# PhishDestroy Live Threat Feed

> Append-only public record of recently detected phishing domains and malicious infrastructure.

## What's Here

The live phishing threat feed presents recent records in detection-time order.
Fields shown when available:
- Domain and detection timestamp
- Registrar and IP address
- Domain creation date
- Evidence screenshot or screenshot-pending state
- Full PhishDestroy domain report
- Links to urlscan, VirusTotal, Browserling, and Hybrid Analysis

## Data Access

- GET https://raw.githubusercontent.com/phishdestroy/destroylist/main/list.json — DestroyList JSON
- GET /feed-threats.xml — detailed Atom threat feed with IOC metadata
- GET /api/stats.php — platform-wide statistics

## Current Snapshot

- Live-feed records: 152,469
- Snapshot updated: 2026-08-14T12:39:06+00:00

The live-feed count is distinct from the larger platform database total. A
record can omit registrar, IP, creation date, or screenshot while enrichment
is still pending; the page labels unavailable evidence rather than inventing it.

## Citation
  PhishDestroy CTI (https://phishdestroy.io/live/), CC-BY-4.0, accessed 2026-08-24