing domains living for years is effectively over across nearly the entire crypto space — all the key terms, all the major brand-abuse patterns.

Since July 2025 we've also made the project genuinely public: a real website rather than a joke landing page, an open repository, documented processes — everything built so that anyone, especially victims, can verify what happened and who ignored what.

Get involved

The project keeps growing, and we hope it's useful. If you have ideas for improving the project or its tools, open an Issue on GitHub or submit a ticket via our Telegram bot. Any question, any proposal. We are non-commercial — but we actively cooperate with everyone who shares our goal: making the internet safer.