█ Append-only blacklist · since 1 July 2025

Live phishing threat feed.

Name: Live Threat Feed | PhishDestroy
Creator: PhishDestroy
License: https://creativecommons.org/licenses/by/4.0/

Every detected scam domain, logged as we see it.

The PhishDestroy live phishing threat feed is an append-only public record of recently detected phishing domains and malicious infrastructure. DNS resolvers, browser extensions and threat-intelligence pipelines use the same raw evidence.

Download JSON feed → Browse threats Report via bot

THREAT RADAR / 01

Detect → Document → ReportIllustrative workflow

8 Threats Today since midnight

3,769 Threats This Week 7-day rolling

16,134 Threats This Month 2026-10

223,460 Total Threats Tracked full platform database

█ Daily threat activity

Last 30 days, by detection volume.

peak: 07.10 · 2,128 detections

Today Daily count

21.09 29.09 06.10 13.10 20.10

Show data table · domains added per day, last 30 days (Europe/Berlin calendar days)

Domains added per day, last 30 days
Day	Domains added
2026-10-20 (today, partial)	8
2026-10-19	535
2026-10-18	277
2026-10-17	487
2026-10-16	933
2026-10-15	267
2026-10-14	233
2026-10-13	1,029
2026-10-12	135
2026-10-11	880
2026-10-10	600
2026-10-09	922
2026-10-08	687
2026-10-07	2,128
2026-10-06	481
2026-10-05	186
2026-10-04	349
2026-10-03	475
2026-10-02	303
2026-10-01	240
2026-09-30	40
2026-09-29	558
2026-09-28	91
2026-09-27	434
2026-09-26	395
2026-09-25	878
2026-09-24	243
2026-09-23	558
2026-09-22	645
2026-09-21	531

Daily average 538

Peak (30d) 2,128

7-day momentum -43%

Registrars involved 1,534

02 / Infrastructure analytics

Where the infrastructure hides — and what it costs users.

Rolling 30-day window
Auto-refresh 60s

Hall of shame · registrars

7 / 1,534

NICENIC INTERNATIONAL GROUP CO., LIMITED

27,364

Cloudflare, Inc.

15,778

PDR Ltd. d/b/a PublicDomainRegistry.com

6,927

Dynadot Inc

5,921

Gname.com Pte. Ltd.

5,780

NameSilo, LLC

5,767

GoDaddy.com, LLC

5,360

Top TLDs · by detections

7 of 552 TLDs · by detection count

.com62,998

.dev13,466

.app10,793

.xyz8,816

.io8,418

.shop7,421

.net5,595

03 / Featured investigations

Why the registrars bury our reports.

all investigations
/news →

Retaliation 15 Apr 2026

Investigation · NameSilo

NameSilo killed our Twitter because we told the truth about them.

Two PhishDestroy X accounts locked under three shifting justifications. X's own automation cleared us in writing — the ban held anyway. Two weeks earlier we had documented NameSilo sheltering a $20M+ Monero-theft operation now under active EU criminal investigation.

9 min read · PhishDestroy Research Read exposé →

Registrar 14 Apr 2026

Investigation · Trustname (IANA #4318)

Trustname.com: "bulletproof" registrar with €120 in declared revenue.

An ICANN-accredited registrar that calls itself bulletproof in its own DNS TXT record. Estonian shell company, €120 revenue, one employee, Belarusian owners — and a week of fresh fake-Elon crypto-casino domains hidden behind its in-house privacy proxies.

14 min read · PhishDestroy Research Read exposé →

04 / Append log · DestroyList

The blacklist scrolls whether you watch or not.

Source: github.com/phishdestroy/destroylist (mirror: GitLab)
Format: append-only · CC-BY-4.0

scan@phishdestroy:~/destroylist$

LIVE uptime 476 d

scan@phishdestroy:~$ git log --follow list.json | head
▸ append-only blacklist · once added, an entry is never edited or removed
▸ 183,800 live-feed records since 01.07.2025 · sync interval ≈ 14s
scan@phishdestroy:~$ tail -f scan_results | jq

[2026-10-20 03:27:03]+ richaxisholdings.comUltahost, Inc.

[2026-10-20 02:22:31]+ traderstrustprofits.infoOwnRegistrar, Inc.

[2026-10-20 02:07:28]+ brineta.vuDynadot Inc

[2026-10-20 01:24:49]+ fpmarketturkey.comUltahost, Inc.

[2026-10-20 00:46:44]+ australianarmouredmodels.comGoDaddy.com, LLC

[2026-10-20 00:40:06]+ valuedeckcu.comUltahost, Inc.

[2026-10-20 00:33:20]+ cracopilot.comGoDaddy.com, LLC

[2026-10-19 22:48:58]+ papertrade.tradePDR Ltd. d/b/a PublicDomainRegistry.com

[2026-10-19 21:47:49]+ help-fzoru.orgUltahost, Inc.

[2026-10-19 21:39:03]+ dashboard.affirmpayovertime.comaffirmpayovertime.com

[2026-10-19 21:23:40]+ tarjeta.pagamentotiktok.comNameSilo, LLC

[2026-10-19 20:58:42]+ freefcpoints.comNAMECHEAP INC

[2026-10-19 20:57:16]+ fcpoints.onlineNAMECHEAP INC

[2026-10-19 20:55:17]+ gametweak.appNamecheap Inc.

[2026-10-19 20:09:04]+ 2345dq.comGname.com Pte. Ltd.

[2026-10-19 20:07:08]+ 5ecaa638aa074d6cace670663b201685e61412e2.naturaltoursas.comGoDaddy.com, LLC

Last entry: +richaxisholdings.com · 2026-10-20 03:27 UTC Showing 16 of 183,800 live-feed records · Browse full database →

04 / Latest entries

The dossier — raw, unfiltered, append-only.

Showing 16 of 183,800 live-feed records
Sorted by detection time

grep ›

Filters apply to loaded entries. Load more to expand results.

richaxisholdings.com ScamReported

Capture image failed to load from the source

Detected: 2026-10-20 03:27 UTC

Registrar: Ultahost, Inc.

IP Address:

Created: 2026-06-04

urlscan VirusTotal Browserling Hybrid Analysis

traderstrustprofits.info ScamReported

Capture image failed to load from the source

Detected: 2026-10-20 02:22 UTC

Registrar: OwnRegistrar, Inc.

IP Address:

Created: 2025-12-31

urlscan VirusTotal Browserling Hybrid Analysis

brineta.vu ScamReported

Capture image failed to load from the source

Detected: 2026-10-20 02:07 UTC

Registrar: Dynadot Inc

IP Address:

Created: 2026-08-05

urlscan VirusTotal Browserling Hybrid Analysis

fpmarketturkey.com ScamReported

Capture image failed to load from the source

Detected: 2026-10-20 01:24 UTC

Registrar: Ultahost, Inc.

IP Address:

Created: 2025-10-14

urlscan VirusTotal Browserling Hybrid Analysis

australianarmouredmodels.com ScamReported

Screenshot of australianarmouredmodels.com

Capture image failed to load from the source

Detected: 2026-10-20 00:46 UTC

Registrar: GoDaddy.com, LLC

IP Address:

Created: 2026-10-16

urlscan VirusTotal Browserling Hybrid Analysis

valuedeckcu.com ScamReported

Capture image failed to load from the source

Detected: 2026-10-20 00:40 UTC

Registrar: Ultahost, Inc.

IP Address:

Created: 2026-10-17

urlscan VirusTotal Browserling Hybrid Analysis

cracopilot.com ScamReported

Capture image failed to load from the source

Detected: 2026-10-20 00:33 UTC

Registrar: GoDaddy.com, LLC

IP Address:

Created: 2024-08-14

urlscan VirusTotal Browserling Hybrid Analysis

papertrade.trade ScamReported

Capture image failed to load from the source

Detected: 2026-10-19 22:48 UTC

Registrar: PDR Ltd. d/b/a PublicDomainRegistry.com

IP Address:

Created: 2026-10-13

urlscan VirusTotal Browserling Hybrid Analysis

help-fzoru.org ScamReported

Capture image failed to load from the source

Detected: 2026-10-19 21:47 UTC

Registrar: Ultahost, Inc.

IP Address:

Created: 2026-10-12

urlscan VirusTotal Browserling Hybrid Analysis

dashboard.affirmpayovertime.com ScamReported

Screenshot of dashboard.affirmpayovertime.com

Capture image failed to load from the source

Detected: 2026-10-19 21:39 UTC

Registrar: N/A

IP Address:

Created: N/A

urlscan VirusTotal Browserling Hybrid Analysis

tarjeta.pagamentotiktok.com ScamReported

Screenshot of tarjeta.pagamentotiktok.com

Capture image failed to load from the source

Detected: 2026-10-19 21:23 UTC

Registrar: NameSilo, LLC

IP Address:

Created: 2025-11-21

urlscan VirusTotal Browserling Hybrid Analysis

freefcpoints.com ScamReported

Capture image failed to load from the source

Detected: 2026-10-19 20:58 UTC

Registrar: NAMECHEAP INC

IP Address:

Created: 2026-10-06

urlscan VirusTotal Browserling Hybrid Analysis

fcpoints.online ScamReported

Capture image failed to load from the source

Detected: 2026-10-19 20:57 UTC

Registrar: NAMECHEAP INC

IP Address:

Created: 2026-06-24

urlscan VirusTotal Browserling Hybrid Analysis

gametweak.app ScamReported

Capture image failed to load from the source

Detected: 2026-10-19 20:55 UTC

Registrar: Namecheap Inc.

IP Address:

Created: 2026-07-06

urlscan VirusTotal Browserling Hybrid Analysis

2345dq.com ScamReported

Capture image failed to load from the source

Detected: 2026-10-19 20:09 UTC

Registrar: Gname.com Pte. Ltd.

IP Address:

Created: 2024-06-22

urlscan VirusTotal Browserling Hybrid Analysis

5ecaa638aa074d6cace670663b201685e61412e2.naturaltoursas.com ScamReported

Screenshot of 5ecaa638aa074d6cace670663b201685e61412e2.naturaltoursas.com

Capture image failed to load from the source

Detected: 2026-10-19 20:07 UTC

Registrar: GoDaddy.com, LLC

IP Address:

Created: 2018-03-06

urlscan VirusTotal Browserling Hybrid Analysis

Stream JSON

█ Submit · escalation desk

Found one we have not logged yet?

Send the URL to our triage queue. No account or sign-in is required.