destroylist - Real-time phishing & scam domain blocklist - 205k+

项目说明

<img src=" alt="Performing Arts" width="28" height="28" /> Destroylist: Phishing & Scam Domain Blacklist

<p align="center">
<img src="scripts/destroylist_image.png" alt="Destroylist" width="100%"/>
</p>

<p align="center">
<a href="
<img src=" alt="Typing SVG"/>
</a>
</p>

<p align="center">
<img src=" alt="Rootlist"/>
<img src=" alt="On List Update"/>
<img src=" alt="Update Statistics"/>
<img src=" alt="Deploy GitHub Pages"/>
</p>

<p align="center">
<img src=" alt="Status"/>
<img src=" alt="License"/>
<img src=" alt="Contributions"/>
<img src=" alt="Last Commit"/>
<img src=" alt="Stars"/>
<img src=" alt="Forks"/>
</p>

<img src=" width="100%">

<img src=" alt="Rocket" width="22" height="22" /> Quick Start

Add to Pi-hole or AdGuard Home in one click — paste this URL into your blocklist settings:

> CDN link above is recommended — served global CDN, no rate limits.
> Raw GitHub mirror (may return 429 on hea):

> More formats: Hosts · AdBlock · Dnsmasq · Unbound · RPZ · API

<img src=" width="100%">

<img src=" alt="High " width="22" height="22" /> Quick Access

<details>
<summary><b>Table of Contents</b></summary>

</details>

Li

| Primary | Primary Live | Community | Community Live |
|:-------:|:------------:|:---------:|:--------------:|
| ![]() | ![]() | ![]() | ![]() |

Badge are exact feed-entry counts. The API reports normalized unique domains, so its can be lower after URL, www and duplicate normalization. See the machine-readable dns/metrics.json definitions.

| Primary Content | Community Content |
|:---------------:|:-----------------:|
| ![]() | ![]() |

| | Today | Week | Month |
|:--|:-----:|:----:|:-----:|
| Primary | ![]() | ![]() | ![]() |
| Community | ![]() | ![]() | ![]() |

<img src=" alt="File Folder" width="22" height="22" /> Data Feeds

| Feed | Description | Update | Download |
|:-----|:------------|:------:|:--------:|
| Primary | Curated phishing domains | ⚡ Real-time | ![JSON]() ![TXT]() |
| Primary Live | DNS active | 🕐 24h | ![JSON]() ![TXT]() |
| Community | Aggregated from 13+ sources | 🕐 2h | ![JSON]() ![TXT]() |
| Community Live | Community DNS | 🕐 24h | ![JSON]() ![TXT]() |
| Primary Content | Curated + HTTP content | 🕐 12h | ![JSON]() ![TXT]() |
| Community Content | Aggregated + HTTP content | 🕐 24h | ![JSON]() ![TXT]() |
| Allowlist | False positi | ✋ Manual | ![JSON]() |

> [!TIP]
> Production: list.json or acti.json · Max co: blocklist.json · Firewall/DNS: root lists

<details>
<summary>📁 <b>All Download Formats</b> (TXT, Hosts, AdBlock, Dnsmasq, Unbound, RPZ)</summary>
<br>

> Getting 429 errors? Use the jsDelivr CDN links below — they bypass GitHub rate limits.

CDN (recommended, no rate limits):

| Format | Primary | Primary Live | Community | Community Live |
|:------:|:-------:|:------------:|:---------:|:--------------:|
| TXT | ⬇️ | ⬇️ | ⬇️ | ⬇️ |
| Hosts | ⬇️ | ⬇️ | ⬇️ | ⬇️ |
| AdBlock | ⬇️ | ⬇️ | ⬇️ | ⬇️ |
| Dnsmasq | ⬇️ | ⬇️ | ⬇️ | ⬇️ |
| Unbound | ⬇️ | ⬇️ | ⬇️ | ⬇️ |
| RPZ | ⬇️ | ⬇️ | ⬇️ | ⬇️ |
| Redis | ⬇️ | ⬇️ | ⬇️ | ⬇️ |

> Redis one-liner — load the full list into a Redis set (atomic swap, zero-downtime reload):
>
> Then check any domain in O(1): SISMEMBER destroylist:primary e.com

<details>
<summary>Via raw.githubusercontent.com (may return 429 under hea)</summary>

| Format | Primary | Primary Live | Community | Community Live |
|:------:|:-------:|:------------:|:---------:|:--------------:|
| TXT | ⬇️ | ⬇️ | ⬇️ | ⬇️ |
| Hosts | ⬇️ | ⬇️ | ⬇️ | ⬇️ |
| AdBlock | ⬇️ | ⬇️ | ⬇️ | ⬇️ |
| Dnsmasq | ⬇️ | ⬇️ | ⬇️ | ⬇️ |
| Unbound | ⬇️ | ⬇️ | ⬇️ | ⬇️ |
| RPZ | ⬇️ | ⬇️ | ⬇️ | ⬇️ |

</details>

> Hosts → Pi-hole, /etc/hosts, Windows · AdBlock → uBlock Origin, AdGuard · Dnsmasq → dnsmasq DNS · Unbound → pfSense, OPNsense · RPZ → BIND, Knot DNS · Redis → redis-cli --pipe bulk load

</details>

<img src=" alt="Laptop" width="22" height="22" /> Root Lists

> [!TIP]
> Root domains only — no subdomains, hosting pro excluded

| | All Roots | Live Only | Services Only |
|:--|:-:|:-:|:-:|
| 🔴 Primary | JSON · TXT | JSON · TXT | JSON · TXT |
| ⚫ Community | JSON · TXT | JSON · TXT | JSON · TXT |

> All Roots — clean root domains (no infra) · Live Only — DNS- active · Services Only — hosting platform subdomains (, Pages.de, etc.)

<img src=" width="100%">

<img src=" /> Content- Feeds <img src=" />

> [!NOTE]
> Real HTTP content — not just DNS, but actual phishing page detection

![Primary Content]()
![Community Content]()

| Feed | Update | Description |
|:-----|:------:|:------------|
| Primary Content | 12h (06:00 / 18:00 UTC) | Curated phishing with acti |
| Community Content | 24h (03:00 UTC) | Aggregated feeds with acti |

> Download links: see Data Feeds above

> [!WARNING]
> Cloaking Alert: Scammers use cloaking to hide phishing from bots — showing blank/fake pages to scanners. Domain NOT in content list ≠ safe! Use Primary or Community full lists for complete protection.

<img src=" width="100%">

<img src=" width="25" height="25" /> Threat Intelligence API

<p align="center">
<img src="scripts/api.png" alt="API" width="700"/>
</p>

<p align="center">
<a href=" src=" alt="API"/></a>
<a href=" src=" alt="Stats"/></a>
</p>

> Free, open, no API key. Real-time domain risk scoring (0-100) across the Primary and Community datasets · scheduled sync · Single & bulk check (500/req) · Keyword search · Full feeds

<details>
<summary>📖 <b>API Endpoints, Scoring & Integration Examples</b></summary>
<br>

Endpoints

| Method | Endpoint | Description |
|:------:|:---------|:------------|
| GET | /v1/check?domain= | Single domain check with risk score & se |
| POST | /v1/check/bulk | Bulk check up to 500 domains per request |
| GET | /v1/search?q= | Search blocklisted domains by keyword |
| GET | /v1/feed/{list} | Download full domain feeds (primary, community, active) |
| GET | /v1/stats | Li & domain counts |

Threat Scoring

Every domain gets a risk score (0-100) based on multiple signals:

| Signal | Points | Description |
|:-------|:------:|:------------|
| Curated blocklist | +40 | In primary destroylist |
| Community reported | +20 | Reported by community sources |
| DNS active | +30 | Domain currently resolves |
| Multi-source | +10 | Confirmed by multiple feeds |
| Suspicious keywords | +5 each | metamask, wallet, airdrop, etc. |
| Risky TLD | +5 | .xyz, .top, .club, .icu, etc. |

> 🔴 Critical 70-100 · 🟠 High 40-69 · 🟡 Medium 20-39 · 🟢 Low 1-19

Quick Integration

cURL

Python

Ja

Bulk Check

</details>

<img src=" width="100%">

<img src=" alt="Telescope" width="22" height="22" /> About Destroylist

> [!NOTE]
> Live data collection began on July 1, 2025

<di="center">

Live feed counts above · 13+ threat sources · 50+ reports · 6 output formats · Free API

</div>

Destroylist is a real-time threat intelligence platform by PhishDestroy — protecting firewalls, DNS resolvers, browser extensions, and security teams worldwide. Every domain is discovered, , reported to registrars, and published transparently.

Data Pipeline

<details>
<summary>🔧 <b>Quick Integration Examples</b> (Subscribe URLs · curl · Python · Bash)</summary>
<br>

One-Click Subscribe URLs

| Tool | Format | URL |
|:-----|:------:|:----|
| Pi-hole | Hosts | |
| AdGuard Home | AdBlock | |
| uBlock Origin | AdBlock | |
| pfSense / OPNsense (Unbound) | Unbound | |
| BIND / Knot DNS (RPZ) | RPZ | |
| Dnsmasq | Dnsmasq | |

> Pi-hole — Settings > Blocklists > paste the Hosts URL<br>
> AdGuard Home — Filters > DNS Blocklists > Add blocklist > paste the AdBlock URL<br>
> uBlock Origin — Settings > Filter lists > Import > paste the AdBlock URL<br>
> pfSense — Services > DNS Resolver > paste the Unbound URL<br>
> BIND/Knot — Add the RPZ URL as a response-policy zone

curl One-Liners

Python

Bash

</details>

<img src=" width="100%">

<img src=" alt="Shield" width="22" height="22" /> Threat Intelligence & Automated Remediation Workflow

<p align="center">
<img src="scripts/about.png" alt="Workflow" width="700"/>
</p>

<di="center">

| 🔍 DISCOVER | 📤 REPORT | ⚖️ LEGAL | 📡 PUBLISH |
|:---:|:---:|:---:|:---:|
| 30+ parsers | 50+ | ICANN compliance | Real-time |
| CT logs, DNS | Google, Microsoft | Abuse notifications | GitHub,
| Social media | , Cloudflare | E packages | Twitter, Mastodon |

</div>

<details>
<summary>📖 <b>Read Full Workflow Details</b></summary>
<br>

🔍 Phase 1: Pre-empti & Ingestion

🔎 We utilize a distributed network of 30+ proprietary parsers to identify malicious domains at their earliest stage:

---

📤 Phase 2: Global Ecosystem Contribution

Once a threat is confirmed, we submit data to over 50 industry-leading :

---

📝 Phase 3: Legal Notifications & In Support

---

📢 Phase 4: Public Transparency & Community Alerts

</details>

<img src=" width="100%">

<img src=" alt="Police Car" width="22" height="22" /> Key Info for Online Fraud

<p align="center">
<img src="scripts/abuse.png" alt="Abuse Process" width="700"/>
</p>

<details>
<summary><b>Show details about complaints and transparency</b></summary>
<br>

💼 DestroyList aims to disable malicious domains: scams, phishing, and other illicit sites to enhance internet safety.

Before a domain is added, we:

🔍 Scan it across cybersecurity platforms for threat intelligence.

📥 Send an official complaint to the registrar and the hosting provider (), including scan results, screenshots, and a request for client in. The complaint also notifies them about inclusion in our public database.

🚔 According to ICANN rules, registrars must review such complaints within 24 hours.

---

🦖 We work hard to eliminate threats quickly. Every malicious domain is analyzed, documented, reported, and published transparently.

However, when a domain receives 10–30+ abuse reports and a registrar still ignores them for months, the situation changes: the registrar is no longer a passi. It effectively provides infrastructure for illegal activity.

Some registrars behave as if their internal policies somehow o ICANN requirements and national laws — as if phishing and fraud are "allowed" as long as they personally decide not to act.

👮 We document this publicly so that anyone can see: threats persist not because they were unnoticed, but because the responsible pro simply chose to do nothing.

---

Requests from private indi:

DestroyList is an open-source, non-commercial project.

Private indi may request the number of abuse reports we have sent for a specific domain, but only through public channels:

❗ We do not respond to private e-mail requests from indi about report counts.

✔️ This is a legal requirement for transparency and equal access to information.

Official go or law-enforcement requests may be answered pri.

---

💔 If you were defrauded by a domain already listed here, check its addition date using the commit history or via our

💬 If the fraud happened after the domain was already listed, the registrar's or host's delay may indicate they share responsibility for the loss. Future potential can also see this negligence documented publicly.

🔞 Registrars and hosts that tolerate scam operations may reasonably be expected to assist or their legal representatives.

</details>

<img src=" width="100%">

<img src=" alt="Bar Chart" width="22" height="22" /> Use Cases & Historical Vault

Network security · Threat research · AI/ML training · Trend analysis · Automation

Point-in-time history — every state of the list is reconstructable:

| Granularity | Where | Retention |
|:---|:---|:---|
| Every change | Commit history | Forever (41,000+ commits) |
| Daily added/remo | changes/ | Forever, searchable in GitHub code search |
| Weekly & monthly full snapshots | archives/ → Release assets | Recent in tree, older rotated to the permanent Release |

> [!TIP]
> 📩 Historical Vault (500K+ domains, 5+ years archived):

<img src=" width="100%">

<img src=" alt="Magic Wand" width="22" height="22" /> Appeals Process

<p align="center">
<img src="scripts/appeal.png" alt="Appeals" width="700"/>
</p>

Wrongly listed? Fix it fast:

| ![Appeals Form]() | ![GitHub Issue]() |
|:---:|:---:|

Accuracy first! 🔭

<img src=" width="100%">

<a name="-connect-with-us"></a><img src=" width="25" height="25" /> Connect With Us

<p align="center">
<a href=" src=" alt="Website"/></a>
<a href=" src=" alt="Medium"/></a>
<a href=""><img src=" alt="
<a href=""><img src=" alt="Bot"/></a>
<a href=" src=" alt="Twitter"/></a>
<a href=" src=" alt="Mastodon"/></a>
</p>

<p align="center">
<a href=" src=" alt="API"/></a>
<a href=" src=" alt="Ban Service"/></a>
<a href="mailto:"><img src=" alt="Email"/></a>
</p>

<img src=" width="100%">

👾 Pac-Man Contribution Graph

<picture>
<source media="(prefers-color-scheme: dark)" srcset=" />
<source media="(prefers-color-scheme: light)" srcset=" />
<img alt="pacman-contribution-graph" src=" width="100%" />
</picture>

<img src=" width="100%">

🔗 Related In & Repositories

| Repository | Description |
|:-----------|:------------|
| namesilo-e | E archive — NameSilo registrar abuse in |
| nicenic-e | E archive — NiceNIC registrar abuse in |
| trustname-e | E archive — TrustName registrar abuse in |
| ScamIntelLogs | Raw scam intelligence logs and IOC data |
| DestroyScammers | Scammer exposure and disruption operations |

<img src=" width="100%">

📄 License

!License

MIT — Free, open, yours to use!

<img src=" width="100%">

<img src=" alt="Handshake" width="22" height="22" /> Join the Fight!

<di="center">

Every star helps this project reach more security teams and protect more users.

![Star this repo]()
![Open an Issue]()
![Submit a PR]()

</div>

We welcome contributions:

Drop an Issue or PR — let's crush phishing together! 💪

项目信息

开发语言：HTML

Star 数：1902

技术要点

该项目属于病毒分析方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Real-time phishing & scam domain blocklist - 205k+ curated threats, 1M+ community, free API, multiple formats展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。