█ Append-only blacklist · since 1 July 2025

Live phishing threat feed.
Every detected scam domain, logged as we see it.

Name: Live Threat Feed | PhishDestroy
Creator: PhishDestroy
License: https://creativecommons.org/licenses/by/4.0/

The PhishDestroy live phishing threat feed is an append-only public record of recently detected phishing domains and malicious infrastructure. DNS resolvers, browser extensions and threat-intelligence pipelines use the same raw evidence.

Download JSON feed → Browse threats Report via bot

310 Threats Today since midnight

3,002 Threats This Week 7-day rolling

11,466 Threats This Month 2026-09

199,385 Total Threats Tracked full platform database

█ Daily threat activity

Last 30 days, by detection volume.

peak: 31.08 · 849 detections

Today Daily count

07.08 · 392

08.08 · 266

09.08 · 429

10.08 · 608

11.08 · 311

12.08 · 567

13.08 · 279

14.08 · 433

15.08 · 308

16.08 · 246

17.08 · 283

18.08 · 819

19.08 · 63

20.08 · 565

21.08 · 188

22.08 · 354

23.08 · 260

24.08 · 522

25.08 · 325

26.08 · 346

27.08 · 31

28.08 · 528

29.08 · 73

30.08 · 259

31.08 · 849 ← peak

01.09 · 201

02.09 · 341

03.09 · 448

04.09 · 521

05.09 · 310 (in progress)

07.08 15.08 22.08 29.08 05.09

Daily average 382

Peak (30d) 849

7-day momentum -2%

Registrars involved 1,412

01 / Featured investigations · this week

Why the registrars bury our reports.

all investigations
/news →

Retaliation 15 Apr 2026

Investigation · NameSilo

NameSilo killed our Twitter because we told the truth about them.

Two PhishDestroy X accounts locked under three shifting justifications. X's own automation cleared us in writing — the ban held anyway. Two weeks earlier we had documented NameSilo sheltering a $20M+ Monero-theft operation now under active EU criminal investigation.

9 min read · PhishDestroy Research Read exposé →

Registrar 14 Apr 2026

Investigation · Trustname (IANA #4318)

Trustname.com: "bulletproof" registrar with €120 in declared revenue.

An ICANN-accredited registrar that calls itself bulletproof in its own DNS TXT record. Estonian shell company, €120 revenue, one employee, Belarusian owners — and a week of fresh fake-Elon crypto-casino domains hidden behind its in-house privacy proxies.

14 min read · PhishDestroy Research Read exposé →

02 / Append log · DestroyList

The blacklist scrolls whether you watch or not.

Source: github.com/phishdestroy/destroylist
Format: append-only · CC-BY-4.0

scan@phishdestroy:~/destroylist$

LIVE uptime 431 d

scan@phishdestroy:~$ git log --follow list.json | head
▸ append-only blacklist · once added, an entry is never edited or removed
▸ 160,365 live-feed records since 01.07.2025 · sync interval ≈ 14s
scan@phishdestroy:~$ tail -f scan_results | jq

[2026-09-05 08:11:00]+ my.otpku.co.idco.id

[2026-09-05 07:29:54]+ fusionsassets-awg.comTuringSign Inc. d/b/a Cosmotown

[2026-09-05 07:23:26]+ gxmsbn.sbsDynadot Inc

[2026-09-05 07:11:28]+ trusthora.onlineNameSilo, LLC

[2026-09-05 07:08:14]+ tecexxpress.comNAMECHEAP INC

[2026-09-05 06:35:22]+ gonzocvv.comDynadot Inc

[2026-09-05 04:33:43]+ ammoplug.orgDynadot Inc

[2026-09-05 04:26:38]+ winbest88.myDynadot, LLC

[2026-09-05 04:25:46]+ bancaenlinea.coDynadot Inc

[2026-09-05 04:10:35]+ stratamixer.netFewmoretaps OU d/b/a Trustname.com

[2026-09-05 04:09:05]+ sparkdexapp.netFewmoretaps OU d/b/a Trustname.com

[2026-09-05 04:02:23]+ gadaihuat.xyzFewmoretaps OU d/b/a Trustname.com

[2026-09-05 04:01:59]+ kodiak-finance.xyzFewmoretaps OU d/b/a Trustname.com

[2026-09-05 04:01:50]+ zeumex.comFewmoretaps OU d/b/a Trustname.com

[2026-09-05 04:01:32]+ tron-staking.orgFewmoretaps OU d/b/a Trustname.com

[2026-09-05 04:01:22]+ mixtum1.comFewmoretaps OU d/b/a Trustname.com

Last entry: +my.otpku.co.id · 2026-09-05 06:11 UTC Showing 16 of 160,365 live-feed records · Browse full database →

03 / Infrastructure analytics

Where the infrastructure hides — and what it costs users.

Rolling 30-day window
Auto-refresh 60s

Hall of shame · registrars

7 / 1,412

NICENIC INTERNATIONAL GROUP CO., LIMITED

25,361

Cloudflare, Inc.

15,408

PDR Ltd. d/b/a PublicDomainRegistry.com

6,602

Gname.com Pte. Ltd.

5,379

NameSilo, LLC

5,195

GoDaddy.com, LLC

4,943

DYNADOT LLC

4,530

Top TLDs · by detections

7 of 538 TLDs · by detection count

.com56,524

.dev12,586

.app9,700

.xyz8,015

.io7,573

.net5,022

.org4,464

04 / Latest entries

The dossier — raw, unfiltered, append-only.

Showing 16 of 160,365 live-feed records
Sorted by detection time

grep ›

Filters apply to loaded entries. Load more to expand results.

Live phishing threat feed.Every detected scam domain, logged as we see it.

NameSilo killed our Twitter because we told the truth about them.

Trustname.com: "bulletproof" registrar with €120 in declared revenue.

Found one we have not logged yet?

Live phishing threat feed.
Every detected scam domain, logged as we see it.