PhishDestroy API

Free, open-source threat intelligence API for detecting phishing sites and cryptocurrency scams in real time

♥ Volunteer Project Open Source Free Forever No API Key

...

Unique Domains

...

Primary List

...

Community

...

Active Threats

API Reference

▶GET/v1/checkcore

Check a single domain for threats. Returns risk score (0-100), severity level, matched blocklists, suspicious keyword detection, and automatic subdomain-to-parent domain matching.

domainstringDomain to check (required). Also accepts d or url

curl "https://api.destroy.tools/v1/check?domain=metamask-login.xyz"

{
  "domain": "metamask-login.xyz",
  "threat": true,
  "severity": "critical",
  "risk_score": 85,
  "active": true,
  "matched_domain": "metamask-login.xyz",
  "lists": { "primary": true, "community": true },
  "flags": ["curated_blocklist", "community_reported",
    "dns_active", "multi_source", "suspicious_keywords", "risky_tld"],
  "matched_keywords": ["metamask", "login"],
  "checked_at": "2025-02-10T22:00:00.000Z"
}

{
  "domain": "google.com",
  "threat": false,
  "message": "Not found in any blocklist",
  "note": "Not listed does not guarantee safety",
  "checked_at": "2025-02-10T22:00:00.000Z"
}

▶POST/v1/check/bulk500/req

Check up to 500 domains in a single request. Returns per-domain threat analysis and a summary with counts.

curl -X POST "https://api.destroy.tools/v1/check/bulk"   -H "Content-Type: application/json"   -d '{"domains":["metamask-login.xyz","google.com","free-crypto.top"]}'

{
  "results": {
    "metamask-login.xyz": { "threat": true, "severity": "critical", "risk_score": 85, ... },
    "google.com": { "threat": false },
    "free-crypto.top": { "threat": true, "severity": "high", "risk_score": 55, ... }
  },
  "summary": { "total": 3, "threats": 2, "clean": 1 }
}

▶GET/v1/searchsearch

Search blocklisted domains by substring. Find all phishing domains targeting a specific brand or keyword.

qstringSearch query, minimum 3 characters (required)

limitintMax results, default 50, max 200

curl "https://api.destroy.tools/v1/search?q=metamask&limit=10"

{
  "query": "metamask",
  "count": 10,
  "limit": 10,
  "domains": ["metamask-airdrop.xyz", "metamask-bridge.io", ...]
}

▶GET/v1/feed/{list}

Download complete domain feeds for integration into firewalls, DNS filters, SIEM, or security tools.

listpathOne of: primary community primary_active community_active

curl "https://api.destroy.tools/v1/feed/primary_active"

▶GET/v1/stats

Live statistics: domain counts per list, total unique domains, last sync timestamp, API version.

curl "https://api.destroy.tools/v1/stats"

Quick Start

// JavaScript / Node.js
const r = await fetch("https://api.destroy.tools/v1/check?domain=" + domain);
const data = await r.json();
if (data.threat) {
  console.warn("BLOCKED:", data.severity, "score:", data.risk_score);
}

# Python
import requests
r = requests.get(f"https://api.destroy.tools/v1/check?domain={domain}")
if r.json()["threat"]:
    print("PHISHING:", r.json()["severity"])

# Bulk check with cURL
curl -s -X POST "https://api.destroy.tools/v1/check/bulk"   -H "Content-Type: application/json"   -d '{"domains":["site1.com","site2.xyz"]}' | jq .summary

Threat Scoring

Every domain gets a risk score (0-100) based on multiple signals:

+40Curated blocklist (primary)

+20Community reported

+30DNS active (live threat)

+10Multi-source confirmed

+5eaSuspicious keywords (metamask, wallet...)

+5Risky TLD (.xyz, .top, .club...)

Critical 70-100 · High 40-69 · Medium 20-39 · Low 1-19

About

PhishDestroy is a volunteer-driven, open-source cybersecurity project dedicated to fighting phishing and cryptocurrency scams. Since 2019 we have neutralized over 500,000+ threats across 25+ networks.

Our blocklist is curated by security researchers and community contributors. The API is free, requires no API key, and syncs hourly from the destroylist repository (700+ GitHub stars). Use it in browser extensions, security tools, firewalls, bots, SIEM systems, or anything that needs malicious domain detection.

We don't just collect — we destroy. Active reporting to registrars, hosting providers, and law enforcement for immediate takedowns.

Integrated Sources

+ many more integrated into our threat intelligence pipeline

Community Contributors

Disclaimer: PhishDestroy is a volunteer community project provided "as is" without warranty. The API is intended for informational and security research purposes. A domain not being listed does not guarantee it is safe. Data is sourced from multiple community contributors and automated scanning. False positives may occur. Always perform additional verification before taking action. PhishDestroy is not responsible for any decisions made based on API results.