destroylist

Destroylist: Phishing & Scam Domain Blacklist

Destroyolist Illustration

Quick Overview & Access

Project Status

Last Commit Stars

Statistics

Primary	Primary Live	Community	Community Live

	Today	Week	Month
Primary
Community

Data Feeds

Feed	Description	Update
list.json / .txt	Primary curated phishing domains	Real-time
active_domains.json	Primary DNS verified	24h
blocklist.json	Community aggregated	2h
live_blocklist.json	Community DNS verified	24h
allowlist.json	False positive protection	Manual

Download Formats

Format	Primary	Primary Live	Community	Community Live
TXT	⬇	⬇	⬇	⬇
Hosts	⬇	⬇	⬇	⬇
AdBlock	⬇	⬇	⬇	⬇
Dnsmasq	⬇	⬇	⬇	⬇

Hosts — Pi-hole, /etc/hosts, Windows · AdBlock — uBlock Origin, AdGuard · Dnsmasq — DNS server

Root Lists

Root domains only (no subdomains), hosting providers excluded

Source	All Roots	Live Only
Primary	active_root_domains.json	online_root_domains.json
Community	community_root_domains.json	community_online_root_domains.json

💡 Production: list.json or active_domains.json · Max coverage: blocklist.json · Firewall/DNS: root lists

Connect With Us

About Destroylist

Live data collection began on July 1, 2025

Destroylist is a powerful tool against phishing and scams, powered by PhishDestroy. It provides reliable intel for:

Firewalls
DNS resolvers
Threat platforms
Security research

Protect the web, one domain at a time!

Quick Integration

Python

import requests
blocklist = requests.get('https://raw.githubusercontent.com/phishdestroy/destroylist/main/list.json').json()
is_malicious = "suspicious-domain.com" in blocklist

Bash

curl -s https://raw.githubusercontent.com/phishdestroy/destroylist/main/list.txt | grep -q "suspicious-domain.com" && echo "BLOCKED"

DNS Blocklist (Pi-hole/AdGuard)

https://raw.githubusercontent.com/phishdestroy/destroylist/main/dns/active_domains.json

Key Info for Online Fraud Victims

DestroyList Banner

DestroyList aims to disable malicious domains: scams, phishing, and other illicit sites to enhance internet safety.

Before a domain is added, we:

Scan it across cybersecurity platforms for threat intelligence.

Send an official complaint to the registrar and the hosting provider (via WHOIS), including scan results, screenshots, and a request for client investigation. The complaint also notifies them about inclusion in our public database.

According to ICANN rules, registrars must review such complaints within 24 hours.

We work hard to eliminate threats quickly. Every malicious domain is analyzed, documented, reported, and published transparently.
However, when a domain receives 10–30+ abuse reports and a registrar still ignores them for months, the situation changes: the registrar is no longer a passive party. It effectively provides infrastructure for illegal activity.
Some registrars behave as if their internal policies somehow override ICANN requirements and national laws — as if phishing and fraud are “allowed” as long as they personally decide not to act.

We document this publicly so that anyone can see: threats persist not because they were unnoticed, but because the responsible providers simply chose to do nothing.

Requests from private individuals:

DestroyList is an open-source, non-commercial volunteer project.

Private individuals may request the number of abuse reports we have sent for a specific domain, but only through public channels:

via GitHub issues
via commit history: https://github.com/phishdestroy/destroylist/commits/main/

We do not respond to private e-mail requests from individuals about report counts.
This is a legal requirement for transparency and equal access to information.

Official government or law-enforcement requests may be answered privately.

If you were defrauded by a domain already listed here, check its addition date using the commit history or via our Telegram/Mastodon channels.

If the fraud happened after the domain was already listed, the registrar’s or host’s delay may indicate they share responsibility for the loss.
Future potential victims can also see this negligence documented publicly.