Destroylist
Every confirmed domain, published openly and updated around the clock. 220K+ entries.
Inside PhishDestroy · since 2019
Anatomy of a takedown
How a phishing domain goes from first report to offline in minutes: where we find it, how we confirm it, what we keep as evidence, who we notify, and how we make sure it stays down.
Listen to this article
0:00 / --:--
- 500K+
- domains disrupted since 2019
- <0.5%
- false positives across 100K+ reports
- 50+
- vendors and feeds act on our reports
- minutes
- to take a site down, down from weeks
The process
Five steps from report to removal
The same pipeline handles a single report or thousands a day. Nothing is reported before it is verified and captured.
Step 01
Detect
Leads come from three directions: people who report links to our Telegram bot, our own parsers that watch search ads and new domains, and feeds shared by partners and researchers.
Step 02
Verify
Nothing is reported until it is confirmed. Analysts and automated checks look at the page, the payload and the targeting. False positives stay under 0.5% across 100,000+ validated reports. Contributors with 100+ accurate reports get trusted status and skip moderation.
Step 03
Preserve
Before the report goes out, the site is captured: HTML, screenshots, network calls and JavaScript payloads, through urlscan.io, the Wayback Machine and our own snapshots. Scammers delete their traces. We keep copies.
Step 04
Report
Reports go to the registrar, the host and more than 50 antivirus vendors and threat-intel platforms that recognise our submissions. A confirmed phishing site can be offline within minutes. Cases with attribution or money trails go to law enforcement or CERT teams as full evidence packages.
Step 05
Monitor
A takedown is not finished when the abuse desk replies. We keep checking until the site is offline and stays offline, and re-check removed domains so resurfacing infrastructure is caught within hours.
Speed
From weeks to minutes
When PhishDestroy started, taking down one malicious domain could take weeks. The same takedown now often takes minutes.
Most of that comes from two things: tooling we keep improving, and the reputation behind our reports. We have focused on phishing and almost nothing else since 2019, which kept the false-positive rate low and earned the trust of the companies that act on what we send.
2019weeks
Todayminutes
Detection
Where threats surface
Phishing rarely hides. It has to advertise to reach victims, and that is where we catch it.
Community reports
People send links to @PhishDestroy_bot on Telegram. It is our main public intake. @PhishDestroy_bot
Search and ad parsers
Custom parsers watch Google Ads, Bing and Yandex sponsored results for wallet, exchange and bridge keywords, so a scam is caught when it first pays for placement.
Partner feeds
Threat-intelligence feeds shared with us by partners and independent researchers.
Honeypots and canaries
Honeypot networks and seed-phrase canary tokens alert us the moment scammers try to use stolen data.
WHOIS and certificate logs
Monitoring of new registrations and Certificate Transparency for look-alike domains aimed at protected brands.
Evidence
A public record they cannot delete
Every operation leaves a trail that supports attribution and prosecution long after the domain is gone.
Registrars
Allies and enablers
How fast a takedown happens depends on the registrar and the host. Our data splits them into two groups.
Act within hours
- Namecheap24/7 abuse team; 30,000+ malicious domains removed together
- GoDaddyacts within hours of a verified report
- Hostingeracts within hours of a verified report
- Squarespaceacts within hours of a verified report
- IONOSacts within hours of a verified report
Ignore abuse reports
- NiceNicrepeatedly ignores abuse reports
- Cosmotownrepeatedly ignores abuse reports
- NameSilorepeatedly ignores abuse reports
- Webnicrepeatedly ignores abuse reports
In practice this makes them safe havens for scam operations.
Pushback
When it hurts, they hit back
We read organised backlash as confirmation that the takedowns cost scammers money.
DDoS attacks
Attacks on our infrastructure, absorbed by Cloudflare.
Paid smear campaigns
Coordinated PR placements against us.
Mass-reporting
Organised reporting of our social accounts to get them shut down.
X account suspended
Our account with 140,000+ documented reports was suspended after registrar pressure.
Who we are
Legal status and coordination
Our job is to document and dismantle malicious operations, then support the people with legal authority to act on the evidence.
Operator collective
Non-profit. Not a company or legal entity, with no ties to any government.
Public by default
Reports and evidence are published on GitHub, Telegram and Mastodon. Nothing is held back.
Evidence to authorities
In major cases we hand full evidence packages to law enforcement or CERT teams, only when the intelligence is verified and actionable.
No personal data
We store no personal data about contributors. That protects whistleblowers, and leaves nothing to leak.
By the numbers
What the pipeline has done
- 500K+
- phishing and scam domains disrupted since 2019
- 220K+
- domains in Destroylist right now
- 50+
- antivirus vendors and threat-intel platforms receive our data
- 30K+
- domains removed with Namecheap alone
- <0.5%
- false-positive rate
- 100K+
- validated reports behind that rate
- 140K+
- reports archived after the X suspension
- 888K+
- community subscribers across our feeds
Join in
How you can help
Every takedown on this page started with a report. Collective action is the strongest defence we have.
Report in Telegram
Send a suspicious link to the bot and get an instant check.
@PhishDestroy_botReport on the site
Use the form if you have more context: screenshots, wallets, how you found it.
Open the formGet alerts
New takedowns and campaigns, posted as they happen.
@PhishDestroyAlertsBlock with Destroylist
Add the list to your DNS filter, firewall or security stack.
Get the listKeep reading
Related investigations
Investigation$0 Takedowns: how we disrupt phishing infrastructure
MetricsImpact metrics: 500K+ phishing threats neutralised
InvestigationNameSilo, Webnic, NiceNic: registrars enabling scams
ToolkitTools for fighting phishing: 225 tools, checked and linked
PhishDestroy is a non-commercial, independent project, and our research may carry a bias against scam infrastructure and the services that enable it. Read it critically. Transparency statement · Blog archive