How to Block Hundreds of Thousands of Phishing Sites with a Single Line of Code

Most phishing sites live only a few days. Scammers register a domain with a name similar to a popular service, steal private keys or card data from a couple of dozen inattentive users, and then move on to the next address. Traditional antivirus databases often lag behind at the analysis stage, when the main damage has already been done.

Recently I came across the open-source project Destroylist by the PhishDestroy team. It's not just another list of bad addresses, but a comprehensive threat collection system that automatically searches for scams, verifies content, reports violations to registrars, and delivers ready-to-use feeds in all possible formats.

What's Inside and Who It's For

The project database contains over 888,000 tracked domains. Of these, about 180,000 are in the main verified list of phishing resources. The project collects data from 13 sources through its own parsers, constantly filtering out false positives.

The feed is useful in four clear scenarios:

• Configuring a home network or office DNS server via Pi-hole, AdGuard Home, or Unbound.
• Validating links inside web services, messenger bots, or crypto wallets before redirecting the user.
• Enriching data in a SOC or OSINT research tools.
• Training your own traffic filtering models.

Feeds for Every Taste and Fast Redis

One nice feature of the repository is that the authors care about how you'll be fetching the data. You won't need to write parsers to clean logs or transform JSON on the fly. The project directory contains ready-made files for various tools:

• Hosts (for Pi-hole, /etc/hosts or Windows)
• AdBlock (for uBlock Origin and AdGuard)
• Dnsmasq
• Unbound (for pfSense and OPNsense)
• RPZ (for BIND and Knot DNS)
• Redis

If you need to load an up-to-date feed into Redis for O(1) lookups, the repository includes a ready-made one-liner:

curl -s https://cdn.jsdelivr.net/gh/phishdestroy/destroylist@main/rootlist/formats/primary/redis.txt | redis-cli --pipe

After running this command, checking an address at evil-domain.com becomes an instant operation:

SISMEMBER destroylist:primary evil-domain.com

All lists are available directly from GitHub as well as through the jsDelivr CDN. The second option is preferable since frequent requests to raw GitHub files can easily result in a 429 error.

HTTP Content Verification and the Cloaking Problem

Many blacklist creators limit themselves to DNS resolution. If a domain responds to ping or returns an IP address, it's considered alive. But attackers often use cloaking: if a search bot or automated security scanner visits the site, it gets an empty page or a placeholder. The actual phishing content is shown only to real users with the right HTTP headers and geolocation.

Destroylist has a separate feed with HTTP verification. The project's scripts don't just check DNS records—they make real HTTP requests every 12 hours and analyze page content.

If a phishing page is actually being served right now, the domain gets added to content_active.json. However, the authors honestly warn: if a site isn't in the content-checked list, that doesn't mean it's safe. Due to cloaking, it's more logical to use the full list.

Free Threat Intelligence API

If you don't want to store a local database or regularly update text files, the project has a public REST API. It's completely free, requires no registration, and needs no API keys.

The API's special feature is the risk score calculation from 0 to 100 points. The rating is formed from a combination of factors:

• Presence in the project's main list (+40 points)
• Confirmed DNS activity (+30 points)
• Community reports (+20 points)
• Suspicious keywords like airdrop, wallet, metamask (+5 points each)
• Risky TLDs like .xyz, .top, .club (+5 points)

You can check a domain via cURL with a single command:

curl "https://api.destroy.tools/v1/check?domain=suspicious-site.xyz"

The response is a transparent JSON with threat level (severity) and points earned:

{
  "domain": "suspicious-site.xyz",
  "threat": true,
  "risk_score": 85,
  "severity": "critical"
}

For batch checks, there's a POST endpoint at /v1/check/bulk that accepts up to 500 domains per request. This is convenient if you're filtering user input or processing incoming logs in batches.

Python example for regular checks:

import requests

def check_domain(domain: str) -> bool:
    response = requests.get(f"https://api.destroy.tools/v1/check?domain={domain}")
    if response.status_code == 200:
        data = response.json()
        return data.get("threat", False)
    return False

if check_domain("suspicious-site.xyz"):
    print("Внимание! Домен находится в черном списке.")

Fighting Registrars and Automation

Destroylist is interesting not just as a database, but as a precedent in automated abuse fighting. The project authors developed a pipeline that, after detecting a threat, generates evidence (screenshots, traffic dumps, WHOIS dumps) and sends official complaints to hosting providers, registrars, and over 50 security services including Google Safe Browsing, VirusTotal, Cloudflare, and Microsoft Security.

The repository transparently maintains a history of all submitted abuses. The project publishes reports on registrars that ignore ICANN requirements and don't respond to dozens of abuse reports for months.

If a legitimate domain accidentally got caught in the sweep, there's an appeal form on the website and public GitHub Issues. The authors promptly process requests and add corrected addresses to the allowlist.json file.

Final Thoughts

Destroylist is a mature open-source tool (MIT license) with a high update frequency. Thanks to its flexible export structure, it's easy to integrate into both a home Pi-hole and a production service that needs to filter out scams on the fly.

Check out the repository, grab the feed format you need, or just save the free API address. The project is alive, actively developed by the community, and genuinely helps make the network cleaner.