A fair review.
A clear outcome.

We always removed the domain — that was never in question. What we didn’t do was write to say sorry. Not out of arrogance: we simply didn’t think a letter from us had value for anyone. A removal is concrete; an apology is words. We were wrong about that. For someone who lost traffic or had to deal with their registrar, hearing plainly that the mistake was ours matters. It isn’t hard for us, and we’ve always tried to do it where we could.

The real obstacle was data. We are strictly against keeping non-public data: every stored address is a liability and a risk. PhishDestroy is not our job, and it is built so that it can stop being ours at any moment without breaking. It must not depend on us. Mailing lists, user records and retained logs all tie it to us personally.

Now we can do it without storing anything. If your appeal was approved — today or at any point in the past — enter your appeal ID and an address below. We send one apology, with a PDF letter you can forward to your registrar or customers, and the address is discarded. One false positive — one letter.

We hear this a lot. We won’t argue — but we honestly don’t see where this harshness is, or who it’s directed at. So here is exactly what we do, and you can check every part of it.

“Mass” describes how many phishing domains we handle, not how hard we hit any one of them. A domain gets one report, sent to its registrar. A follow-up goes out only if the domain is still live, and it may also be sent to ICANN or the TLD operator. Follow-ups are strictly rate-limited: never sooner than 48 hours after the previous report. By our own data, about 7% of domains in 2026 received anything beyond the first report — every one of them confirmed malicious. Our system is open: the number of reports sent for any domain is public.

We don’t shout “ban them” at registrars. We have no power to force anyone, and our report templates have been public for a long time. They ask the registrar’s abuse team to urgently investigate the domain, its owner and its content. We don’t claim the owner is malicious, or even that the content belongs to them. We say the site may have been compromised or hacked, and ask the registrar or host to check. We explicitly respect their internal procedures and leave the decision to their AUP and Terms of Service. The report also notes that the domain was added to our public list, with a timestamp, to inform the security community.

We don’t accuse anyone, and we don’t demand blocking. That would be improper, and it is beyond our authority. Our conclusions come from qualified scanning systems and indicators we collect ourselves, but no scanner, certified or not, can guarantee zero errors — cloaking alone makes sure of that. We have never claimed we don’t make mistakes. We say the opposite everywhere.

If we were attacking registrars, they would have blocklisted us long ago.

This myth has an author. About a year ago, scammers published a guide to getting around NiceNIC suspensions. Its template letter to the registrar claimed their scam casino was the target of “coordinated mass attacks ordered by competitors”.

No. This one was invented by AI, from the words “seed-phrase flooding”. To an AI, “flood” means a malicious attack. That isn’t what it is.

Seed flooding means submitting fake recovery phrases into a phishing kit’s collection form. This devalues the stolen data and reveals how the kit processes it, so its backend can be reported. Services like EmailJS have mostly responded by revoking the keys that identified the phishing sites. We have used the method in many infrastructure investigations, and the full method is described at /seed-flooding/.

Every run is logged — target, time and request count. Volumes can be large, sometimes up to a million submissions. But it was almost never fully automated. Years ago we tried to automate it against Google-ad phishing forms, and it didn’t work: phishers changed formats, added captchas and encrypted payloads, and finding the window automatically was not possible.

• One submission is a single POST of 12 words plus a response status. Opening a website from your own IP weighs far more.
• Almost every use in all these years was inside Cloudflare, from Cloudflare to Cloudflare. Given the packet size, the shared infrastructure and the load distribution, it cannot work as an attack. The two exceptions were handled with basic precautions: the hosting provider was warned about our testing.
• We are a non-profit project. We have no botnet, no proxies, nothing used to take a server down.
• A legitimate site has nothing to fear. If you have a form at all, a 12/24-word phrase does nothing to it. Kit handlers have specific variables; on a normal site these are harmless POST requests to nowhere.

We need the opposite of an outage: the phishing site must stay up while the registrar checks it. PhishDestroy has never DDoSed anyone. We don’t think this method is pleasant, but there is no malice in it, and we keep it within decent limits.

Tell us directly — through a GitHub issue or the Telegram bot. We answer.

We have no interest in listing anything legitimate or mistaken. We gain nothing from it, only damage to our reputation and stricter filters on our own system. But the system has contributors. The right to submit without checks is earned only after a substantial number of domains has passed standard review first. That status has value, and it has been abused, as with some “stress-test” services and a grey Indonesian casino operation.

We are strictly against anyone using PhishDestroy for personal gain instead of fighting phishing. Even if your own service isn’t entirely clean, if you believe someone is paying for takedowns, send us the domain or domains. We’ll check. If a member of our community sells takedowns, we block that member and every domain they listed commercially. Any question can be resolved. But if your site is actually illegal, we’re unlikely to remove it.

Yes. Every false positive feeds back into our rules. Mass cases or anomalies — several legitimate sites in the database at once — never go unnoticed: we find which signal failed, which source fed it, and what else that source touched.

Yes. Every false-positive domain is publicly removed from GitHub and added to allow/allowlist.json as a separate commit. A correction nobody can verify is worth nothing.