Check up to 500 domains or URLs against the DestroyList phishing blocklist.
Network: DestroyListNew
Reputation Links
Runs locallyNew
Use Reputation Links
What it does
Look a suspicious domain, URL or IP up in five places at once: urlscan.io scans, VirusTotal verdicts, Google Safe Browsing, crt.sh certificate history and the PhishDestroy domain report.
It runs entirely in your browser: nothing you enter is uploaded.
Example
A subdomain under a country-code domain
login.example.co.ukLinks for the domain login[.]example[.]co[.]uk (registered domain example[.]co[.]uk). Opening a link sends the name to that service; nothing is sent from this page.
urlscan.io
Earlier scans of the site: screenshots, redirects, requests.
Open urlscan.io
↗
(new tab)
VirusTotal
Engine verdicts, DNS, WHOIS and related URLs for the domain.
Open VirusTotal
↗
(new tab)
Google Safe Browsing
Whether Chrome and other browsers warn about the site.
Open Google Safe Browsing
↗
(new tab)
crt.sh
TLS certificates issued for the name: when it was set up and which subdomains exist.
Open crt.sh
↗
(new tab)
PhishDestroy domain report
Our report, if the domain is in the PhishDestroy database.
Open PhishDestroy domain report
↗
(new tab)Builds the five links; crt.sh searches %.example.co.uk, the registered domain from the Public Suffix List, so every certificate for its subdomains shows up, and the PhishDestroy report link uses example.co.uk too.
FAQ
Does this page query those services?
No. It only builds links, and nothing is sent until you open one; then that service sees the name. This keeps a suspicious domain out of third-party logs until you decide to look it up.
What does each service tell me?
urlscan.io shows earlier scans with screenshots and redirects, VirusTotal shows antivirus and blocklist verdicts, Safe Browsing shows whether browsers warn, crt.sh lists TLS certificates (when the site was set up) and the PhishDestroy report shows our evidence.
Why does crt.sh search the parent domain?
Phishing kits often live on many subdomains of one registered domain. Searching %.registered-domain, worked out with the Public Suffix List, lists every certificate issued for them, not only the one name you entered.