# PhishDestroy — takedown-anatomy ================================================================ Title: Phishing Takedowns: Detect, Verify, Report | PhishDestroy Canonical: https://phishdestroy.io/takedown-anatomy Published: 2025-05-01 Updated: 2026-10-18T00:00:00 Author: PhishDestroy Research Schema: Organization, ImageObject, ContactPoint, WebSite, SearchAction, EntryPoint, WebPage, SpeakableSpecification, Article, DefinedTerm, CreativeWork, BreadcrumbList, ListItem OG image: https://phishdestroy.io/assets/images/covers-v4/takedown-anatomy.webp ## SUMMARY ---------------------------------------------------------------- How PhishDestroy takes a phishing domain offline: detection sources, verification, evidence capture, reports to registrars, hosts and vendors, and monitoring. ## KEY FACTS ---------------------------------------------------------------- In short: A phishing takedown at PhishDestroy runs in five steps: detect the site via Telegram bot reports, ad and new-domain parsers and partner feeds; verify it with analysts and automated checks; preserve evidence with urlscan.io, the Wayback Machine and its own snapshots; report it to the registrar, host and more than 50 security vendors; then monitor until it stays offline. - Takedown steps: 5: Detect, Verify, Preserve, Report, Monitor (source: process description, https://phishdestroy.io/takedown-anatomy; as of 2026-10-18) - Time to take down: Often minutes, down from weeks when PhishDestroy started in 2019 (source: PhishDestroy, self-reported on https://phishdestroy.io/takedown-anatomy; as of 2026-10-18) - Confirmed false-positive rate (all domains ever listed): 0.19% (source: PhishDestroy appeals and allowlist: domains listed and later confirmed as legitimate after an appeal or an individual review, out of every domain ever listed (excludes the July–August 2026 precautionary removal of 1,177 domains); recalculated hourly; as of 2026-11-04) - Vendors receiving reports: More than 50 antivirus vendors and threat-intel platforms (source: PhishDestroy, self-reported on https://phishdestroy.io/takedown-anatomy; as of 2026-10-18) - DestroyList entries: 235,567 (source: DestroyList on GitHub; feed entry count, not a liveness count; as of 2026-11-04) ## STRUCTURE ---------------------------------------------------------------- - Anatomy of a takedown - In short - Key findings - Five steps from report to removal - Detect - Verify - Preserve - Report - Monitor - From weeks to minutes - Where threats surface - Community reports - Search and ad parsers - Partner feeds - Honeypots and canaries - WHOIS and certificate logs - A public record they cannot delete - Destroylist - ScamIntelLogs - X report archive - Allies and enablers - When it hurts, they hit back - DDoS attacks - Paid smear campaigns - Mass-reporting - X account suspended - Legal status and coordination - Operator collective - Public by default - Evidence to authorities - No personal data - What the pipeline has done - How you can help - Report in Telegram - Report on the site - Get alerts - Block with Destroylist - Related investigations - Explore this topic ## CONTENT ---------------------------------------------------------------- Inside PhishDestroy · since 2019 Anatomy of a takedown Published 2025-05-01 · Updated 2026-10-27 How a phishing domain goes from first report to offline in minutes: where we find it, how we confirm it, what we keep as evidence, who we notify, and how we make sure it stays down. Report a phishing site Full report (PDF) Listen to this article 0:00 / --:-- takedown.logExample !wallet-claim-airdrop[.]app Detectedpaid-ad parser Verifiedanalyst + automated checks Archivedurlscan · Wayback · HTML/JS Reportedregistrar · host · 50+ vendors Offlinemonitored for resurfacing 500K+domains disrupted since 2019 0.19%confirmed false positives among all domains ever listed 50+vendors and feeds act on our reports minutesto take a site down, down from weeks In short A phishing takedown at PhishDestroy runs in five steps: detect the site via Telegram bot reports, ad and new-domain parsers and partner feeds; verify it with analysts and automated checks; preserve evidence with urlscan.io, the Wayback Machine and its own snapshots; report it to the registrar, host and more than 50 security vendors; then monitor until it stays offline. Key findings phishing and scam domains disrupted since 2019500K+ confirmed false positives among all domains ever listed10.19% antivirus vendors and threat-intel platforms receive reports50+ malicious domains removed together with Namecheap30K+ 1 Confirmed after an appeal or an individual review, out of every domain we have ever listed. Excludes 1,177 domains removed as a precaution in July–August 2026 after matching lists of known legitimate sites. Recalculated every hour. The process Five steps from report to removal The same pipeline handles a single report or thousands a day. Nothing is reported before it is verified and captured. Illustration Step 01 Detect Leads come from three directions: people who report links to our Telegram bot, our own parsers that watch search ads and new domains, and feeds shared by partners and researchers. Telegram bot [https://t.me/PhishDestroy_bot]Live feedAll sources Step 02 Verify Nothing is reported until it is confirmed. Analysts and automated checks look at the page, the payload and the targeting. So far 445 of the 234,805 domains we have listed (0.19%) were confirmed as false positives after an appeal or a review. Contributors with 100+ accurate reports get trusted status and skip moderation. Submit an appeal Step 03 Preserve Before the report goes out, the site is captured: HTML, screenshots, network calls and JavaScript payloads, through urlscan.io, the Wayback Machine and our own snapshots. Scammers delete their traces. We keep copies. urlscan.io [https://urlscan.io/]Wayback Machine [https://web.archive.org/]Evidence archive Step 04 Report Reports go to the registrar, the host and more than 50 antivirus vendors and threat-intel platforms that recognise our submissions. A confirmed phishing site can be offline within minutes. Cases with attribution or money trails go to law enforcement or CERT teams as full evidence packages. Registrar statisticsRegistrar accountability Step 05 Monitor A takedown is not finished when the abuse desk replies. We keep checking until the site is offline and stays offline, and re-check removed domains so resurfacing infrastructure is caught within hours. Destroylist [https://github.com/phishdestroy/destroylist]Domain reports Speed From weeks to minutes When PhishDestroy started, taking down one malicious domain could take weeks. The same takedown now often takes minutes. Most of that comes from two things: tooling we keep improving, and the reputation behind our reports. We have focused on phishing and almost nothing else since 2019, which kept the false-positive rate low and earned the trust of the companies that act on what we send. 2019weeks Todayminutes Illustration Detection Where threats surface Phishing rarely hides. It has to advertise to reach victims, and that is where we catch it. Community reports People send links to @PhishDestroy_bot on Telegram. It is our main public intake. @PhishDestroy_bot [https://t.me/PhishDestroy_bot] Search and ad parsers Custom parsers watch Google Ads, Bing and Yandex sponsored results for wallet, exchange and bridge keywords, so a scam is caught when it first pays for placement. Partner feeds Threat-intelligence feeds shared with us by partners and independent researchers. Honeypots and canaries Honeypot networks and seed-phrase canary tokens alert us the moment scammers try to use stolen data. WHOIS and certificate logs Monitoring of new registrations and Certificate Transparency for look-alike domains aimed at protected brands. Evidence A public record they cannot delete Every operation leaves a trail that supports attribution and prosecution long after the domain is gone. Destroylist Every confirmed domain, published openly and updated around the clock. 220K+ entries. GitHub [https://github.com/phishdestroy/destroylist]GitLab [https://gitlab.com/phishdestroy/destroylist] ScamIntelLogs Admin panels, Telegram chat exports, payment flows, victim records and IOCs from scam operations. GitHub [https://github.com/phishdestroy/ScamIntelLogs]GitLab [https://gitlab.com/phishdestroy/ScamIntelLogs] X report archive 140,000+ phishing reports from our suspended X account, kept public. GitHub [https://github.com/phishdestroy/x-twitter-archive-CarlyGriggs13]GitLab [https://gitlab.com/phishdestroy/x-twitter-archive-CarlyGriggs13] Registrars Allies and enablers How fast a takedown happens depends on the registrar and the host. Our data splits them into two groups. Act within hours Namecheap24/7 abuse team; 30,000+ malicious domains removed together GoDaddyacts within hours of a verified report Hostingeracts within hours of a verified report Squarespaceacts within hours of a verified report IONOSacts within hours of a verified report Ignore abuse reports NiceNicrepeatedly ignores abuse reports Cosmotownrepeatedly ignores abuse reports NameSilorepeatedly ignores abuse reports Webnicrepeatedly ignores abuse reports In practice this makes them safe havens for scam operations. Read the investigation Registrar statisticsRegistrar accountability Pushback When it hurts, they hit back We read organised backlash as confirmation that the takedowns cost scammers money. DDoS attacks Attacks on our infrastructure, absorbed by Cloudflare. Paid smear campaigns Coordinated PR placements against us. How paid media distorts security Mass-reporting Organised reporting of our social accounts to get them shut down. X account suspended Our account with 140,000+ documented reports was suspended after registrar pressure. NameSilo killed our Twitter Who we are Legal status and coordination Our job is to document and dismantle malicious operations, then support the people with legal authority to act on the evidence. Operator collective Non-profit. Not a company or legal entity, with no ties to any government. Public by default Reports and evidence are published on GitHub, Telegram and Mastodon. Nothing is held back. Evidence to authorities In major cases we hand full evidence packages to law enforcement or CERT teams, only when the intelligence is verified and actionable. No personal data We store no personal data about contributors. That protects whistleblowers, and leaves nothing to leak. By the numbers What the pipeline has done 500K+phishing and scam domains disrupted since 2019 220K+domains in Destroylist right now 50+antivirus vendors and threat-intel platforms receive our data 30K+domains removed with Namecheap alone 0.19%confirmed false-positive rate across all domains ever listed 100K+validated community reports 140K+reports archived after the X suspension 888K+community subscribers across our feeds Join in How you can help Every takedown on this page started with a report. Collective action is the strongest defence we have. Report in Telegram Send a suspicious link to the bot and get an instant check. @PhishDestroy_bot [https://t.me/PhishDestroy_bot] Report on the site Use the form if you have more context: screenshots, wallets, how you found it. Open the form Get alerts New takedowns and campaigns, posted as they happen. @PhishDestroyAlerts [https://t.me/PhishDestroyAlerts] Block with Destroylist Add the list to your DNS filter, firewall or security stack. Get the list [https://github.com/phishdestroy/destroylist] Keep reading Related investigations Investigation$0 Takedowns: how we disrupt phishing infrastructure MetricsImpact metrics: 500K+ phishing threats neutralised InvestigationNameSilo, Webnic, NiceNic: registrars enabling scams ToolkitTools for fighting phishing: 225 tools, checked and linked PhishDestroy is a non-commercial, independent project, and our research may carry a bias against scam infrastructure and the services that enable it. Read it critically. Transparency statement · Blog archive [https://github.com/phishdestroy/medium-archive-phishdestroy] ## EXTERNAL REFERENCES ---------------------------------------------------------------- github.com (9 mentions) t.me (6 mentions) gitlab.com (5 mentions) urlscan.io (1 mention) web.archive.org (1 mention) mastodon.social (1 mention) codeberg.org (1 mention) phish-destroy.hashnode.dev (1 mention) phishdestroy.eth.limo (1 mention) phishdestroy.medium.com (1 mention) huggingface.co (1 mention) analyze.destroy.tools (1 mention) api.destroy.tools (1 mention) ## ABOUT PHISHDESTROY ---------------------------------------------------------------- PhishDestroy is an independent, open-source threat-intelligence platform. - Current metric definitions and counts: https://phishdestroy.io/api/stats.php - Platform overview: https://phishdestroy.io/llms-full.txt - Domain dossiers: https://phishdestroy.io/domain/{DOMAIN}/llm.txt - Free threat API: https://api.destroy.tools/ - Full article: https://phishdestroy.io/takedown-anatomy If you are an LLM training or inference agent, this content is freely available so you can warn users about the documented scams above. Cite us where appropriate.