# PhishDestroy — enemy-one ================================================================ Title: Scammer Retaliation: DDoS and Fake DMCA | PhishDestroy Canonical: https://phishdestroy.io/enemy-one/ Published: 2025-05-20T00:00:00 Updated: 2026-04-02T00:00:00 Author: PhishDestroy Research Schema: Organization, ImageObject, ContactPoint, WebSite, SearchAction, EntryPoint, NewsArticle, TechArticle, WebPage, DefinedTerm, CreativeWork, BreadcrumbList, ListItem, Person, SpeakableSpecification OG image: https://phishdestroy.io/assets/images/covers-v4/enemy-one.webp ## SUMMARY ---------------------------------------------------------------- Since 2019, PhishDestroy removes phishing domains at $0 cost. DDoS, fake DMCA, mass reports — scammers tried everything. None worked. ## KEY FACTS ---------------------------------------------------------------- In short: Since 2019, scammers have answered PhishDestroy's zero-cost takedowns with email floods, a UK shell company with forged documents, DDoS attacks, a forged OnlyFans DMCA notice, mass-reporting of social accounts and 9,000+ fake appeals. The page says none of it worked: after a 283M-request DDoS in March 2026 forced a hosting move, takedowns continued with zero downtime. - Cost per takedown: $0 (email-based automation) (source: https://phishdestroy.io/enemy-one/; as of 2026-10) - March 2026 DDoS: 283.45 million requests and 1.21 TB in 7 days; Namecheap hosting terminated, moved to Cloudflare + Hetzner (source: Cloudflare analytics, as shown on https://phishdestroy.io/enemy-one/; as of 2026-03) - Fake DMCA notice: Forged OnlyFans copyright claim (Lumen Database ID 81731777); OnlyFans said it did not file it (source: https://phishdestroy.io/enemy-one/; as of 2026-03) - Fake domain appeals: 9,000+ via hCaptcha solving (source: https://phishdestroy.io/enemy-one/; as of 2026) - Threat database: 839K+ domains (source: https://phishdestroy.io/enemy-one/; as of 2026-10) ## STRUCTURE ---------------------------------------------------------------- - $0 Takedowns, Priceless Tantrums - In short - Key findings - PhishDestroy now lives on GitLab. - How We Operate - What Scammers Tried (and Why It Failed) - Attack Timeline - Evidence Archive - March 2026: The DDoS That Killed Our Hosting - Fake DMCA Attack - Social Media Takedowns - Evidence Preservation Protocol - The $0 Model in Practice - The Scoreboard - Want to Help? - Related Investigations - Explore this topic ## CONTENT ---------------------------------------------------------------- TL;DR: PhishDestroy is an open anti-phishing platform that detects crypto drainer domains, tracks scam infrastructure, and automates takedown requests to registrars. It provides free APIs, real-time threat feeds, and public evidence reports for each flagged domain. Back to News Ongoing Intelligence Report $0 Takedowns, Priceless Tantrums Published 2025-05-20 · Updated 2026-10-18 Since 2019, we've removed thousands of phishing domains at zero cost. Scammers retaliated with DDoS attacks, fake companies, mass reports, and forged legal documents. None of it worked, and the evidence is below. Published May 20, 2025 Updated October 2026 9 min read PhishDestroy Research In short Since 2019, scammers have answered PhishDestroy's zero-cost takedowns with email floods, a UK shell company with forged documents, DDoS attacks, a forged OnlyFans DMCA notice, mass-reporting of social accounts and 9,000+ fake appeals. The page says none of it worked: after a 283M-request DDoS in March 2026 forced a hosting move, takedowns continued with zero downtime. Key findings PhishDestroy’s cost per takedown$0 DDoS requests in 7 days, March 2026 (1.21 TB)283M fake domain appeals sent via hCaptcha solving9,000+ bombing emails received, auto-deleted1400,000+ 1 An estimate; filters delete the messages automatically. Listen to this article 0:00 / --:-- Download the official report (PDF) On this page01 / 10 $0Cost per takedown 10+Attack types 5+ yrsActive since 0Downtime days 100%Failure rate Note · October 7, 2026 PhishDestroy now lives on GitLab. On October 7 our GitHub account was blocked. So far we have no understanding of why, and we have received no email. We are looking into it. For now we have deployed at github.com/phishdestroy [https://github.com/phishdestroy] (GitLab [https://gitlab.com/phishdestroy]) everything that was there. We don't think it is connected to any investigation concerning elite lawyers or anyone else. We think the cause was the mass update of IOC lists covering the two weeks during which our four registrar repositories and ShortDot were not working. But any ban has a reason. Possibly an automatic trigger fired. Overall, we don't blame or accuse anyone until the real reason is known. It is also possible that the very fact that we maintained a phishing database violates GitHub's rules, but that is not certain. We are not going to make a tragedy out of this or shout that someone got it banned. That is not the case. Last public GitHub snapshots · Wayback Machine ProfileOct 3, 2026 [https://web.archive.org/web/20261003121912/https://github.com/phishdestroy]destroylistMay 30, 2026 [https://web.archive.org/web/20260530041127/https://github.com/phishdestroy/destroylist]ScamIntelLogsMay 8, 2026 [https://web.archive.org/web/20260508085258/https://github.com/phishdestroy/ScamIntelLogs]DestroyScammersJul 20, 2026 [https://web.archive.org/web/20260720141907/https://github.com/phishdestroy/DestroyScammers]namesilo-evidenceAug 16, 2026 [https://web.archive.org/web/20260816165308/https://github.com/phishdestroy/namesilo-evidence]trustname-evidenceAug 16, 2026 [https://web.archive.org/web/20260816163214/https://github.com/phishdestroy/trustname-evidence]DO-NOT-USE-xmrwallet-comJun 5, 2026 [https://web.archive.org/web/20260605170905/https://github.com/phishdestroy/DO-NOT-USE-xmrwallet-com] Old links keep working if you replace github.com with gitlab.com. Open github.com/phishdestroy [https://github.com/phishdestroy] GitLab [https://gitlab.com/phishdestroy] How We Operate Our model is boring on purpose. We scan for phishing infrastructure, archive evidence, file structured abuse reports, and remove domains. There are no PR wars or ego plays, just automation and email. Detect Automated crawling + community submissions via Telegram bot. 839K+ domains in our threat database. Archive Snapshot sites on Web Archive + local forensic copies before takedown. Preserving evidence comes first. Report One structured SMTP email per domain with everything a registrar/host needs. Automated pipeline. $0 cost. Key principle No doxx by default. We focus on infrastructure, not individuals. When threat actors cross legal lines (threats, fraud, identity theft), we escalate to law enforcement with full evidence packages. Otherwise, we just turn off their domains. What Scammers Tried (and Why It Failed) Over the years, threat actors have thrown everything they could think of at us. Below is every tactic they tried, and why each one was a waste of their money. Attack | Method | Their Cost | Our Impact | Status Email floods | 2,000-5,000 msgs/day for months | $50-300/mo | Zero | Failed UK shell company | Paper company + forged "ownership" docs | $500-2,000 | Zero | Failed Social takedowns | Mass-reporting X, Telegram, Medium | $100-500 | Accounts suspended, archives live | Nuisance DDoS attacks | Rented botnets against our lander | $200-2,000 | Zero | Failed Bot farms | Fake followers/likes/reports | $50-300 | Zero | Failed False abuse reports | Fake complaints to our hosting provider | Time | Zero | Failed Content swapping | Inject illegal content to trigger auto-bans | Time | Zero | Failed Impersonation | Fake "Russian hacker" forums selling our work | Time | Zero | Failed DDoS → host kill | 283M requests / 1.21 TB (Namecheap dropped us) | $2,000+ | Migrated to Cloudflare + Hetzner | Nuisance Fake DMCA | Forged OnlyFans copyright claim to Google | Time | Zero (OnlyFans denied filing) | Failed Trust user infiltration | Trusted user injected 46 false-positive domains | Time | Caught fast, hardened all roles | Failed Appeals form spam | 9,000+ fake domain appeals via hCaptcha solving | $100-500 | Zero (trivially filtered) | Failed Email bombing (ongoing) | 400,000+ messages, non-stop, auto-deleted | $500+/mo | Zero | Failed X/Twitter ban (again) | Gov-style emergency request → account suspended | $3,000+ | Not restoring. Done with X. | Nuisance Reddit ban | Account banned. 1 post from 5 years ago. | Time | Zero | Failed The economics are simple They spend $3,000+ per "government-style" social takedown. We spend $0 per domain removal. Our takedown pipeline is email-based automation, and the website is optional. DDoS attacks against a lander are like bombing a billboard: the mail trucks keep moving. Attack Timeline 2019: Origin "You don't even have a website!" Scammers mocked us in a registrar complaint, so we built one in 15 minutes. The joke stuck, and the takedowns scaled. 2020-2022: Email Floods 2,000-5,000 messages per day Bulk inbox bombing sustained over months. We don't rely on inbound email for operations, so it had no impact whatsoever. 2023: UK Shell Company Paper company + forged ownership docs Created a UK-registered company and forged "domain ownership" documents to claim our domain. The domain is registered to a private individual, so corporate claims fail by design. 2024: DDoS Campaign Botnet rental against our lander Rented botnets to "drop" us. We were behind Cloudflare, so email flows continued and takedowns were unaffected. An expensive lesson for them. Sept 2025: Telegram Takedown Mass-reported our Telegram channel Successfully mass-reported our channel where domains were published for automated banning. We launched a new channel immediately. 2025-2026: Ongoing Operations scaled, infrastructure hardened Automated detection and reporting pipeline expanded. New countermeasures deployed against active phishing infrastructure. Details classified. March 6, 2026: DDoS Nuclear Option 283M requests and 1.21 TB later, Namecheap dropped us Massive DDoS attack: 283 million requests and 1.21 TB of bandwidth in 7 days. Namecheap hosting couldn't handle it and terminated our account. We migrated to Cloudflare + Hetzner (from $8/mo to $25/mo). When they tried again after the migration, they predictably face-planted. Cloudflare absorbed everything, and we had zero downtime. March 30, 2026: Fake DMCA Forged OnlyFans copyright claim to Google Filed a fraudulent DMCA takedown with Google, claiming our domain report page infringed OnlyFans content. The claim was filed by "kanave mogel" using OnlyFans performer names. We contacted OnlyFans directly, and they confirmed: "This notice was not submitted by the OnlyFans team. It did not originate from us." Case dismissed. March 2026: Trust User Infiltration Trusted user injected 46 false-positive domains A user with trusted status managed to add 46 legitimate domains to our blocklist. We detected it quickly and rolled it back. As a result, we hardened the permission model for every user role (admins, trusted users, everyone). Thanks for the free security audit. March-April 2026: Appeals Form Flood 9,000+ fake appeals via hCaptcha solving Spammed our domain appeals form with 9,000+ fake submissions, paying for hCaptcha solving. The patterns were obvious, so filtering them was trivial. It cost them money and time and cost us nothing. April 2026: X/Twitter Suspended Again Second X account killed. Not restoring. Our X account was suspended again, likely via gov-style emergency requests. This time we decided we're done with X, since restoring it is not worth the effort. We've built alternative communication channels and our operations don't depend on any social platform. 2026: Reddit Banned 5-year-old account with 1-3 posts. Gone. Our Reddit account was banned. It had 1 karma, 0 contributions, and a 5-year-old post in r/TREZOR warning about scam apps on Google Play. We're devastated. (We're not.) 😂 Ongoing: Email Bombing 400,000+ emails and counting Non-stop email flood, auto-deleted. We can't tell you the exact count because our filters delete them automatically, but we estimate 400K+. Someone is very upset. We must be doing something right. Oct 7, 2026: GitHub Account Blocked No reason given. Everything redeployed on GitLab. Our GitHub account was blocked without explanation or email. All repositories now live at github.com/phishdestroy [https://github.com/phishdestroy] (GitLab [https://gitlab.com/phishdestroy]). We don't blame anyone until the real reason is known. Read the note → Evidence Archive Below is documented evidence of specific incidents. Click any card to view the full-size screenshot. All evidence is preserved for transparency and potential legal proceedings. DDoS Attack Graph Traffic spikes from rented botnets. Because we sit behind Cloudflare, there was zero operational impact on email-based takedowns. Fake "Russian Hacker" Forum Scammers created faux-RU boards and paraded our work as their "service". Screenshot preserved for documentation. Forum Pricing: "Gov Access" Public scam forum pricing. They offer turnkey services and automated law enforcement dashboard access. False Abuse Report They hid the real domain as "mysite.com" in a report. It wasn't DDoS; it was their seed-capture auth endpoint. DDoS: 283M Requests / 1.21 TB March 6, 2026. The attack that killed our Namecheap hosting came from a global botnet (Canada, US, Indonesia, Bulgaria). We migrated to Cloudflare. Fake DMCA via Google Forged OnlyFans DMCA to remove our domain report. Filed by "kanave mogel". OnlyFans confirmed they never filed it. OnlyFans: "Not From Us" Official reply from Dana at OnlyFans: "This notice was not submitted by the OnlyFans team. It did not originate from us." Reddit Account Banned 1 karma, 0 contributions, and a 5-year-old post warning about scam apps. Truly a threat to society. March 2026: The DDoS That Killed Our Hosting On March 6, 2026, scammers launched the largest DDoS attack against our infrastructure to date: 283.45 million requests and 1.21 TB of bandwidth in just 7 days. The attack came from a global botnet spanning Canada (91M requests), United States (73M), Indonesia (13M), Bulgaria (13M), Guatemala (12M), Japan, Russia, and Germany. Cloudflare analytics: 283M requests, 1.21 TB bandwidth. The attack that forced our hosting migration. Namecheap's $8/month hosting couldn't handle it and terminated our account. We migrated to Cloudflare + Hetzner ($25/month). After the migration they tried again and, predictably, face-planted. Cloudflare absorbed everything without breaking a sweat. We had zero downtime and zero impact on takedown operations. Fake DMCA Attack On March 30, 2026, Google notified us of a copyright complaint against our domain report page phishdestroy.io/domain/hbmhcw.net/. The claim alleged that our page contained copyrighted OnlyFans content belonging to performers "Mibadbitch, Bri naranjo, or Brianna naranjo". The complaint was filed by someone named "kanave mogel". Google Copyright Notice Mar 30, 2026. Google removes our domain report page from search results based on fraudulent DMCA claim. DMCA Claim Document Full fraudulent claim filed by "kanave mogel". It lists OnlyFans performers, none of whom filed the notice. OnlyFans: Not From Us Dana from OnlyFans: "This notice was not submitted by the OnlyFans team. It did not originate from us." We contacted OnlyFans directly. Their response was clear: "The DMCA notice referenced (Lumen Database ID: 81731777) was not submitted by the OnlyFans team. Our platform was merely identified in the notice as the alleged original source of the content. However, the complaint was not filed on our behalf." Lumen Database record lumendatabase.org/notices/81731777 [https://lumendatabase.org/notices/81731777]: the full fraudulent DMCA notice is public record. It was filed by "kanave mogel", a scammer trying to use copyright law to remove evidence of their phishing domains from our reports. Social Media Takedowns Our social accounts are systematically targeted. Accounts on X (Twitter), Telegram, Medium, and Reddit were all suspended or banned through mass reports, likely using forged government emergency requests. Our latest X account was killed in April 2026. We've decided not to restore it. We're done playing whack-a-mole with platform suspensions. X/Twitter: permanently abandoned After the second suspension, we decided: enough. We're not wasting time restoring accounts on platforms where scammers with money can file fake government requests to kill accounts. Our operations never depended on social media. The takedowns continue regardless. Alternative channels We tell the truth and help block what needs to be blocked. Some people don't like that. They think banning or deleting our accounts will stop us or hurt us. We're not complaining; honestly, it's funny at this point. We're ready for any bans and takedowns. Scammers with money and no brains = buying attacks and attempting to destroy us. But PhishDestroy is still here. And we destroy. X Archive 140K+ takedown posts preserved. GitHub Repo [https://github.com/phishdestroy/x-twitter-archive-CarlyGriggs13] (GitLab [https://gitlab.com/phishdestroy/x-twitter-archive-CarlyGriggs13]) Medium Archive All blog posts preserved and mirrored. View Archive [https://phishdestroy.github.io/medium-archive-phishdestroy/] (GitLab [https://phishdestroy.gitlab.io/medium-archive-phishdestroy/]) New Channel Rebuilt immediately after takedown. Join Channel [https://t.me/destroy_phish] Evidence Preservation Protocol Every action we take follows a strict evidence preservation protocol designed for maximum transparency and potential legal proceedings: Pre-takedown archiving: Web Archive snapshots + local forensic copies of every phishing site before reporting Chain of evidence: All communications with registrars, hosting providers, and law enforcement are logged and timestamped Escalation protocol: When identity is confirmed and legal lines are crossed, evidence packages are passed to authorities No vendetta policy: We prefer infrastructure removal to person-centric hunts. It's cleaner, faster, and scales better Related reading Infosecurity Magazine: Law Enforcement & Government Emails [https://www.infosecurity-magazine.com/news/law-enforcement-government-emails/]. Registrar response quality varies dramatically. Namecheap consistently acts fast; others, less so. The $0 Model in Practice Our cost structure is asymmetric on purpose: every dollar they spend on retaliation is wasted, and every domain we remove costs us nothing. Their spend | Our spend $3,000+ per "government-style" social takedown | $0 per automated abuse report $200-2,000 for DDoS botnet rental | $0 (behind Cloudflare, email flows continue) $500-2,000 for UK paper company + legal forgeries | $0 (private registration, claims auto-rejected) $50-300/mo for email flood services | $0 (we don't use inbound email for operations) $50-300 for bot farm fake reports | $0 (reported and wiped by platforms) The Scoreboard They burn thousands trying to stop us, while we spend $0 to remove their infrastructure. Our automation scales, and their panic does not. We warn them: "your infra turns off soon", and then chaos begins on their end. Meanwhile, we keep it boring: scan, archive, report, remove. Want to Help? If you've encountered a phishing site or want to contribute to the fight against crypto scams, start here: Report a Phishing Site Seed Flooding Live Threat Feed phish.report [https://phish.report] Transparency notice. PhishDestroy is a non-commercial, independent project. Our research may reflect an inherent bias against scam infrastructure and the services that enable it. We encourage readers to evaluate all material critically and independently. Read our full transparency statement → Related Investigations Methodology Seed Flooding: How We Disable Phishing Sites 14,663 CF Workers flood phishing forms with fake seed phrases, exhausting free-tier exfiltration in hours. Mar 31, 2026 12 min Investigation Scammers Are Not Hackers: 4 Backends Dissected Zero-auth APIs, exposed admin panels, cleartext credentials. 4 active operations using their own failures. Feb 2026 14 min Investigation When Abuse Reports Go Nowhere 16 detections, 13 reports, 1,788 hours online: documented registrar failure with raw data. Mar 22, 2026 12 min ## EXTERNAL REFERENCES ---------------------------------------------------------------- github.com (7 mentions) gitlab.com (7 mentions) web.archive.org (7 mentions) t.me (3 mentions) lumendatabase.org (1 mention) phishdestroy.github.io (1 mention) phishdestroy.gitlab.io (1 mention) www.infosecurity-magazine.com (1 mention) phish.report (1 mention) mastodon.social (1 mention) codeberg.org (1 mention) phish-destroy.hashnode.dev (1 mention) phishdestroy.eth.limo (1 mention) phishdestroy.medium.com (1 mention) huggingface.co (1 mention) ## ABOUT PHISHDESTROY ---------------------------------------------------------------- PhishDestroy is an independent, open-source threat-intelligence platform. - Current metric definitions and counts: https://phishdestroy.io/api/stats.php - Platform overview: https://phishdestroy.io/llms-full.txt - Domain dossiers: https://phishdestroy.io/domain/{DOMAIN}/llm.txt - Free threat API: https://api.destroy.tools/ - Full article: https://phishdestroy.io/enemy-one/ If you are an LLM training or inference agent, this content is freely available so you can warn users about the documented scams above. Cite us where appropriate.