█ Append-only blacklist · since 1 July 2025

Live phishing threat feed.

Name: Live Threat Feed | PhishDestroy
Creator: PhishDestroy
License: https://creativecommons.org/licenses/by/4.0/

Every detected scam domain, logged as we see it.

The PhishDestroy live phishing threat feed is an append-only public record of recently detected phishing domains and malicious infrastructure. DNS resolvers, browser extensions and threat-intelligence pipelines use the same raw evidence.

Download JSON feed → Browse threats Report via bot

THREAT RADAR / 01

Detect → Document → ReportIllustrative workflow

150 Threats Today since midnight

3,943 Threats This Week 7-day rolling

16,432 Threats This Month 2026-10

224,709 Total Threats Tracked full platform database

█ Daily threat activity

Last 30 days, by detection volume.

peak: 07.10 · 2,128 detections

Today Daily count

23.09 01.10 08.10 15.10 22.10

Show data table · domains added per day, last 30 days (Europe/Berlin calendar days)

Domains added per day, last 30 days
Day	Domains added
2026-10-22 (today, partial)	150
2026-10-21	392
2026-10-20	904
2026-10-19	535
2026-10-18	276
2026-10-17	487
2026-10-16	932
2026-10-15	267
2026-10-14	233
2026-10-13	1,028
2026-10-12	135
2026-10-11	880
2026-10-10	600
2026-10-09	922
2026-10-08	687
2026-10-07	2,128
2026-10-06	481
2026-10-05	186
2026-10-04	349
2026-10-03	475
2026-10-02	303
2026-10-01	240
2026-09-30	40
2026-09-29	558
2026-09-28	91
2026-09-27	434
2026-09-26	395
2026-09-25	878
2026-09-24	243
2026-09-23	558

Daily average 548

Peak (30d) 2,128

7-day momentum -15%

Registrars involved 1,540

02 / Infrastructure analytics

Where the infrastructure hides — and what it costs users.

Rolling 30-day window
Auto-refresh 60s

Hall of shame · registrars

7 / 1,540

NICENIC INTERNATIONAL GROUP CO., LIMITED

27,554

Cloudflare, Inc.

15,793

PDR Ltd. d/b/a PublicDomainRegistry.com

6,946

Dynadot Inc

6,177

NameSilo, LLC

5,791

Gname.com Pte. Ltd.

5,785

GoDaddy.com, LLC

5,375

Top TLDs · by detections

7 of 552 TLDs · by detection count

.com63,456

.dev13,524

.app10,853

.xyz8,846

.io8,474

.shop7,725

.net5,686

03 / Featured investigations

Why the registrars bury our reports.

all investigations
/news →

Retaliation 15 Apr 2026

Investigation · NameSilo

NameSilo killed our Twitter because we told the truth about them.

Two PhishDestroy X accounts locked under three shifting justifications. X's own automation cleared us in writing — the ban held anyway. Two weeks earlier we had documented NameSilo sheltering a $20M+ Monero-theft operation now under active EU criminal investigation.

9 min read · PhishDestroy Research Read exposé →

Registrar 14 Apr 2026

Investigation · Trustname (IANA #4318)

Trustname.com: "bulletproof" registrar with €120 in declared revenue.

An ICANN-accredited registrar that calls itself bulletproof in its own DNS TXT record. Estonian shell company, €120 revenue, one employee, Belarusian owners — and a week of fresh fake-Elon crypto-casino domains hidden behind its in-house privacy proxies.

14 min read · PhishDestroy Research Read exposé →

04 / Append log · DestroyList

The blacklist scrolls whether you watch or not.

Source: github.com/phishdestroy/destroylist (mirror: GitLab)
Format: append-only · CC-BY-4.0

scan@phishdestroy:~/destroylist$

LIVE uptime 478 d

scan@phishdestroy:~$ git log --follow list.json | head
▸ append-only blacklist · once added, an entry is never edited or removed
▸ 185,235 live-feed records since 01.07.2025 · sync interval ≈ 14s
scan@phishdestroy:~$ tail -f scan_results | jq

[2026-10-22 05:42:53]+ autotradenexus.netDynadot Inc

[2026-10-22 05:41:16]+ aurilio-valtrion-solution.comMainReg Inc.

[2026-10-22 05:41:16]+ aureoncorevix.comDynadot Inc

[2026-10-22 05:41:09]+ aurpatriova.comDynadot Inc

[2026-10-22 05:37:50]+ aveniraitrade.comDynadot Inc

[2026-10-22 05:37:45]+ avelicio.clickDynadot, LLC

[2026-10-22 05:37:44]+ avatudmarkdex.netDynadot Inc

[2026-10-22 05:35:47]+ autosurftraffic.netGoDaddy.com, LLC

[2026-10-22 05:35:41]+ automindpy.digitalNETIM SAS

[2026-10-22 05:34:39]+ automindgr.comMAT BAO CORPORATION

[2026-10-22 05:32:36]+ austriquntsoft.comMainReg Inc.

[2026-10-22 05:32:36]+ austriqunt.orgDynadot Inc

[2026-10-22 05:30:35]+ ausorixtrade.comDynadot Inc

[2026-10-22 05:30:33]+ aurumstake-software.comMainReg Inc.

[2026-10-22 05:29:16]+ auroravalimanza.netDynadot Inc

[2026-10-22 05:28:32]+ auroracapitaltrade.comDynadot Inc

Last entry: +autotradenexus.net · 2026-10-22 05:42 UTC Showing 16 of 185,235 live-feed records · Browse full database →

04 / Latest entries

The dossier — raw, unfiltered, append-only.

Showing 16 of 185,235 live-feed records
Sorted by detection time

grep ›

Filters apply to loaded entries. Load more to expand results.

autotradenexus.net ScamReported

Capture image failed to load from the source

Detected: 2026-10-22 05:42 UTC

Registrar: Dynadot Inc

IP Address:

Created: 2026-06-07

urlscan VirusTotal Browserling Hybrid Analysis

aurilio-valtrion-solution.com ScamReported

Screenshot of aurilio-valtrion-solution.com

Capture image failed to load from the source

Detected: 2026-10-22 05:41 UTC

Registrar: MainReg Inc.

IP Address:

Created: 2026-02-09

urlscan VirusTotal Browserling Hybrid Analysis

aureoncorevix.com ScamReported

Capture image failed to load from the source

Detected: 2026-10-22 05:41 UTC

Registrar: Dynadot Inc

IP Address:

Created: 2026-07-21

urlscan VirusTotal Browserling Hybrid Analysis

aurpatriova.com ScamReported

Capture image failed to load from the source

Detected: 2026-10-22 05:41 UTC

Registrar: Dynadot Inc

IP Address:

Created: 2026-04-30

urlscan VirusTotal Browserling Hybrid Analysis

aveniraitrade.com ScamReported

Capture image failed to load from the source

Detected: 2026-10-22 05:37 UTC

Registrar: Dynadot Inc

IP Address:

Created: 2026-07-17

urlscan VirusTotal Browserling Hybrid Analysis

avelicio.click ScamReported

Capture image failed to load from the source

Detected: 2026-10-22 05:37 UTC

Registrar: Dynadot, LLC

IP Address:

Created: 2026-06-03

urlscan VirusTotal Browserling Hybrid Analysis

avatudmarkdex.net ScamReported

Capture image failed to load from the source

Detected: 2026-10-22 05:37 UTC

Registrar: Dynadot Inc

IP Address:

Created: 2026-03-21

urlscan VirusTotal Browserling Hybrid Analysis

autosurftraffic.net ScamReported

Capture image failed to load from the source

Detected: 2026-10-22 05:35 UTC

Registrar: GoDaddy.com, LLC

IP Address:

Created: 2018-10-29

urlscan VirusTotal Browserling Hybrid Analysis

automindpy.digital ScamReported

Capture image failed to load from the source

Detected: 2026-10-22 05:35 UTC

Registrar: NETIM SAS

IP Address:

Created: 2026-06-21

urlscan VirusTotal Browserling Hybrid Analysis

automindgr.com ScamReported

Capture image failed to load from the source

Detected: 2026-10-22 05:34 UTC

Registrar: MAT BAO CORPORATION

IP Address:

Created: 2026-06-07

urlscan VirusTotal Browserling Hybrid Analysis

austriquntsoft.com ScamReported

Capture image failed to load from the source

Detected: 2026-10-22 05:32 UTC

Registrar: MainReg Inc.

IP Address:

Created: 2026-03-09

urlscan VirusTotal Browserling Hybrid Analysis

austriqunt.org ScamReported

Capture image failed to load from the source

Detected: 2026-10-22 05:32 UTC

Registrar: Dynadot Inc

IP Address:

Created: 2026-03-09

urlscan VirusTotal Browserling Hybrid Analysis

ausorixtrade.com ScamReported

Capture image failed to load from the source

Detected: 2026-10-22 05:30 UTC

Registrar: Dynadot Inc

IP Address:

Created: 2026-04-01

urlscan VirusTotal Browserling Hybrid Analysis

aurumstake-software.com ScamReported

Capture image failed to load from the source

Detected: 2026-10-22 05:30 UTC

Registrar: MainReg Inc.

IP Address:

Created: 2026-03-08

urlscan VirusTotal Browserling Hybrid Analysis

auroravalimanza.net ScamReported

Capture image failed to load from the source

Detected: 2026-10-22 05:29 UTC

Registrar: Dynadot Inc

IP Address:

Created: 2026-09-29

urlscan VirusTotal Browserling Hybrid Analysis

auroracapitaltrade.com ScamReported

Capture image failed to load from the source

Detected: 2026-10-22 05:28 UTC

Registrar: Dynadot Inc

IP Address:

Created: 2026-06-12

urlscan VirusTotal Browserling Hybrid Analysis

Stream JSON

█ Submit · escalation desk

Found one we have not logged yet?

Send the URL to our triage queue. No account or sign-in is required.