OSINT NavigatorDE Deutsch

destroylist

Operator: PhishDestroy

Free phishing blocklists with domain checks, research reports and an API. Also accessible to AI assistants through MCP.

Technical Infrastructure

Open website

Product

Free phishing data from PhishDestroy, with blocklists and a public threat intelligence API. A separate local viewer is available as a release.

Availability and source date

Active

As of: 16 October 2026.

No functionality test has been performed.

Use in OSINT research

Checks whether a domain appears in the phishing lists and provides leads on scam campaigns and connected infrastructure. No match does not mean that the domain is safe.

Queries

InputResultResult type
Domain / website + URLBlocklist matching and existing records for a domain. URL paths are removed when matching.
Retrieved
Keyword / free textDomains with matching names, plus available threat reports or campaigns matching a keyword, brand or phishing kit.
Retrieved
Domain / website + URLRisk prediction, an AI analysis report and leads on similar domains based on technical characteristics. These assessments are not confirmed findings.
Derived

Features

  • Checks individual domains or up to 500 domains per batch query.
  • Searches blocklists and threat reports by keyword.
  • Provides risk signals, reports and connections to similar domains.
  • Provides blocklists and historical data snapshots for download.
  • Offers a free API and an MCP server for AI assistants.

Categories

  • Technical Infrastructure
  • Threat intelligence

Coverage

Dataset

Its own curated phishing domains and aggregated community lists, supplemented by DNS, registration and other reputation information. It is not a register of people.

Access

Installation and deployment

Website · Locally installable

Blocklists and the API are provided online. The separately released PhishDestroy Viewer runs locally with Python and downloads the lists. This does not establish that a self-hosted API server is available.

Requirements

Public data and API without an account or API key. The optional local viewer requires Python 3.8 or later and an internet connection.

Export

API responses as JSON. Blocklists as JSON, TXT, Hosts, AdBlock and other DNS formats; historical data snapshots as JSON.

Provider

PhishDestroy

Country of establishment

Not applicable

Interfaces

API

Available. Public REST API without a key. Domain checks, batch queries, search, feeds, threat reports and campaigns.

MCP

Available. Remote MCP server at https://api.destroy.tools/mcp, without sign-in. Calls use the same allowances as the API.

AI agents

Available. Documented integration with Claude, ChatGPT, Cursor and VS Code through MCP. An OpenAPI description and agent reference are also available.

Maintenance

Licence

MIT

Latest activity

Commit 10/2026

Stars

approx. 2,100 (as of 16 October 2026)

Usage note

Code and data are licensed under MIT. The licence and copyright notice must be retained when distributing copies.

Limitations

  • The absence of a blocklist match or a risk score does not establish safety. New threats and false positives are possible.
  • Risk assessments and AI reports are analytical leads, not confirmed findings.
  • API limits apply per IP address and function. Availability is not guaranteed.

Guides and practical reports

Sources

Report an error