Threat intelligence.
Without the friction.

Look up a domain or URL and inspect its threat verdict and available detection signals. Input is normalized: scheme, credentials, port and path are removed and internationalized names are converted to punycode. Subdomains inherit a parent listing, except under shared-hosting suffixes such as appspot.com or pages.dev.

curl --fail-with-body 'https://api.destroy.tools/v1/check?domain=example.com'

Check up to 500 domains in a single request. Send a JSON body and the Content-Type: application/json header. The body may be at most 256 KB. Results are keyed by the normalized domain, and non-string or unparsable entries are counted in summary.invalid and echoed (first 50) in invalid_inputs.

curl --fail-with-body -X POST 'https://api.destroy.tools/v1/check/bulk' \
  -H 'Content-Type: application/json' \
  -d '{"domains":["example.com","example.org"]}'

Inspect the returned body and HTTP status. A failed request is not a clean verdict for the submitted domains.

Find blocklisted domain names containing a substring. The query is matched literally, including % and _. Search results are domain indicators, not links to visit.

curl --fail-with-body 'https://api.destroy.tools/v1/search?q=example&limit=10'

Download a full list for firewalls, DNS filters and ad blockers. Feeds are static files regenerated only when a list changes. They support ETag and Last-Modified conditional requests and gzip, and are cacheable for 5 minutes. Append a format to the list name; without one you get JSON.

curl --fail-with-body --compressed -o primary.txt 'https://api.destroy.tools/v1/feed/primary.txt'

Retrieve current dataset counts, synchronization information, and the API version. Figures are precomputed after every synchronization, which runs every 15 minutes. No parameters are required.

curl --fail-with-body 'https://api.destroy.tools/v1/stats'

Counts describe the API dataset. They are not counts of confirmed takedowns.

Check database reachability and synchronization freshness before relying on results. Never cached. Returns HTTP 503 when the database is unreachable or the last synchronization is older than two hours.

curl --fail-with-body 'https://api.destroy.tools/v1/health'

List the available feeds with their entry counts, update times, and download URLs. Each file includes its size and SHA-256 checksum so you can verify downloads.

curl --fail-with-body 'https://api.destroy.tools/v1/feeds'

Stay in sync without downloading full lists. Download the full .txt feed once, then request changes since the previous response's until. When truncated is true, continue from next_since. Removals are retained for 30 days; an older since returns HTTP 410 with the full feed URL.

curl --fail-with-body 'https://api.destroy.tools/v1/feed/primary/delta?since=2026-10-09T08:00:00Z'

One call that answers “what do we know about this link?” — for any domain or URL, listed or not. verdict is the authoritative blocklist result. assessment is a prediction from PhishDestroy data with a risk of high, elevated, low or none and the signals behind it. context is a plain-text summary with numbered sources, ready to hand to a language model.

curl --fail-with-body 'https://api.destroy.tools/v1/investigate?domain=example.com'

Established high-traffic domains (Tranco top 1M) and registrations held for three years or more are capped at low risk, because phishing domains are almost always new; registration comes from the registry’s RDAP service, never from the domain itself. On a held-out sample, 68% of phishing domains detected in the last week scored elevated or high, against 1 of 300 established sites scored without the Tranco cap. A none result is not evidence of safety, and a prediction is not a confirmed listing.

Search confirmed phishing records by words — brands, kits, drainers, scam types, registrars — and get the best matches with a citable context. At most 10 results per call and no paging: it answers a question, it does not export the dataset.

curl --fail-with-body 'https://api.destroy.tools/v1/intel/search?q=ledger+seed+phrase+recovery&limit=5'

Pull the full intelligence record for a confirmed domain: who it impersonates, how it scores across reputation sources, where it is hosted, its lifecycle, a fingerprint, and a machine-written analyst report. A domain that is not in the dataset returns found: false. WHOIS emails and personal data are never exposed, and the AI report is generated analysis, not a legal determination.

curl --fail-with-body 'https://api.destroy.tools/v1/intel?domain=example.com'

Find other domains run by the same actor as a seed domain. Clustering uses a shared favicon hash, IP address or phishing kit, but only when that signal is specific to one actor — generic shared infrastructure such as a blank favicon, a shared CDN address or a broad kit is dropped so the cluster stays meaningful instead of sweeping in unrelated sites. The response reports which signals it clustered_by, and every row carries its own matched_by.

curl --fail-with-body 'https://api.destroy.tools/v1/similar?domain=example.com&limit=50'

See a whole impersonation campaign at once. Pass brand (or kit) to get every tracked domain for that target with total, alive and distinct_ips and a page of domains. Pass nothing to get type: "brand_index", the top 50 brands by tracked-domain count. These counts describe tracked impersonation domains, not takedowns.

curl --fail-with-body 'https://api.destroy.tools/v1/campaign?brand=Ledger'