Destroylist: Phishing & Scam Domain Blacklist

Quick Start

Add to Pi-hole or AdGuard Home in one click — paste this URL into your blocklist settings:

https://cdn.jsdelivr.net/gh/phishdestroy/destroylist@main/rootlist/formats/primary_active/hosts.txt

> CDN link above is recommended — served via jsDelivr global CDN, no rate limits.
> Raw GitHub mirror (may return 429 on heavy traffic): https://raw.githubusercontent.com/phishdestroy/destroylist/main/rootlist/formats/primary_active/hosts.txt

> More formats: Hosts · AdBlock · Dnsmasq · Unbound · RPZ · API

Quick Access

Live Statistics

| Primary | Primary Live | Community | Community Live |
|:-------:|:------------:|:---------:|:--------------:|
|  |  |  |  |

| Primary Content | Community Content |
|:---------------:|:-----------------:|
|  |  |

| | Today | Week | Month |
|:--|:-----:|:----:|:-----:|
| Primary |  |  |  |
| Community |  |  |  |

Data Feeds

| Feed | Description | Update | Download |
|:-----|:------------|:------:|:--------:|
| Primary | Curated phishing domains | ⚡ Real-time |   |
| Primary Live | DNS verified active | 🕐 24h |   |
| Community | Aggregated from 13+ sources | 🕐 2h |   |
| Community Live | Community DNS verified | 🕐 24h |   |
| Primary Content | Curated + HTTP content verified | 🕐 12h |   |
| Community Content | Aggregated + HTTP content verified | 🕐 24h |   |
| Allowlist | False positive protection | ✋ Manual |  |

> [!TIP]
> Production: list.json or active_domains.json · Max coverage: blocklist.json · Firewall/DNS: root lists

> curl -s https://cdn.jsdelivr.net/gh/phishdestroy/destroylist@main/rootlist/formats/primary/redis.txt | redis-cli --pipe
>

Root Lists

> [!TIP]
> Root domains only — no subdomains, hosting providers excluded

| | All Roots | Live Only | Services Only |
|:--|:-:|:-:|:-:|
| 🔴 Primary | JSON · TXT | JSON · TXT | JSON · TXT |
| ⚫ Community | JSON · TXT | JSON · TXT | JSON · TXT |

> All Roots — clean root domains (no infra) · Live Only — DNS-verified active · Services Only — hosting platform subdomains (Vercel, Pages.dev, Netlify, etc.)

Content-Verified Feeds

> [!NOTE]
> Real HTTP content verification — not just DNS, but actual phishing page detection


| Feed | Update | Description |
|:-----|:------:|:------------|
| Primary Content | 12h (06:00 / 18:00 UTC) | Curated phishing with verified active content |
| Community Content | 24h (03:00 UTC) | Aggregated feeds with verified active content |

> Download links: see Data Feeds above

> [!WARNING]
> Cloaking Alert: Scammers use cloaking to hide phishing from bots — showing blank/fake pages to scanners. Domain NOT in content list ≠ safe! Use Primary or Community full lists for complete protection.

Threat Intelligence API

%%{init: {"theme":"base", "themeVariables": { "background": "transparent", "mainBkg": "#000000", "primaryColor": "#000000", "primaryTextColor": "#FFFFFF", "primaryBorderColor": "#FF0000", "lineColor": "#FF0000", "secondaryColor": "#111111", "tertiaryColor": "#111111", "fontFamily": "Inter, system-ui, sans-serif"}, "flowchart": {"curve": "basis", "htmlLabels": true}}}%%
flowchart LR
  Request["🌐 Client Request<br/>(Single / Bulk)"] e1@--> API["⚡ Live API<br/>api.destroy.tools"]
  API e2@--> Engine["🧠 Threat Engine<br/>(Risk Score 0-100)"]
  Engine e3@--> DB[("🗄️ Destroylist DB<br/>1M+ Threats")]
  DB e4@--> Engine
  Engine e5@--> Response["📋 JSON Response<br/>(Severity & Status)"]

  classDef client fill:#000000,stroke:#333333,stroke-width:2px,color:#FFFFFF;
  classDef api fill:#000000,stroke:#FF0000,stroke-width:2px,color:#FFFFFF;
  classDef db fill:#000000,stroke:#333333,stroke-width:2px,stroke-dasharray: 5 5,color:#FFFFFF;
  classDef animate stroke:#FF0000,stroke-width:2px,stroke-dasharray:10 5,stroke-dashoffset:900,animation:dash 22s linear infinite;
  classDef animateDark stroke:#333333,stroke-width:2px,stroke-dasharray:10 5,stroke-dashoffset:900,animation:dash 22s linear infinite;

  class Request client;
  class API,Engine,Response api;
  class DB db;
  class e1,e2,e3,e5 animate;
  class e4 animateDark;

> Free, open, no API key. Real-time domain risk scoring (0-100) across 888K+ threats · 2h sync · Single & bulk check (500/req) · Keyword search · Full feeds

curl "https://api.destroy.tools/v1/check?domain=suspicious-site.xyz"

import requests
r = requests.get(f"https://api.destroy.tools/v1/check?domain={domain}")
if r.json()["threat"]:
    print(f"BLOCKED: {r.json()['severity']} (score: {r.json()['risk_score']})")

const r = await fetch(`https://api.destroy.tools/v1/check?domain=${domain}`);
const data = await r.json();
if (data.threat) console.warn("PHISHING:", data.severity, data.risk_score);

curl -X POST "https://api.destroy.tools/v1/check/bulk" 
  -H "Content-Type: application/json" 
  -d '{"domains":["site1.com","site2.xyz","site3.top"]}'

About Destroylist

> [!NOTE]
> Live data collection began on July 1, 2025

Destroylist is a real-time threat intelligence platform by PhishDestroy — protecting firewalls, DNS resolvers, browser extensions, and security teams worldwide. Every domain is discovered, verified, reported to registrars, and published transparently.

Data Pipeline

%%{init: {"theme":"base", "themeVariables": { "background": "transparent", "mainBkg": "#000000", "primaryColor": "#000000", "primaryTextColor": "#FFFFFF", "primaryBorderColor": "#FF0000", "lineColor": "#FF0000", "secondaryColor": "#111111", "tertiaryColor": "#111111", "fontFamily": "Inter, system-ui, sans-serif"}, "flowchart": {"curve": "basis", "htmlLabels": true}}}%%
flowchart TB
  subgraph Sources["🔍 Threat Sources"]
    S1[30+ Parsers]
    S2[Community Feeds]
    S3[Telegram Bot]
    S4[CT Logs / DNS]
  end

  subgraph Ingestion["📥 Ingestion"]
    I1[smart_aggregator.py]
    I2[validate_and_clean.py]
  end

  subgraph Enrichment["🧠 Enrichment"]
    E1[DNS Validation]
    E2[HTTP Content Check]
    E3[VirusTotal / GSB]
  end

  subgraph Distribution["📡 Distribution"]
    D1[JSON / TXT]
    D2[Hosts / AdBlock]
    D3[RPZ / Unbound]
    D4[API Feed]
  end

  Sources --> Ingestion
  Ingestion --> Enrichment
  Enrichment --> Distribution

  classDef source fill:#000000,stroke:#333333,stroke-width:2px,color:#FFFFFF;
  classDef ingest fill:#000000,stroke:#FF0000,stroke-width:2px,color:#FFFFFF;
  classDef enrich fill:#000000,stroke:#CC0000,stroke-width:2px,color:#FFFFFF;
  classDef dist fill:#000000,stroke:#FF0000,stroke-width:2px,stroke-dasharray: 5 5,color:#FFFFFF;

  class S1,S2,S3,S4 source;
  class I1,I2 ingest;
  class E1,E2,E3 enrich;
  class D1,D2,D3,D4 dist;

# Plain domain list
curl -fsSL https://raw.githubusercontent.com/phishdestroy/destroylist/main/rootlist/formats/primary_active/domains.txt -o domains.txt

# Hosts format (Pi-hole, /etc/hosts)
curl -fsSL https://raw.githubusercontent.com/phishdestroy/destroylist/main/rootlist/formats/primary_active/hosts.txt -o hosts_blocklist.txt

# AdBlock format (uBlock Origin, AdGuard)
curl -fsSL https://raw.githubusercontent.com/phishdestroy/destroylist/main/rootlist/formats/primary_active/adblock.txt -o adblock.txt

# Dnsmasq
curl -fsSL https://raw.githubusercontent.com/phishdestroy/destroylist/main/rootlist/formats/primary_active/dnsmasq.conf -o dnsmasq_blocklist.conf

# Unbound (pfSense / OPNsense)
curl -fsSL https://raw.githubusercontent.com/phishdestroy/destroylist/main/rootlist/formats/primary_active/unbound.conf -o unbound_blocklist.conf

# RPZ (BIND / Knot)
curl -fsSL https://raw.githubusercontent.com/phishdestroy/destroylist/main/rootlist/formats/primary_active/rpz.zone -o rpz_blocklist.zone

import requests
blocklist = requests.get('https://raw.githubusercontent.com/phishdestroy/destroylist/main/list.json').json()
is_malicious = "suspicious-domain.com" in blocklist

curl -s https://raw.githubusercontent.com/phishdestroy/destroylist/main/list.txt | grep -q "suspicious-domain.com" && echo "BLOCKED"

Threat Intelligence & Automated Remediation Workflow

%%{init: {"theme":"base", "themeVariables": { "background": "transparent", "mainBkg": "#000000", "primaryColor": "#000000", "primaryTextColor": "#FFFFFF", "primaryBorderColor": "#FF0000", "lineColor": "#FF0000", "secondaryColor": "#111111", "tertiaryColor": "#111111", "fontFamily": "Inter, system-ui, sans-serif"}, "flowchart": {"curve": "basis", "htmlLabels": true}}}%%
flowchart LR
  Discover["🔍 DISCOVER<br/>30+ Parsers"] e1@--> Report["📤 REPORT<br/>50+ Vendors"]
  Report e2@--> Legal["⚖️ LEGAL<br/>ICANN Compliance"]
  Legal e3@--> Publish["📡 PUBLISH<br/>Real-time Feed"]

  classDef box fill:#000000,stroke:#333333,stroke-width:2px,color:#FFFFFF;
  classDef animate stroke:#FF0000,stroke-width:2px,stroke-dasharray:10 5,stroke-dashoffset:900,animation:dash 22s linear infinite;

  class Discover,Report,Legal,Publish box;
  
  class e1,e2,e3 animate;

Cloudflare        Google Safe Browsing      Microsoft Security      VirusTotal
Netcraft          ESET                      Bitdefender             Norton Safe Web
Avira             PhishTank                 Dr.Web                  Yandex Safe Browsing
URLScan.io        PolySwarm                 SiteReview              Urlquery
PhishStats        PhishReport               IsItPhish               ThreatCenter

Key Info for Online Fraud Victims

Use Cases & Historical Vault

Network security · Threat research · AI/ML training · Trend analysis · Automation

Point-in-time history — every state of the list is reconstructable:

| Granularity | Where | Retention |
|:---|:---|:---|
| Every change | Commit history | Forever (41,000+ commits) |
| Daily added/removed diffs | <code class="ra0-md-code">changes/</code> | Forever, searchable in GitHub code search |
| Weekly & monthly full snapshots | <code class="ra0-md-code">archives/</code> → Release assets | Recent in tree, older rotated to the permanent Release |

> [!TIP]
> 📩 Historical Vault (500K+ domains, 5+ years archived): contact@phishdestroy.io

Appeals Process

Wrongly listed? Fix it fast:

|  |  |
|:---:|:---:|

• ✔️ Appeals Form — fastest option
• ✔️ GitHub Issue with proof

Accuracy first! 🔭

Connect With Us

👾 Pac-Man Contribution Graph

🔗 Related Investigations & Repositories

| Repository | Description |
|:-----------|:------------|
| namesilo-evidence | Evidence archive — NameSilo registrar abuse investigation |
| nicenic-evidence | Evidence archive — NiceNIC registrar abuse investigation |
| trustname-evidence | Evidence archive — TrustName registrar abuse investigation |
| ScamIntelLogs | Raw scam intelligence logs and IOC data |
| DestroyScammers | Scammer exposure and disruption operations |

📄 License

!License

MIT — Free, open, yours to use!

Join the Fight!

We welcome contributions:

• 🔍 Fresh threat intelligence & new blocklist sources
• 💡 Detection algorithm improvements
• 📢 Integration guides for new platforms
• 🌐 Translations & documentation

Drop an Issue or PR — let's crush phishing together! 💪