Open intelligence / developer tools
Check a suspicious link. Investigate a domain. Build threat intelligence into your own tools.
Explore destroy.toolsDomain checks, bulk lookups, threat intelligence and feeds. Open documentation, ready-to-run examples, and an MCP endpoint for your tools.
curl --fail-with-body \
'https://api.destroy.tools/v1/check?domain=example.com'Look up a URL or domain against public threat intelligence.
Connect domain reputation, DNS and infrastructure evidence.
On this platform
Already using phishdestroy.io? These public endpoints remain available for platform statistics, reports and syndication.
/api/probe.php?domain=example.comReturns current DNS and HTTP availability evidence. This endpoint does not issue a phishing or safety verdict.
/api/stats.phpReturns defined counts for tracked domains, latest stored availability, confirmed takedowns, stored report records, and dataset scope.
/api/stats-cti.phpReturns defined aggregate counters, keeping confirmed takedowns separate from latest-check unavailability.
/feed.xmlAtom feed of recently updated domain-security reports. Individual entries retain their own evidence status.
/feed-threats.xmlReal-time RSS stream of newly detected phishing domains, updated as threats emerge.
/llms.txtMachine-readable plain-text summary of platform capabilities and data boundaries.
/llms-full.txtExtended machine-readable platform context, source boundaries, endpoint definitions, and reuse notes.
/domain/{domain}/llm.txtStructured threat intelligence dossier for a specific domain in plain text for AI agent use.
Data: CC-BY-4.0. Cite as: PhishDestroy CTI, https://phishdestroy.io, accessed YYYY-MM-DD
For high-volume or commercial use, contact us on Telegram — we welcome partnerships.