Skip to content
View phishdestroy's full-sized avatar
🚨
Scammers will be caught, the time of reckoning has come!
🚨
Scammers will be caught, the time of reckoning has come!
2.5k followers · 58 following

Achievements

Achievement: Pair ExtraordinaireAchievement: Galaxy BrainAchievement: Starstruckx3Achievement: Public SponsorAchievement: Pull SharkAchievement: YOLOAchievement: Quickdraw

Achievements

Achievement: Pair ExtraordinaireAchievement: Galaxy BrainAchievement: Starstruckx3Achievement: Public SponsorAchievement: Pull SharkAchievement: YOLOAchievement: Quickdraw

Highlights

Block or report phishdestroy

Block user

Prevent this user from interacting with your repositories and sending you notifications. Learn more about blocking users.

You must be logged in to block users.

Content in all repositories owned by your account will be closed.
Maximum 250 characters. Please don’t include any personal information such as legal names or email addresses. Markdown is supported. This note will only be visible to you.
Report abuse

Contact GitHub support about this user’s behavior. Learn more about reporting abuse.

Report abuse
phishdestroy/README.md

PhishDestroy Banner

⚔️ PhishDestroy

Volunteer-Driven Threat Intelligence • Infrastructure Takedowns • OSINT Automation

Mission • Operations • Operational Matrix • Repositories • Expertise • Contact

🎯 Mission

PhishDestroy is a volunteer-driven threat intelligence initiative focused on large-scale detection, analysis, and elimination of:

  • Crypto drainers
  • Phishing networks
  • Scam infrastructure
  • Fraudulent applications
  • Threat actor clusters

Since 2019, we have:

  • Neutralized 500,000+ malicious domains
  • Eliminated 25+ actor-controlled infrastructures
  • Investigated 15+ threat actor groups
  • Maintained global OSINT feeds and takedown workflows

📊 Operations Overview

RECONNAISSANCE │ ████████████████████ │ CONTINUOUS
ANALYSIS │ ████████████████████ │ ACTIVE
COORDINATION │ ████████████████████ │ ONGOING
NEUTRALIZATION │ ████████████████████ │ RELENTLESS

🛡️ Operational Matrix

🌐 SCAN

• CT logs monitoring
• DNS anomaly detection
• Passive DNS + feeds
• Automated scanners
• Community submissions

🎯 HUNT

• Infra correlation
• Actor attribution
• Fingerprinting
• Network graphing
• Validation workflows

⚡ STRIKE

• Registrar escalation
• Hosting abuse pipeline
• Null-routing requests
• Evidence reporting
• Multi-team ops

🔥 ERASE

• Infra shutdown
• Persistence monitoring
• Re-emergence detection
• Intelligence linking
• Zero-tolerance control

📡 Repositories

🛡️ Blocklists & Threat Intelligence

Repository What it is Site
destroylist Real-time phishing & scam domain blocklist — JSON, TXT, hosts, AdBlock, dnsmasq, Unbound, RPZ (wiki) 🌐
DestroyScammers Scam intelligence, phishing attribution, drainer mapping (wiki) 🌐
ScamIntelLogs Telegram dumps of scammer groups preserved as evidence 🌐

🔍 Registrar Evidence — updated daily

Repository What it is Site
namesilo-evidence NameSilo, LLC (IANA #1479) — abuse investigation, IOC datasets 🌐
nicenic-evidence NICENIC International Group (IANA #3765) — full zone scan 🌐
trustname-evidence Trustname.com / Fewmoretaps OÜ — zone evidence, IOC datasets 🌐
shortdot-evidence ShortDot SA — .icu .bond .cyou .sbs .cfd .buzz .qpon brand-impersonation domains 🌐

🧪 Investigations & Tools

Repository What it is Site
DO-NOT-USE-xmrwallet-com xmrwallet.com leaks your private view key on every request — technical proof 🌐
taylor-wessing-data-breach-toolkit PDF redaction auditor & layer decomposer suite
Nigerian-dignity Catalogue of "inheritance" and "lottery" scam infrastructure 🌐
Anti-Phishing-Research Decoy research tool that feeds scammers millions of fake seeds
Operation-Takedown Tools and scripts for active phishing campaign disruption

🗄️ Archives

Repository What it is Site
medium-archive-phishdestroy Archive of the PhishDestroy blog after the Medium suspension 🌐
x-twitter-archive-CarlyGriggs13 138K tweets of phishing takedown reports from @CarlyGriggs13 🌐

🧠 OSINT Detection Methods

  • Certificate Transparency API
  • DNS anomalies & registrar drift
  • Hosting & ASN correlation
  • Blockchain scam transaction analysis
  • Malware reverse engineering
  • AI-enhanced phishing kit detection
  • Automated intelligence clustering

🧩 Expertise & Stack

  • Languages & Frameworks: Python, Go, Rust, PHP, JavaScript, Bash
  • Threat Intelligence & Analysis: YARA Rules, Malware RE, Infrastructure Mapping
  • Database & Services: MySQL, Redis, Nginx, Cloudflare, Docker, Linux, Git/GitLab

📬 Contact & Community

Evidence-based threat neutralization since 2019
📧 gitlab@phishdestroy.io
💪 Powered by volunteers, protected by community

Pinned Loading

  1. destroylist destroylist Public

    Real-time phishing & scam domain blocklist - 205k+ curated threats, 1M+ community, free API, multiple formats

    HTML 1.9k 504

  2. ScamIntelLogs ScamIntelLogs Public

    Open-source intelligence archive of crypto scam operations — internal chats, admin panels, victim records, and infrastructure data for research and investigation

    HTML 416 45

  3. DestroyScammers DestroyScammers Public

    Scam intelligence, phishing attribution, drainer mapping. Legal OSINT only. Public data. Real cases. For researchers and victims.

    JavaScript 325 20

  4. namesilo-evidence namesilo-evidence Public

    NameSilo (IANA #1479) registrar abuse investigation — 5,281,151 domains scanned, 204,460 classified IOC (122,119 HIGH), largely behind NameSilo's own PrivacyGuardian WHOIS shield. Filed with ICANN …

    HTML 152 21

  5. DO-NOT-USE-xmrwallet-com DO-NOT-USE-xmrwallet-com Public

    Forked from XMRWallet/Website

    ⚠️ xmrwallet.com steals your private view key on every request. Technical proof inside. If you lost funds — read LOST_FUNDS.md

    201 49

  6. trustname-evidence trustname-evidence Public

    Phase II evidence package: complete-zone scan of ICANN registrar #4318 Trustname.com / Fewmoretaps OÜ — 15,040 domains tracked, 4,276 classified IOC (3,293 HIGH). Daily updated IOC feeds, SIEM CSV,…

    Python 108 10