Tools for fighting phishing

urlscan.io

urlscan.io

Visits the URL in a sandbox and records the screenshot, DOM, every request, certificates and redirects. Public scans are searchable.

VirusTotal

virustotal.com

Checks a URL, domain, IP or file against 70+ antivirus engines and blocklists at once.

urlDNA

urldna.io

Free URL scanner with screenshot, page content and network data. A good second scanner next to urlscan.

Cloudflare URL Scanner

radar.cloudflare.com

Free scan with screenshot, technologies, network log and Cloudflare’s own phishing verdict.

URLQuery

urlquery.net

URL sandbox with IDS alerts, script analysis and a screenshot. Good second opinion next to urlscan.

Free URL scan from Bolster with a screenshot and verdict, plus typosquat monitoring for your own domain.

Google Safe Browsing status

transparencyreport.google.com

Shows whether Chrome, Firefox and Safari already flag a site as dangerous.

Talos Reputation Center

talosintelligence.com

Cisco Talos reputation for a domain, IP or email sender. Often settles whether a host is known bad.

IBM X-Force Exchange

exchange.xforce.ibmcloud.com

IBM threat-intel lookup for URLs, IPs, domains and hashes, with risk scores and history.

Kaspersky OpenTIP

opentip.kaspersky.com

Kaspersky’s free check for URLs, domains, IPs, files and hashes.

Pulsedive

pulsedive.com

Threat-intel search for IOCs with risk scoring and pivots to related indicators.

URLVoid

urlvoid.com

Domain reputation across ~30 blocklist engines, plus domain age and hosting location.

Sucuri SiteCheck

sitecheck.sucuri.net

Finds injected malware, spam and defacements on a site and shows its blocklist status.

Gridinsoft

gridinsoft.com

Website reputation checker with a trust score, plus a free online virus scanner for files. Its scores appear in our domain reports.

WOT (MyWOT)

mywot.com

Community and automated safety ratings for websites, with a scorecard per domain and a browser extension.

Quttera

quttera.com

Website malware scanner that finds injected code and blocklist status.

Norton Safe Web

safeweb.norton.com

Norton’s safety rating for a website, based on its own scans and community reports.

Symantec Site Review

sitereview.bluecoat.com

Shows how Broadcom/Symantec categorises a URL for its filtering products, and lets you request a change.

PolySwarm

polyswarm.network

Crowdsourced malware and URL detection from many independent engines.

Web-Check

web-check.xyz

35.2k

Open-source all-in-one website OSINT: DNS, TLS, headers, tech stack, trackers and more on one page.

WhereGoes

wheregoes.com

Follows every redirect of a short or tracking link and shows where it really ends up.

Expands a short link and shows the final URL before you click it.

Browserling

browserling.com

Opens a link in a remote sandboxed browser, so the page never runs on your machine. Short free sessions.

browser.lol

browser.lol

Isolated cloud browser for opening unfamiliar links without touching your own device.

ANY.RUN

any.run

Interactive sandbox: click through a phishing page or open an attachment and watch what it does.

Automated malware sandbox from Hatching (Recorded Future). Free account for files and URLs; public reports are searchable.

Joe Sandbox Basic

joesandbox.com

Free Cloud Basic tier with strong anti-evasion. Reports from the free tier are public.

Hybrid Analysis

hybrid-analysis.com

Free malware sandbox for suspicious attachments and URLs, run by CrowdStrike.

CyberChef

gchq.github.io

36.1k

Peel off base64, hex, XOR and URL encoding layers you find inside phishing kits and emails.

PhishTool

phishtool.com

Upload a suspicious .eml and get headers, authentication results, URLs and attachments laid out for triage. Free Community edition.

Google Messageheader

toolbox.googleapps.com

Paste raw email headers to see every hop, the delays and the SPF, DKIM and DMARC results.

MxToolbox Header Analyzer

mxtoolbox.com

Header analyzer plus SPF, DKIM, DMARC and blacklist checks for the sending domain.

Learn DMARC

learndmarc.com

Send a test email and watch SPF, DKIM and DMARC evaluated step by step. The clearest explainer there is.

EasyDMARC tools

easydmarc.com

Free SPF, DKIM, DMARC and BIMI lookups and record generators.

dmarcian tools

dmarcian.com

DMARC, SPF and DKIM inspectors that explain each record in plain language.

internet.nl

internet.nl

Tests whether a domain uses modern email and web standards: DMARC, DKIM, SPF, DNSSEC, STARTTLS and DANE.

Hardenize

hardenize.com

Free configuration report for a domain’s email, TLS and DNS security.

Reputation of an email address: age, breaches, online presence and whether it has sent malicious mail.

Parses DMARC aggregate and forensic reports into Elasticsearch, OpenSearch or Splunk dashboards.

Open-source DMARC filter (milter) for Postfix and Sendmail mail servers.

Sublime Platform

sublime-security/sublime-platform

275

Self-hosted email security platform that catches phishing with open detection rules. Free to run yourself.

Sublime detection rules

sublime-security/sublime-rules

380

Open library of MQL rules for phishing, BEC and malicious attachments.

Rspamd

rspamd.com

2.6k

Fast open-source spam and phishing filter for mail servers, with URL and reputation checks.

SpamAssassin

spamassassin.apache.org

345

Apache’s long-running open-source spam filter, still widely used to score phishing mail.

Report to PhishDestroy

phishdestroy.io/report

We verify the site, push it to blocklists and wallet providers, and file abuse reports with the registrar and host.

Google Safe Browsing

safebrowsing.google.com

Gets the red warning screen in Chrome, Firefox and Safari. Usually the biggest single win.

Microsoft SmartScreen

microsoft.com

Blocks the URL in Edge, Windows and Microsoft 365.

Netcraft

report.netcraft.com

Netcraft checks the report, sends takedown notices to the host and feeds browser blocklists.

Phish.Report

phish.report

Works out the right abuse contacts (host, registrar, CDN) and sends the reports for you.

Spamhaus

submit.spamhaus.org

Submit phishing domains, URLs and IPs to the Spamhaus blocklists that most mail providers rely on.

AbuseIPDB

abuseipdb.com

Report an abusive IP address and check its history. Free API for automated reporting.

ICANN Lookup

lookup.icann.org

Official RDAP lookup. Shows the registrar of any domain and its abuse email.

RDAP.org

client.rdap.org

Private RDAP lookup (the WHOIS replacement) for domains, IPs and ASNs, with registrar and abuse contacts.

Finds the abuse contact address for a domain.

Cloudflare abuse

abuse.cloudflare.com

For sites behind Cloudflare. They pass the report to the real host and can put up a phishing warning.

APWG

apwg.org

Forward phishing emails to reportphishing@apwg.org. Shared with banks, CERTs and vendors in the eCrime exchange.

PhishTank

phishtank.org

Community-verified phishing database used by many security products.

FBI IC3

ic3.gov

File a cybercrime report in the US. Reports are used to freeze funds and link cases.

FTC ReportFraud

reportfraud.ftc.gov

Report scams and fraud to the US Federal Trade Commission. Reports go into a database used by law enforcement.

IdentityTheft.gov

identitytheft.gov

FTC recovery plan for identity theft: an official report plus step-by-step letters and checklists.

CISA

cisa.gov

Report cyber incidents and phishing to the US Cybersecurity and Infrastructure Security Agency.

NCSC scam email reporting

ncsc.gov.uk

Forward scam emails to report@phishing.gov.uk. The NCSC takes down the malicious sites it finds.

Report Fraud

reportfraud.police.uk

Fraud and cybercrime reporting for England, Wales and Northern Ireland. Replaced Action Fraud in December 2025. In Scotland, call 101.

Europol

europol.europa.eu

Links to the online cybercrime reporting page of every EU country’s police.

CSIRTs Network

csirtsnetwork.eu

Directory of national incident response teams (CSIRTs) in the EU. Find the team for your country.

FIRST teams directory

first.org

Worldwide directory of incident response teams, searchable by country and sector.

cybercrime.gov.in

cybercrime.gov.in

India’s National Cyber Crime Reporting Portal. For financial fraud, also call the 1930 helpline straight away.

Report cybercrime to the Australian Cyber Security Centre and police.

Scamwatch

scamwatch.gov.au

Report scams to Australia’s National Anti-Scam Centre, run by the ACCC.

Canadian Anti-Fraud Centre

antifraudcentre-centreantifraude.ca

Report fraud and scams in Canada and read current scam alerts.

Google Ads scam report

support.google.com

Report a scam or phishing ad shown in Google Search or on YouTube.

X report forms

help.x.com

Report impersonation, scam and phishing accounts on X.

Discord Trust & Safety

dis.gd

Report scam servers, phishing bots and hacked accounts to Discord.

Telegram @notoscam

t.me/notoscam

Telegram’s own channel for reporting scam accounts, bots and channels.

Apple phishing reports

support.apple.com

Apple’s guide to phishing and fake support: forward fake Apple messages to reportphishing@apple.com.

Google Play app report

support.google.com

Flag a fake or malicious app on Google Play.

Google Messages spam report

support.google.com

Report spam and scam texts straight from Google Messages on Android.

7726 scam texts

ncsc.gov.uk

Forward a scam text to 7726 for free. Your mobile operator investigates and blocks the sender.

ScamAdviser

scamadviser.com

Trust score for an online shop or website, based on domain age, hosting and user reports.

SmartCustomer (formerly Sitejabber)

smartcustomer.com

Consumer reviews of websites and businesses. Victims often post there first; we used its reviews as evidence in the xmrwallet case.

Global Anti-Scam Alliance

gasa.org

Research and reports on scams across countries and platforms, from a cross-industry alliance.

Static and dynamic analysis of suspicious Android and iOS apps.

Exodus Privacy

reports.exodus-privacy.eu.org

809

Lists the trackers and permissions inside an Android app. A quick check for fake or spyware apps.

Free community feed of active phishing URLs in plain text.

PhishStats

phishstats.info

Phishing database and real-time feed running since 2014, with a free API.

Phishunt

phishunt.io

Free real-time feed of phishing domains for the last 24 hours, 7 or 30 days, in TXT, JSON or CSV.

Malware distribution URLs from abuse.ch, exported as CSV, hosts file or RPZ.

Domains, IPs, URLs and hashes tagged by malware family, with a free API.

Phishing domains and links, re-tested regularly and split into active and inactive lists.

Phishing Army

phishing.army

Ready-made Pi-hole and AdGuard blocklist built from PhishTank, OpenPhish and other sources.

Free daily list of newly registered domains. Most phishing starts on a domain that is days old.

Widely used DNS blocklists. The Threat Intelligence Feeds list targets phishing, malware and scams.

Unified hosts file that merges reputable lists, with optional extensions.

OISD

oisd.nl

Large blocklist for ads, phishing and malware, tuned for very few false positives.

DNS blocklists in Lite and Pro sizes for Pi-hole, AdGuard and RethinkDNS.

Spamhaus DROP

spamhaus.org

Don’t Route Or Peer: IP ranges hijacked or run by criminals. Safe to drop at the firewall.

FireHOL IP lists

iplists.firehol.org

3.9k

Hundreds of IP blocklists collected, deduplicated and tracked over time.

blocklist.de

blocklist.de

IP addresses caught attacking SSH, mail and web servers, reported by volunteers.

CINS Army list

cinsscore.com

IPs with a poor reputation from the Sentinel IPS network, free to download.

Emerging Threats Open

rules.emergingthreats.net

Proofpoint’s free ET Open rulesets for Suricata and Snort, plus IP blocklists.

Detects malicious traffic using dozens of public feeds and static trails. Feed collection and sensor in one.

CIRCL OSINT feed

circl.lu

CIRCL’s default OSINT feed for MISP. Enable it in a couple of clicks.

Botvrij.eu

botvrij.eu

Free IOC lists and a MISP feed from a Dutch volunteer project.

MetaMask eth-phishing-detect

MetaMask/eth-phishing-detect

1.3k

The domain blocklist MetaMask and other wallets use to stop users before a phishing page loads.

ScamSniffer database

scamsniffer/scam-database

268

Web3 blacklist of drainer domains and scam addresses.

SEAL blocklists

security-alliance/blocklists

Web3 phishing blocklists from the Security Alliance (SEAL) volunteer network.

Polkadot.js phishing

polkadot-js/phishing

208

Known scam hosts and addresses targeting Polkadot and Substrate users, with a JS checker.

IOCs posted by the infosec community on X: URLs, domains, IPs and hashes, searchable and downloadable.

AlienVault OTX

otx.alienvault.com

Open Threat Exchange: community pulses packed with IOCs, plus a free API.

Research-grade ranking of the most popular sites. Use it as an allowlist to cut false positives.

Index of free threat-intel feeds with direct links, ready for SIEM ingestion.

Large curated list of threat-intel sources, formats, frameworks and tools.

crt.sh

crt.sh

Certificate Transparency search. Finds every certificate issued for a brand name or look-alike.

Censys

platform.censys.io

Search hosts and certificates. One TLS cert often leads to dozens of related phishing domains. Free tier: 100 queries a month.

Shodan

shodan.io

Search engine for exposed servers. Map hosting clusters and find scam admin panels.

DNS history, certificates and host responses with fast pivots. Free tier for researchers.

Silent Push

silentpush.com

Infrastructure hunting focused on phishing and scam networks. Free Community Edition.

Netlas

netlas.io

Internet scan data, DNS and WHOIS in one search. A Shodan and Censys alternative with a free tier.

ZoomEye

zoomeye.ai

Search engine for internet-facing hosts and services.

FOFA

en.fofa.info

Asset search engine with strong coverage of hosting in Asia.

Hunter.how

hunter.how

Internet search engine for security researchers, with favicon and certificate pivots.

ONYPHE

onyphe.com

Search engine for exposed assets and threat data.

SecurityTrails

securitytrails.com

Historical DNS and WHOIS, reverse IP and subdomain discovery.

ViewDNS.info

viewdns.info

Reverse IP, reverse WHOIS, DNS history and a dozen other lookups on one page.

DNSDumpster

dnsdumpster.com

Maps the DNS records and subdomains of a domain and draws the hosting graph.

DomainTools WHOIS

whois.domaintools.com

WHOIS lookup with registrar, dates and name servers.

MerkleMap

merklemap.com

167

Subdomain search over CT logs, including hosts that were never linked anywhere.

Cloudflare Radar

radar.cloudflare.com

Internet traffic, outages and attack trends by country and network, domain popularity rankings, and adoption of DNSSEC, IPv6 and post-quantum TLS.

OONI Explorer

explorer.ooni.org

Open data on internet censorship: which sites and apps are blocked in which countries, measured by volunteers.

bgp.tools

bgp.tools

Turns an IP into its network: ASN, upstreams, and the hosting company to report.

Hurricane Electric BGP

bgp.he.net

Free BGP toolkit: ASN details, announced prefixes, peers and IP lookups.

IPinfo

ipinfo.io

IP location, ASN, hosting and VPN detection.

ip.thc.org

ip.thc.org

The Hacker’s Choice reverse-DNS, subdomain and CNAME database, around 5 billion domains: the largest public rDNS dataset. Temporarily unavailable when we checked on 18 Oct 2026.

Criminal IP

criminalip.io

IP and domain threat intelligence: reputation, open ports, related infrastructure.

GreyNoise

viz.greynoise.io

Tells you whether an IP is just internet background noise (scanners and bots), so you can ignore it.

Wappalyzer

wappalyzer.com

Shows the CMS, frameworks and analytics a site runs. Handy for spotting reused phishing kits.

BuiltWith

builtwith.com

Technology profile of a site plus relationship data that links sites sharing the same tracking IDs.

Calculates favicon hashes so you can find every host serving the same phishing page.

IntelligenceX

intelx.io

Search leaks, darknet sources and archived data by email, domain, URL or IP. Free tier.

Wayback Machine

web.archive.org

Archive the phishing page before it vanishes. Use Save Page Now and keep the snapshot link as evidence.

archive.today

archive.ph

Second archive for evidence. Captures pages that block the Wayback Machine.

Ghostarchive

ghostarchive.org

Free archive for web pages and social posts. We used it to save our X reports before the account was suspended.

Maltego

maltego.com

Link-analysis graphs that connect domains, emails, IPs and social accounts. Free Community edition.

Collects emails, subdomains, hosts and names from public sources.

Automated OSINT with 200+ modules for mapping a target’s footprint.

Swiss-Knife

swiss-knife.xyz

254

EVM toolbox: decode drainer calldata, inspect contracts and convert units.

Generates typo and homoglyph variants of your domain and shows which ones are registered.

Finds typosquatting and look-alike domains for your brand among daily new registrations.

Generates and tests domain typos and variations to detect typosquatting.

Domain permutation engine written in Go, in the spirit of dnstwist.

Python library that generates typo-squatting variations of a domain, from the AIL project.

Cert Spotter

sslmate.com

Watches Certificate Transparency logs and emails you when a certificate is issued for your domains.

Canarytokens

canarytokens.org

2.2k

Free “cloned website” token. You get an alert when someone copies your login page to another domain.

Scores newly issued certificates from CT logs in real time and flags likely phishing.

Self-hosted CertStream server. A live websocket feed of every new certificate.

Indicator of Kit: open rule language for fingerprinting phishing kits by their HTML and JS.

YARA rules for spotting known phishing-kit ZIP archives.

StalkPhish.io

stalkphish.io

Phishing and fraud detection API that tracks campaigns and phishing kits soon after they go live.

The pattern-matching engine behind most kit and malware detection rules.

Generic detection rules for SIEM logs. The log-side counterpart to YARA.

MISP

misp-project.org

6.6k

Open threat-intel sharing platform used by CERTs and SOCs to exchange IOCs.

Open threat-intelligence platform built on STIX 2.1, with graph views and connectors.

TheHive

strangebee.com

Case management for security incidents. Free Community edition from StrangeBee.

Runs analyzers against URLs, IPs and files at scale. Pairs with TheHive and MISP.

One API to enrich IOCs with dozens of analyzers and threat-intel sources.

Keeps observables, IOCs and TTPs in one searchable threat-intel repository.

File triage and malware analysis platform from the Canadian Centre for Cyber Security.

Endpoint forensics and incident response: query thousands of machines at once.

Wazuh

wazuh/wazuh

17.3k

Open-source SIEM and XDR for endpoint monitoring and threat detection.

Open-source SOAR for automating security workflows such as phishing triage.

CERT Polska’s framework for building distributed malware-analysis pipelines.

Blocks malvertising and malicious domains. Accepts hosts-format lists like Destroylist as custom filters.

Osprey

osprey.ac

184

Open-source extension that checks every site against several protection providers.

Netcraft Extension

netcraft.com

Blocks known phishing sites and shows hosting details and site age for the page you are on.

Malwarebytes Browser Guard

malwarebytes.com

Blocks scam pages, tech-support scams and malicious ads.

Quad9

quad9.net

Free DNS resolver that refuses to resolve known malicious domains, for every device on the network.

Cloudflare 1.1.1.1 for Families

one.one.one.one

Free DNS that blocks malware (1.1.1.2), or malware and adult content (1.1.1.3).

DNS4EU

joindns4.eu

EU-backed protective DNS, free for individuals, with malware and phishing filtering.

AdGuard DNS

adguard-dns.io

Free public DNS that blocks ads, trackers and phishing domains.

NextDNS

nextdns.io

Configurable DNS firewall with threat-intel blocklists. Free up to 300,000 queries a month.

Control D

controld.com

Free DNS resolvers that block malware, ads or adult content, no account needed.

Mullvad DNS

mullvad.net

Free encrypted DNS from Mullvad with optional ad, tracker and malware blocking.

Pi-hole

pi-hole.net

61.3k

Network-wide DNS blocking. Add Destroylist as an adlist and the whole network is covered.

AdGuard Home

adguard.com

37.5k

Self-hosted DNS filter with DoH/DoT support. Takes the same blocklists as Pi-hole.

Google Advanced Protection

landing.google.com

Google’s strongest account protection for people at high risk, built on passkeys or security keys.

YubiKey

yubico.com

Hardware security keys. FIDO2 logins cannot be phished, because the key checks the real site’s domain.

Aegis

getaegis.app

13.3k

Open-source 2FA authenticator for Android with encrypted backups.

2FAS

2fas.com

1.5k

Free open-source 2FA app for iOS and Android, with a browser extension.

Gophish

getgophish.com

14.3k

Run phishing-awareness simulations for your own team and see who clicks.

CanIPhish

caniphish.com

Phishing simulations and awareness training with a free tier.

Privacy Arsenal

phishdestroy.io/privacy-arsenal

102 privacy tools sorted by trust tier: browsers, messengers, passwords, encryption, VPN and DNS.

Rabby Wallet

rabby.io

1.9k

Simulates every transaction and warns about risky approvals before you sign.

ScamSniffer

scamsniffer.io

Browser extension that warns about drainer sites and malicious signature requests.

Pocket Universe

pocketuniverse.app

Extension that simulates transactions and flags scams before you sign. Now part of Kerberus.

Etherscan approval checker

etherscan.io

See and revoke token approvals on Ethereum directly in Etherscan.

GoPlus Security

gopluslabs.io

Free security API for tokens, addresses, approvals and dApps, used inside many wallets.

Honeypot.is

honeypot.is

Simulates a buy and a sell to catch honeypot tokens you can buy but never sell.

Token Sniffer

tokensniffer.com

Scans token contracts for scam patterns, copied code and liquidity risks.

De.Fi Scanner

de.fi

Checks a token or contract address for common exploit and rug-pull risks.

MistTrack

misttrack.io

SlowMist’s tracing tool: check an address’s risk and follow stolen funds. Free lookups.

MetaSleuth

metasleuth.io

BlockSec’s visual fund-flow tracer. The free tier is enough to map where stolen funds went.

Breadcrumbs

breadcrumbs.app

Blockchain investigation with visual graphs and address labels, free to start.

Arkham Intelligence

intel.arkm.com

Explorer with entity labels: see which exchange or service an address belongs to.

Bitquery Explorer

explorer.bitquery.io

Multi-chain explorer for transfers, tokens and DEX trades.

Chainabuse

chainabuse.com

Report scam wallet addresses and sites. Exchanges and investigators search these reports.

ChainPatrol report

app.chainpatrol.io

Report a Web3 scam link for review and takedown.

SlowMist Hacked

hacked.slowmist.io

Database of crypto hacks and exploits with dates, losses and attack methods.

Rekt News

rekt.news

Write-ups of DeFi exploits and scams, with a leaderboard of the biggest losses.

Chainalysis research

chainalysis.com

Free research on crypto crime, such as this anatomy of an address-poisoning campaign with more than 82,000 linked addresses.

DeFi Hack Explorer

phishdestroy.io/hack-wallet

Our explorer of DeFi hack incidents and the wallets involved.

Destroylist

phishdestroy/destroylist

2.1k

220k+ phishing and scam domains, updated around the clock. Plain text, JSON and DNS formats for Pi-hole, AdGuard and firewalls.

Destroy API

api.destroy.tools

REST API that scores any domain 0–100, checks up to 500 domains per request and serves full feeds.

Domain Analyzer

analyze.destroy.tools

Paste a domain and get a visual report: risk score, DNS, blocklist hits and severity breakdown.

JS Analyzer

phishdestroy.io/js-analyzer

Drop in a phishing kit or drainer script. Pulls out URLs, wallets, tokens and decoded strings, all inside your browser.

Domain reports

phishdestroy.io/domain

An evidence page for every tracked domain: captures, DNS, registrar, hosting and status history.

Live threat feed

phishdestroy.io/live

Append-only public log of every scam domain we detect, with daily counts and a JSON feed.

Phishing wallets DB

phishdestroy.io/phishing-wallet

17M+ addresses flagged for phishing and wallet draining across 19 networks.

Telegram bot

t.me/PhishDestroy_bot

Send a link and get an instant check, or report a scam straight from Telegram.