A domain is a starting point. We follow the certificates, infrastructure, code and money around it.

• Certificate Transparency (CT) logs: watch certificate records for new domains, related hostnames and recurring naming patterns.
• Passive DNS: trace historical IP addresses, nameservers and DNS changes to follow infrastructure as it moves.
• Hosting & ASN correlation: compare network ranges, hosting providers and registration history to map related infrastructure.
• YARA & phishing-kit fingerprints: match recurring code and artifacts across captured pages, phishing kits and malware samples.
• On-chain transaction analysis: follow wallet addresses and transaction flows to investigate reported theft, drainer activity and connections between cases.
• Malware reverse engineering: inspect scripts, APKs and malware samples to understand their behavior and extract indicators for further investigation.

Registrars say they don't allow scams. Hosts say the same. Yet some of these sites steal for years. So what happened to the complaints?

Often the report didn't show the scam. Cloaking served scanners a harmless page, so we showed what the victim sees: screenshots, archives, even video. Every scam that survives has a reason. We find it, fill the gap in the evidence, report again and log the response.

Scams are against everyone's rules. When the evidence arrives, that should mean something.

We've investigated operations where every site was already gone: no scan, no archive, nothing showing what the domain did. A dead link proves nothing.

So we capture while there's something to capture. Months later an investigator or regulator may need exactly that page. That's also why the database is on GitHub: what we found, when we reported it, and where we might be wrong, all public.

We don't have a “delete” button. When a registrar suspends a domain, that's their call. When another researcher cracks a case, that's their work. We don't need the score.

We want scammers losing time and money. Domains that once ran for years now get replaced in days or hours. That's the whole field's work, and we're part of it.

PhishDestroy is unpaid and non-commercial. No money, no obligations, nothing to gain from any particular ban or verdict.

No sympathy for phishing crews, drainer operators, or “affiliates” sending victims into scams. Whatever you call it, you're helping steal.

A scam losing its domain, its traffic or its cash-out route is exactly what we're working for.

But hacked sites are victims too, and our data can be wrong. That's why it's public and why appeals exist. Listed by mistake? We fix it and say sorry.

We've seen AI recommend scam sites. One was xmrwallet[.]com, a wallet scam running since 2016. A decade online, and a model still sent people there.

So we're building records AI can use: IOCs, fingerprints, recurring patterns, scans, archives, and how each scam works. A new domain shouldn't make the same operation unrecognizable.

The goal: a model checks before it recommends, and warns the person before they connect a wallet, paste a seed phrase or send money. Our API and MCP already provide live checks.

View GitHub contribution activity