实时钓鱼与诈骗域名黑名单 - 20.8万+精选威胁、100万+社区、免费API、多种格式
Destroylist：钓鱼与诈骗域名黑名单
快速开始一键添加到 Pi-hole 或 AdGuard Home — 将此 URL 粘贴到您的黑名单设置中：``` https://cdn.jsdelivr.net/gh/phishdestroy/destroylist@main/rootlist/formats/primary_active/hosts.txt
> **建议使用上面的 CDN 链接** — 通过 jsDelivr 全球 CDN 提供，无速率限制。
> 原始 GitHub 镜像（流量大时可能返回 429）：`https://raw.githubusercontent.com/phishdestroy/destroylist/main/rootlist/formats/primary_active/hosts.txt`
> 更多格式： [Hosts](#-data-feeds) · [AdBlock](#-data-feeds) · [Dnsmasq](#-data-feeds) · [Unbound](#-data-feeds) · [RPZ](#-data-feeds) · [API](#-threat-intelligence-api)
<img src="https://assets.kitploit.com/production/public/readmes/9225/66755568f640f93051ca779dd85131a85bc03d6385f7c57bdaaf388de6854fbc.gif" width="100%">
## <img src="https://assets.kitploit.com/production/public/readmes/9225/375391e605e2336c5dda1b81c5194a94a192db9a096cf46c24c52a389dbd4d16.png" alt="High Voltage" width="22" height="22" /> 快速访问
<details>
<summary><b>目录</b></summary>
- [快速开始](#-quick-start)
- [实时统计](#live-statistics)
- [数据源](#-data-feeds)
- [根域名列表](#-root-lists)
- [内容验证源](#-content-verified-feeds-)
- [威胁情报 API](#-threat-intelligence-api)
- [关于 Destroylist](#-about-destroylist)
- [工作流与修复](#-threat-intelligence--automated-remediation-workflow)
- [欺诈受害者信息](#-key-info-for-online-fraud-victims)
- [申诉流程](#-appeals-process)
- [联系我们](#-connect-with-us)
- [加入战斗](#-join-the-fight)
</details>
### 实时统计
| 主要 | 主要实时 | 社区 | 社区实时 |
|:-------:|:------------:|:---------:|:--------------:|
|  |  |  |  |
| 主要内容 | 社区内容 |
|:---------------:|:-----------------:|
|  |  |
| | 今天 | 本周 | 本月 |
|:--|:-----:|:----:|:-----:|
| **主要** |  |  |  |
| **社区** |  |  |  |
### <img src="https://assets.kitploit.com/production/public/readmes/9225/bb78fad734ffe1195b52ffbea506a7954009d8b8d2124a6f8c076aeedb2c5d84.png" alt="File Folder" width="22" height="22" /> 数据源
| 数据源 | 描述 | 更新 | 下载 |
|:-----|:------------|:------:|:--------:|
| **主要** | 精选钓鱼域名 | ⚡ 实时 | [](https://raw.githubusercontent.com/phishdestroy/destroylist/main/list.json) [](https://raw.githubusercontent.com/phishdestroy/destroylist/main/list.txt) |
| **主要实时** | DNS 验证的活动域名 | 🕐 24h | [](https://raw.githubusercontent.com/phishdestroy/destroylist/main/dns/active_domains.json) [](https://raw.githubusercontent.com/phishdestroy/destroylist/main/dns/active_domains.txt) |
| **社区** | 聚合自 13+ 个来源 | 🕐 2h | [](https://raw.githubusercontent.com/phishdestroy/destroylist/main/community/blocklist.json) [](https://raw.githubusercontent.com/phishdestroy/destroylist/main/community/blocklist.txt) |
| **社区实时** | 社区 DNS 验证 | 🕐 24h | [](https://raw.githubusercontent.com/phishdestroy/destroylist/main/community/live_blocklist.json) [](https://raw.githubusercontent.com/phishdestroy/destroylist/main/community/live_blocklist.txt) |
| **主要内容** | 精选 + HTTP 内容验证 | 🕐 12h | [](https://raw.githubusercontent.com/phishdestroy/destroylist/main/dns/content_active.json) [](https://raw.githubusercontent.com/phishdestroy/destroylist/main/dns/content_active.txt) |
| **社区内容** | 聚合 + HTTP 内容验证 | 🕐 24h | [](https://raw.githubusercontent.com/phishdestroy/destroylist/main/community/content_live.json) [](https://raw.githubusercontent.com/phishdestroy/destroylist/main/community/content_live.txt) |
| **白名单** | 误报保护 | ✋ 手动 | [](https://raw.githubusercontent.com/phishdestroy/destroylist/main/allow/allowlist.json) |
> [!TIP]
> **生产环境：** `list.json` 或 `active_domains.json` · **最大覆盖：** `blocklist.json` · **防火墙/DNS：** 根域名列表
<details>
<summary>📁 <b>所有下载格式</b>（TXT、Hosts、AdBlock、Dnsmasq、Unbound、RPZ）</summary>
<br>
> **遇到 429 错误？** 请使用下方的 jsDelivr CDN 链接 — 它们可绕过 GitHub 速率限制。
**通过 jsDelivr CDN（推荐，无速率限制）：**
| 格式 | 主要 | 主要实时 | 社区 | 社区实时 |
|:------:|:-------:|:------------:|:---------:|:--------------:|
| **TXT** | [⬇️](https://cdn.jsdelivr.net/gh/phishdestroy/destroylist@main/rootlist/formats/primary/domains.txt) | [⬇️](https://cdn.jsdelivr.net/gh/phishdestroy/destroylist@main/rootlist/formats/primary_active/domains.txt) | [⬇️](https://cdn.jsdelivr.net/gh/phishdestroy/destroylist@main/rootlist/formats/community/domains.txt) | [⬇️](https://cdn.jsdelivr.net/gh/phishdestroy/destroylist@main/rootlist/formats/community_active/domains.txt) |
| **Hosts** | [⬇️](https://cdn.jsdelivr.net/gh/phishdestroy/destroylist@main/rootlist/formats/primary/hosts.txt) | [⬇️](https://cdn.jsdelivr.net/gh/phishdestroy/destroylist@main/rootlist/formats/primary_active/hosts.txt) | [⬇️](https://cdn.jsdelivr.net/gh/phishdestroy/destroylist@main/rootlist/formats/community/hosts.txt) | [⬇️](https://cdn.jsdelivr.net/gh/phishdestroy/destroylist@main/rootlist/formats/community_active/hosts.txt) |
| **AdBlock** | [⬇️](https://cdn.jsdelivr.net/gh/phishdestroy/destroylist@main/rootlist/formats/primary/adblock.txt) | [⬇️](https://cdn.jsdelivr.net/gh/phishdestroy/destroylist@main/rootlist/formats/primary_active/adblock.txt) | [⬇️](https://cdn.jsdelivr.net/gh/phishdestroy/destroylist@main/rootlist/formats/community/adblock.txt) | [⬇️](https://cdn.jsdelivr.net/gh/phishdestroy/destroylist@main/rootlist/formats/community_active/adblock.txt) |
| **Dnsmasq** | [⬇️](https://cdn.jsdelivr.net/gh/phishdestroy/destroylist@main/rootlist/formats/primary/dnsmasq.conf) | [⬇️](https://cdn.jsdelivr.net/gh/phishdestroy/destroylist@main/rootlist/formats/primary_active/dnsmasq.conf) | [⬇️](https://cdn.jsdelivr.net/gh/phishdestroy/destroylist@main/rootlist/formats/community/dnsmasq.conf) | [⬇️](https://cdn.jsdelivr.net/gh/phishdestroy/destroylist@main/rootlist/formats/community_active/dnsmasq.conf) |
| **Unbound** | [⬇️](https://cdn.jsdelivr.net/gh/phishdestroy/destroylist@main/rootlist/formats/primary/unbound.conf) | [⬇️](https://cdn.jsdelivr.net/gh/phishdestroy/destroylist@main/rootlist/formats/primary_active/unbound.conf) | [⬇️](https://cdn.jsdelivr.net/gh/phishdestroy/destroylist@main/rootlist/formats/community/unbound.conf) | [⬇️](https://cdn.jsdelivr.net/gh/phishdestroy/destroylist@main/rootlist/formats/community_active/unbound.conf) |
| **RPZ** | [⬇️](https://cdn.jsdelivr.net/gh/phishdestroy/destroylist@main/rootlist/formats/primary/rpz.zone) | [⬇️](https://cdn.jsdelivr.net/gh/phishdestroy/destroylist@main/rootlist/formats/primary_active/rpz.zone) | [⬇️](https://cdn.jsdelivr.net/gh/phishdestroy/destroylist@main/rootlist/formats/community/rpz.zone) | [⬇️](https://cdn.jsdelivr.net/gh/phishdestroy/destroylist@main/rootlist/formats/community_active/rpz.zone) |
| **Redis** | [⬇️](https://cdn.jsdelivr.net/gh/phishdestroy/destroylist@main/rootlist/formats/primary/redis.txt) | [⬇️](https://cdn.jsdelivr.net/gh/phishdestroy/destroylist@main/rootlist/formats/primary_active/redis.txt) | [⬇️](https://cdn.jsdelivr.net/gh/phishdestroy/destroylist@main/rootlist/formats/community/redis.txt) | [⬇️](https://cdn.jsdelivr.net/gh/phishdestroy/destroylist@main/rootlist/formats/community_active/redis.txt) |
> **Redis 一行命令** — 将完整列表加载到 Redis 集合中（原子替换，零停机重载）：
> ```
> curl -s https://cdn.jsdelivr.net/gh/phishdestroy/destroylist@main/rootlist/formats/primary/redis.txt | redis-cli --pipe
> ```
> 然后以 O(1) 复杂度检查任意域名：`SISMEMBER destroylist:primary evil-domain.com`
<details>
<summary>通过 raw.githubusercontent.com（流量大时可能返回 429）</summary>
| 格式 | 主要 | 主要实时 | 社区 | 社区实时 |
|:------:|:-------:|:------------:|:---------:|:--------------:|
| **TXT** | [⬇️](https://raw.githubusercontent.com/phishdestroy/destroylist/main/rootlist/formats/primary/domains.txt) | [⬇️](https://raw.githubusercontent.com/phishdestroy/destroylist/main/rootlist/formats/primary_active/domains.txt) | [⬇️](https://raw.githubusercontent.com/phishdestroy/destroylist/main/rootlist/formats/community/domains.txt) | [⬇️](https://raw.githubusercontent.com/phishdestroy/destroylist/main/rootlist/formats/community_active/domains.txt) |
| **Hosts** | [⬇️](https://raw.githubusercontent.com/phishdestroy/destroylist/main/rootlist/formats/primary/hosts.txt) | [⬇️](https://raw.githubusercontent.com/phishdestroy/destroylist/main/rootlist/formats/primary_active/hosts.txt) | [⬇️](https://raw.githubusercontent.com/phishdestroy/destroylist/main/rootlist/formats/community/hosts.txt) | [⬇️](https://raw.githubusercontent.com/phishdestroy/destroylist/main/rootlist/formats/community_active/hosts.txt) |
| **AdBlock** | [⬇️](https://raw.githubusercontent.com/phishdestroy/destroylist/main/rootlist/formats/primary/adblock.txt) | [⬇️](https://raw.githubusercontent.com/phishdestroy/destroylist/main/rootlist/formats/primary_active/adblock.txt) | [⬇️](https://raw.githubusercontent.com/phishdestroy/destroylist/main/rootlist/formats/community/adblock.txt) | [⬇️](https://raw.githubusercontent.com/phishdestroy/destroylist/main/rootlist/formats/community_active/adblock.txt) |
| **Dnsmasq** | [⬇️](https://raw.githubusercontent.com/phishdestroy/destroylist/main/rootlist/formats/primary/dnsmasq.conf) | [⬇️](https://raw.githubusercontent.com/phishdestroy/destroylist/main/rootlist/formats/primary_active/dnsmasq.conf) | [⬇️](https://raw.githubusercontent.com/phishdestroy/destroylist/main/rootlist/formats/community/dnsmasq.conf) | [⬇️](https://raw.githubusercontent.com/phishdestroy/destroylist/main/rootlist/formats/community_active/dnsmasq.conf) |
| **Unbound** | [⬇️](https://raw.githubusercontent.com/phishdestroy/destroylist/main/rootlist/formats/primary/unbound.conf) | [⬇️](https://raw.githubusercontent.com/phishdestroy/destroylist/main/rootlist/formats/primary_active/unbound.conf) | [⬇️](https://raw.githubusercontent.com/phishdestroy/destroylist/main/rootlist/formats/community/unbound.conf) | [⬇️](https://raw.githubusercontent.com/phishdestroy/destroylist/main/rootlist/formats/community_active/unbound.conf) |
| **RPZ** | [⬇️](https://raw.githubusercontent.com/phishdestroy/destroylist/main/rootlist/formats/primary/rpz.zone) | [⬇️](https://raw.githubusercontent.com/phishdestroy/destroylist/main/rootlist/formats/primary_active/rpz.zone) | [⬇️](https://raw.githubusercontent.com/phishdestroy/destroylist/main/rootlist/formats/community/rpz.zone) | [⬇️](https://raw.githubusercontent.com/phishdestroy/destroylist/main/rootlist/formats/community_active/rpz.zone) |
</details>
> **Hosts** → Pi-hole、/etc/hosts、Windows · **AdBlock** → uBlock Origin、AdGuard · **Dnsmasq** → dnsmasq DNS · **Unbound** → pfSense、OPNsense · **RPZ** → BIND、Knot DNS · **Redis** → `redis-cli --pipe` 批量加载
</details>
### <img src="https://assets.kitploit.com/production/public/readmes/9225/ce7d7fb4a40580532e4e27b60c441010f36f8f671cdfbb5e988e1258bd2c2bc5.png" alt="Laptop" width="22" height="22" /> 根域名列表
> [!TIP]
> **仅根域名** — 不含子域名，排除托管服务商
| | 全部根域名 | 仅实时 | 仅服务 |
|:--|:-:|:-:|:-:|
| 🔴 **主要** | [JSON](https://raw.githubusercontent.com/phishdestroy/destroylist/main/rootlist/active_root_domains.json) · [TXT](https://raw.githubusercontent.com/phishdestroy/destroylist/main/rootlist/active_root_domains.txt) | [JSON](https://raw.githubusercontent.com/phishdestroy/destroylist/main/rootlist/online_root_domains.json) · [TXT](https://raw.githubusercontent.com/phishdestroy/destroylist/main/rootlist/online_root_domains.txt) | [JSON](https://raw.githubusercontent.com/phishdestroy/destroylist/main/rootlist/services_domains.json) · [TXT](https://raw.githubusercontent.com/phishdestroy/destroylist/main/rootlist/services_domains.txt) |
| ⚫ **社区** | [JSON](https://raw.githubusercontent.com/phishdestroy/destroylist/main/rootlist/community_root_domains.json) · [TXT](https://raw.githubusercontent.com/phishdestroy/destroylist/main/rootlist/community_root_domains.txt) | [JSON](https://raw.githubusercontent.com/phishdestroy/destroylist/main/rootlist/community_online_root_domains.json) · [TXT](https://raw.githubusercontent.com/phishdestroy/destroylist/main/rootlist/community_online_root_domains.txt) | [JSON](https://raw.githubusercontent.com/phishdestroy/destroylist/main/rootlist/community_services_domains.json) · [TXT](https://raw.githubusercontent.com/phishdestroy/destroylist/main/rootlist/community_services_domains.txt) |
> **全部根域名** — 干净的根域名（无基础设施） · **仅实时** — DNS 验证的活动域名 · **仅服务** — 托管平台的子域名（Vercel、Pages.dev、Netlify 等）
<img src="https://assets.kitploit.com/production/public/readmes/9225/66755568f640f93051ca779dd85131a85bc03d6385f7c57bdaaf388de6854fbc.gif" width="100%">
## <img src="https://assets.kitploit.com/production/public/readmes/9225/b6a803f28233508a8d026ca7dbf00c61ac4e5d863de24a7b164bc348c079cef8.webp" width="25" /> 内容验证源 <img src="https://assets.kitploit.com/production/public/readmes/9225/f9508aaeba939041deccda3064343b9e328d5722aac996f0efb873b9fc4885e4.webp" width="25" />
> [!NOTE]
> **真正的 HTTP 内容验证** — 不仅是 DNS，而是实际的钓鱼页面检测
[](https://github.com/phishdestroy/destroylist/raw/main/dns/content_active.json)
[](https://github.com/phishdestroy/destroylist/raw/main/community/content_live.json)
| 数据源 | 更新 | 描述 |
|:-----|:------:|:------------|
| **主要内容** | `12h`（06:00 / 18:00 UTC） | 经过验证的活动内容的精选钓鱼数据 |
| **社区内容** | `24h`（03:00 UTC） | 聚合数据源，包含已验证的活动内容 |
> 下载链接：见上文 [数据源](#-data-feeds)
> [!WARNING]
> **伪装预警：** 诈骗者使用伪装技术向机器人隐藏钓鱼页面 — 向扫描器展示空白/伪造页面。不在内容列表中的域名 ≠ 安全！请使用 **主要** 或 **社区** 完整列表以获得全面保护。
<img src="https://assets.kitploit.com/production/public/readmes/9225/66755568f640f93051ca779dd85131a85bc03d6385f7c57bdaaf388de6854fbc.gif" width="100%">
## <img src="https://assets.kitploit.com/production/public/readmes/9225/8473e35500f4880a4b221b0e6b9e0232c4cd8b95dd3e0e87c47b8d1d8456935f.webp" alt="Alien Monster" width="25" height="25" /> 威胁情报 API
<p align="center">
<img src="https://assets.kitploit.com/production/public/readmes/9225/708e69fca236d3f5355650687e220e2d365289b763ddf4dadea90d99e53ec691.png" alt="API" width="700"/>
</p>```mermaid
%%{init: {"theme":"base", "themeVariables": { "background": "transparent", "mainBkg": "#000000", "primaryColor": "#000000", "primaryTextColor": "#FFFFFF", "primaryBorderColor": "#FF0000", "lineColor": "#FF0000", "secondaryColor": "#111111", "tertiaryColor": "#111111", "fontFamily": "Inter, system-ui, sans-serif"}, "flowchart": {"curve": "basis", "htmlLabels": true}}}%%
flowchart LR
Request["🌐 Client Request<br/>(Single / Bulk)"] e1@--> API["⚡ Live API<br/>api.destroy.tools"]
API e2@--> Engine["🧠 Threat Engine<br/>(Risk Score 0-100)"]
Engine e3@--> DB[("🗄️ Destroylist DB<br/>1M+ Threats")]
DB e4@--> Engine
Engine e5@--> Response["📋 JSON Response<br/>(Severity & Status)"]
classDef client fill:#000000,stroke:#333333,stroke-width:2px,color:#FFFFFF;
classDef api fill:#000000,stroke:#FF0000,stroke-width:2px,color:#FFFFFF;
classDef db fill:#000000,stroke:#333333,stroke-width:2px,stroke-dasharray: 5 5,color:#FFFFFF;
classDef animate stroke:#FF0000,stroke-width:2px,stroke-dasharray:10 5,stroke-dashoffset:900,animation:dash 22s linear infinite;
classDef animateDark stroke:#333333,stroke-width:2px,stroke-dasharray:10 5,stroke-dashoffset:900,animation:dash 22s linear infinite;
class Request client;
class API,Engine,Response api;
class DB db;
class e1,e2,e3,e5 animate;
class e4 animateDark;
免费、开源、无需 API 密钥。 跨 888K+ 威胁的实时域名风险评分（0-100）· 2 小时同步 · 单个及批量检查（500/请求）· 关键词搜索 · 完整数据源
关于 Destroylist[!NOTE] 实时数据收集于 2025 年 7 月 1 日开始
追踪 888K+ 个域名 · 13+ 个威胁情报源 · 50+ 份厂商报告 · 6 种输出格式 · 免费 API
Destroylist 是由 PhishDestroy 打造的实时威胁情报平台——保护全球的防火墙、DNS 解析器、浏览器扩展程序以及安全团队。每个域名都会被公开地发现、验证、上报给注册商，并透明地发布。
%%{init: {"theme":"base", "themeVariables": { "background": "transparent", "mainBkg": "#000000", "primaryColor": "#000000", "primaryTextColor": "#FFFFFF", "primaryBorderColor": "#FF0000", "lineColor": "#FF0000", "secondaryColor": "#111111", "tertiaryColor": "#111111", "fontFamily": "Inter, system-ui, sans-serif"}, "flowchart": {"curve": "basis", "htmlLabels": true}}}%% flowchart TB subgraph Sources["🔍 Threat Sources"] S1[30+ Parsers] S2[Community Feeds] S3[Telegram Bot] S4[CT Logs / DNS] end
subgraph Ingestion["📥 Ingestion"] I1[smart_aggregator.py] I2[validate_and_clean.py] end
subgraph Enrichment["🧠 Enrichment"] E1[DNS Validation] E2[HTTP Content Check] E3[VirusTotal / GSB] end
subgraph Distribution["📡 Distribution"] D1[JSON / TXT] D2[Hosts / AdBlock] D3[RPZ / Unbound] D4[API Feed] end
Sources --> Ingestion Ingestion --> Enrichment Enrichment --> Distribution
classDef source fill:#000000,stroke:#333333,stroke-width:2px,color:#FFFFFF; classDef ingest fill:#000000,stroke:#FF0000,stroke-width:2px,color:#FFFFFF; classDef enrich fill:#000000,stroke:#CC0000,stroke-width:2px,color:#FFFFFF; classDef dist fill:#000000,stroke:#FF0000,stroke-width:2px,stroke-dasharray: 5 5,color:#FFFFFF;
class S1,S2,S3,S4 source; class I1,I2 ingest; class E1,E2,E3 enrich; class D1,D2,D3,D4 dist;
<details>
<summary>🔧 <b>快速集成示例</b> (订阅 URL · curl · Python · Bash)</summary>
<br>
### 一键订阅 URL
| 工具 | 格式 | URL |
|:-----|:------:|:----|
| **Pi-hole** | Hosts | `https://raw.githubusercontent.com/phishdestroy/destroylist/main/rootlist/formats/primary_active/hosts.txt` |
| **AdGuard Home** | AdBlock | `https://raw.githubusercontent.com/phishdestroy/destroylist/main/rootlist/formats/primary_active/adblock.txt` |
| **uBlock Origin** | AdBlock | `https://raw.githubusercontent.com/phishdestroy/destroylist/main/rootlist/formats/primary_active/adblock.txt` |
| **pfSense / OPNsense (Unbound)** | Unbound | `https://raw.githubusercontent.com/phishdestroy/destroylist/main/rootlist/formats/primary_active/unbound.conf` |
| **BIND / Knot DNS (RPZ)** | RPZ | `https://raw.githubusercontent.com/phishdestroy/destroylist/main/rootlist/formats/primary_active/rpz.zone` |
| **Dnsmasq** | Dnsmasq | `https://raw.githubusercontent.com/phishdestroy/destroylist/main/rootlist/formats/primary_active/dnsmasq.conf` |
> **Pi-hole** — 设置 > 阻止列表 > 粘贴 Hosts URL<br>
> **AdGuard Home** — 过滤器 > DNS 阻止列表 > 添加阻止列表 > 粘贴 AdBlock URL<br>
> **uBlock Origin** — 设置 > 过滤器列表 > 导入 > 粘贴 AdBlock URL<br>
> **pfSense** — 服务 > DNS 解析器 > 粘贴 Unbound URL<br>
> **BIND/Knot** — 将 RPZ URL 添加为响应策略区域
### curl 单行命令```bash
# Plain domain list
curl -fsSL https://raw.githubusercontent.com/phishdestroy/destroylist/main/rootlist/formats/primary_active/domains.txt -o domains.txt
# Hosts format (Pi-hole, /etc/hosts)
curl -fsSL https://raw.githubusercontent.com/phishdestroy/destroylist/main/rootlist/formats/primary_active/hosts.txt -o hosts_blocklist.txt
# AdBlock format (uBlock Origin, AdGuard)
curl -fsSL https://raw.githubusercontent.com/phishdestroy/destroylist/main/rootlist/formats/primary_active/adblock.txt -o adblock.txt
# Dnsmasq
curl -fsSL https://raw.githubusercontent.com/phishdestroy/destroylist/main/rootlist/formats/primary_active/dnsmasq.conf -o dnsmasq_blocklist.conf
# Unbound (pfSense / OPNsense)
curl -fsSL https://raw.githubusercontent.com/phishdestroy/destroylist/main/rootlist/formats/primary_active/unbound.conf -o unbound_blocklist.conf
# RPZ (BIND / Knot)
curl -fsSL https://raw.githubusercontent.com/phishdestroy/destroylist/main/rootlist/formats/primary_active/rpz.zone -o rpz_blocklist.zone
import requests blocklist = requests.get('https://raw.githubusercontent.com/phishdestroy/destroylist/main/list.json').json() is_malicious = "suspicious-domain.com" in blocklist
### Bash```bash
curl -s https://raw.githubusercontent.com/phishdestroy/destroylist/main/list.txt | grep -q "suspicious-domain.com" && echo "BLOCKED"
威胁情报与自动化修复工作流```mermaid%%{init: {"theme":"base", "themeVariables": { "background": "transparent", "mainBkg": "#000000", "primaryColor": "#000000", "primaryTextColor": "#FFFFFF", "primaryBorderColor": "#FF0000", "lineColor": "#FF0000", "secondaryColor": "#111111", "tertiaryColor": "#111111", "fontFamily": "Inter, system-ui, sans-serif"}, "flowchart": {"curve": "basis", "htmlLabels": true}}}%%
flowchart LR
Discover["🔍 DISCOVER
30+ Parsers"] e1@--> Report["📤 REPORT
50+ Vendors"]
Report e2@--> Legal["⚖️ LEGAL
ICANN Compliance"]
Legal e3@--> Publish["📡 PUBLISH
Real-time Feed"]
classDef box fill:#000000,stroke:#333333,stroke-width:2px,color:#FFFFFF; classDef animate stroke:#FF0000,stroke-width:2px,stroke-dasharray:10 5,stroke-dashoffset:900,animation:dash 22s linear infinite;
class Discover,Report,Legal,Publish box;
class e1,e2,e3 animate;
<p align="center">
<img src="https://assets.kitploit.com/production/public/readmes/9225/b44d5f0758cb8b29e42734f5d032478fbc6c2c1574e5c5dbc1042c5551cb60da.png" alt="Workflow" width="700"/>
</p>
<div align="center">
| 🔍 **发现** | 📤 **报告** | ⚖️ **法律** | 📡 **发布** |
|:---:|:---:|:---:|:---:|
| 30+ 解析器 | 50+ 厂商 | ICANN 合规 | 实时 |
| CT 日志、DNS | Google、Microsoft | 滥用通知 | GitHub、Telegram |
| 社交媒体 | VirusTotal、Cloudflare | 证据包 | Twitter、Mastodon |
</div>
<details>
<summary>📖 <b>阅读完整工作流详情</b></summary>
<br>
### 🔍 阶段 1：主动发现与收集
🔎 我们利用由 **30+ 个专有解析器** 组成的分布式网络，在最早期阶段识别恶意域名：
- **高级启发式检测：** 持续监控 Google Ads（恶意广告）、被 SEO 操纵的搜索结果，以及 Twitter (X)、YouTube 和 Telegram 上的热门社交媒体活动
- **基础设施分析：** 利用 *dnstwist* 和域名仿冒检测，捕获针对知名品牌的相似域名
- **社区情报：** 通过我们的 Telegram Bot 和合作伙伴情报源，实时接收社区报告的威胁
---
### 📤 阶段 2：全球生态贡献
一旦威胁被确认，我们会将数据提交给超过 **50 家行业领先的供应商**：```
Cloudflare Google Safe Browsing Microsoft Security VirusTotal
Netcraft ESET Bitdefender Norton Safe Web
Avira PhishTank Dr.Web Yandex Safe Browsing
URLScan.io PolySwarm SiteReview Urlquery
PhishStats PhishReport IsItPhish ThreatCenter
网络诈骗受害者须知
💼 DestroyList 旨在禁用恶意域名：诈骗、钓鱼及其他非法网站，以提升互联网安全。
在域名被添加之前，我们会：
🔍 在多个网络安全平台上扫描该域名，以获取威胁情报。
📥 向注册商和托管服务商（通过 WHOIS）发送正式投诉，内容包括扫描结果、截图，以及要求对相关客户进行调查的请求。投诉还会告知他们该域名已被列入我们的公开数据库。
🚔 根据 ICANN 规则，注册商必须在 24 小时内审查此类投诉。
🦖 我们努力快速消除威胁。每个恶意域名都会被分析、记录、报告并透明地公开。
然而，当一个域名收到 10–30+ 份滥用报告，而注册商仍数月无视时，情况就发生了变化：注册商不再是被动的一方。它实际上在为非法活动提供基础设施。
一些注册商表现得好像他们的内部政策可以凌驾于 ICANN 要求和国家法律之上——好像只要他们个人决定不采取行动，钓鱼和诈骗就是“允许”的。
👮 我们公开记录这一切，以便任何人看到：威胁持续存在，并非因为它们未被发现，而是因为相关服务商根本选择不作为。
来自个人的请求：
DestroyList 是一个开源的、非商业性的志愿者项目。
个人可以查询我们就特定域名发送的滥用报告数量，但只能通过公开渠道：
❗ 我们不会通过私人电子邮件回复个人关于报告数量的请求。
✔️ 这是出于透明度和信息平等获取的法律要求。
政府或执法部门的正式请求可通过私人方式答复。
💔 如果您被此处已列出的某个域名诈骗，请通过提交历史或我们的 Telegram/Mastodon 频道查看其添加日期。
💬 如果诈骗发生在域名已被列入之后，注册商或托管商的拖延可能表明他们对损失负有共同责任。未来的潜在受害者也可以看到这种疏忽被公开记录。
🔞 容忍诈骗运营的注册商和托管商，理应被期待协助受害者或其法律代表。
用例与历史档案库网络安全 · 威胁研究 · AI/ML 训练 · 趋势分析 · 自动化
时点历史 —— 列表的每个状态都是可重建的：
[!TIP] 📩 历史档案库（50 万+ 域名，5 年以上归档）：[email protected]
申诉流程
被错误列入？快速解决：
 |  |
|---|
准确第一！🔭
联系我们
MIT —— 免费、开放，任你使用！
加入战斗！每一颗星都能帮助这个项目触达更多安全团队，保护更多用户。
我们欢迎各类贡献：
提交一个 Issue 或 PR —— 让我们一起打击钓鱼！ 💪
| 方法 | 端点 | 描述 |
|---|
GET | /v1/check?domain= | 单域名检查，含风险评分与严重性 |
POST | /v1/check/bulk | 每次请求可批量检查最多 500 个域名 |
GET | /v1/search?q= | 按关键词搜索黑名单域名 |
GET | /v1/feed/{list} | 下载完整域名数据源（primary、community、active） |
GET | /v1/stats | 实时统计与域名数量 |
每个域名都会根据多种信号获得一个风险评分（0-100）：
| 信号 | 分值 | 描述 |
|---|---|---|
| 精选黑名单 | +40 | 在主 destroylist 中 |
| 社区举报 | +20 | 由社区来源举报 |
| DNS 活跃 | +30 | 域名当前可解析 |
| 多来源 | +10 | 经多个数据源确认 |
| 可疑关键词 | +5 每个 | metamask、wallet、airdrop 等 |
| 高风险 TLD | +5 | .xyz、.top、.club、.icu 等 |
🔴 严重 70-100 · 🟠 高 40-69 · 🟡 中 20-39 · 🟢 低 1-19
cURL```bash curl "https://api.destroy.tools/v1/check?domain=suspicious-site.xyz"
**Python**```python
import requests
r = requests.get(f"https://api.destroy.tools/v1/check?domain={domain}")
if r.json()["threat"]:
print(f"BLOCKED: {r.json()['severity']} (score: {r.json()['risk_score']})")
JavaScript```javascript
const r = await fetch(https://api.destroy.tools/v1/check?domain=${domain});
const data = await r.json();
if (data.threat) console.warn("PHISHING:", data.severity, data.risk_score);
**批量检查**```bash
curl -X POST "https://api.destroy.tools/v1/check/bulk" \
-H "Content-Type: application/json" \
-d '{"domains":["site1.com","site2.xyz","site3.top"]}'
| 粒度 | 位置 | 保留策略 |
|---|
| 每次变更 | 提交历史 | 永久（41,000+ 次提交） |
| 每日新增/移除差异 | changes/ | 永久存储，可在 GitHub 代码搜索中查找 |
| 每周及每月完整快照 | archives/ → Release 资产 | 仓库树中保留近期快照，较早的轮转至永久 Release |
| 仓库 | 描述 |
|---|
| namesilo-evidence | 证据存档 —— NameSilo 注册商滥用调查 |
| nicenic-evidence | 证据存档 —— NiceNIC 注册商滥用调查 |
| trustname-evidence | 证据存档 —— TrustName 注册商滥用调查 |
| ScamIntelLogs | 原始诈骗情报日志和 IOC 数据 |
| DestroyScammers | 诈骗者曝光与瓦解行动 |