One domain, URL or IP → lookups on urlscan.io, VirusTotal, Safe Browsing and crt.sh.
New
DestroyList Check
Network: DestroyListNew
Use DestroyList Check
What it does
Ask the public Destroy API whether a domain or URL is on DestroyList, the PhishDestroy blocklist of phishing and scam domains, and see the severity, the list and when it was added.
The names you check are sent to the Destroy API (api.destroy.tools), which answers whether DestroyList has them; nothing else leaves the page.
Example
Two names, one of them a reviewed false positive
example.com
login.example.netNone of the 2 names is listed.
example[.]com: Reviewed and cleared: on the false-positive allowlist
Note: Reviewed and cleared as a false positive
login[.]example[.]net: Not listed by DestroyList
Note: Not being listed does not mean a site is safe.
Answer from api.destroy.tools at 2026-10-20T17:08:54Z.Sends both names to api.destroy.tools/v1/check/bulk. example.com comes back as reviewed and cleared (it is on the false-positive allowlist); a name that is not listed is shown as such, with the reminder that not listed does not mean safe.
FAQ
What is sent, and to whom?
Only the names you check, and only when you press Check: one name goes to api.destroy.tools/v1/check, several go in one request to /v1/check/bulk. The Destroy API is run by PhishDestroy and needs no key; nothing else from the page is sent.
What do the results mean?
Listed means the domain, or a parent domain, is on DestroyList, with its severity, risk score and whether it still resolved at the last check. Reviewed and cleared means it was reported but judged a false positive. Suspicious means not listed but the name has warning signs.
Does not listed mean a site is safe?
No. A blocklist only knows what has been found and confirmed; new phishing domains appear every hour. Check the link itself with the other tools here, and report it on the PhishDestroy report page if it looks like a scam.