P

phishing

An up-to-date blacklist of phishing and scam domains, automatically updated by the PhishDestroy system. A reliable threat intelligence source for integration into security systems.

ShortDot SA zone evidence — .icu .bond .cyou .sbs .cfd .buzz .qpon: 51,985 brand-impersonation domains, per-zone abuse stats, STIX 2.1 IOC exports.

Trustname.com / Fewmoretaps OÜ — registrar zone evidence (Phase II): abuse indicators, IOC datasets and chain-of-custody hashes.

NICENIC International Group (IANA #3765) — complete zone scan of 343,107 domains, 37,844 live domains classified. Signed evidence package and IOC feed.

The phishing and scam list the Verdetto app checks on the phone, compiled in the open from public feeds and signed, and the code of the services behind the app (the list build, the lookup copies, the metrics, the record) as Cloudflare Workers.

Phishing URL blocklist for uBlock Origin (uBO), AdGuard, Vivaldi, Pi-hole, Hosts file, Dnsmasq, BIND, Unbound, Snort and Suricata.

Archive of the official PhishDestroy blog, following an unjust platform suspension on Medium.

Phishing takedown archive from @CarlyGriggs13 — 138K tweets, scam domain reports, and threat intel blocked by X.

Scam intelligence, phishing attribution, drainer mapping. Legal OSINT only. Public data. Real cases. For researchers and victims.

PhishDestroy — volunteer-driven threat intelligence, infrastructure takedowns and OSINT automation.

BloodyMary is an educational tool (trojan-virus or Ransomware) for training cybersecurity specialists, simulating realistic phishing attacks with social engineering elements. This project was created to raise awareness about cyber threats and demonstrate the consequences of running suspicious files.

AI-Powered Phishing Detection - By Ayi NEDJIMI

https://ayinedjimi-consultants.fr

SVG Analysis and generation tools for commonly seen SVG attachment phishing

Push notification demo based on malware seen in the wild.

IP obfuscation and URL generator.

C.A.R.P. is a pentest tool that delivers a remote, browser-in-the-browser experience for multi-campaign phishing, credential capture, and session hijacking (bypassing MFA). A target user visits a campaign URL they see a full-screen browser (noVNC + Firefox) that loads a target site you configure (e.g. a login page). Each visitor gets their own isolated Docker container, so sessions don’t mix. Keystrokes are logged per session, and you manage everything (campaigns, sessions, keylogs, idle timeouts) from a single Admin UI.

BigPhish - An all-in-one solution to identify and monitor phishing kit deployment

Expert level script for performing phishing attacks only for educational purpose.

Ultimate python phishing toolkit, with around 70 templates

EvilGinx3 + GoPhish