{ "type": "Domain", "indicator": "30eth.com", "general": { "sections": [ "general", "geo", "url_list", "passive_dns", "malware", "whois", "http_scans" ], "whois": "http://whois.domaintools.com/30eth.com", "alexa": "http://www.alexa.com/siteinfo/30eth.com", "indicator": "30eth.com", "type": "domain", "type_title": "Domain", "validation": [], "base_indicator": { "id": 2680903333, "indicator": "30eth.com", "type": "domain", "title": "", "description": "", "content": "", "access_type": "public", "access_reason": "" }, "pulse_info": { "count": 12, "pulses": [ { "id": "69c081afa2bd54a9599b7c07", "name": "PhishDestroy \u2014 Active Phishing & Crypto Scam Domains", "description": "Real-time feed of phishing, crypto drainer, and scam domains detected by PhishDestroy (phishdestroy.io). Updated hourly. 108K+ domains tracked, 55K+ currently active. Source: github.com/phishdestroy/destroylist", "modified": "2026-05-24T00:00:03.049000", "created": "2026-03-22T23:56:29.438000", "tags": [ "phishing", "crypto", "scam", "drainer", "fraud", "blocklist", "phishdestroy" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 33, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "phishdestroy", "id": "348394", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 93266, "hostname": 57600 }, "indicator_count": 150866, "is_author": false, "is_subscribing": null, "subscriber_count": 99, "modified_text": "6 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69c08867316c564ade394c69", "name": "PhishDestroy \u2014 Content Active Threats (Live)", "description": "Live feed of phishing and crypto scam domains with ACTIVE malicious content from PhishDestroy. These domains are verified to have live phishing/scam pages. Updated hourly. Source: github.com/phishdestroy/destroylist/dns/content_active.json", "modified": "2026-05-21T12:06:19.702000", "created": "2026-03-23T00:25:09.116000", "tags": [ "phishing", "crypto", "scam", "drainer", "fraud", "blocklist", "phishdestroy", "active", "content" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "phishdestroy", "id": "348394", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 132502, "hostname": 66217 }, "indicator_count": 198719, "is_author": false, "is_subscribing": null, "subscriber_count": 44, "modified_text": "9 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69f83cb0ce73bef5c452bfb0", "name": "Credit: PhishDestroy Clone [\"phish detroy- open domains\"]", "description": "", "modified": "2026-05-04T06:29:04.332000", "created": "2026-05-04T06:29:04.332000", "tags": [ "phishing", "crypto", "scam", "drainer", "fraud", "blocklist", "phishdestroy" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": "69c081afa2bd54a9599b7c07", "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 88564, "hostname": 54516 }, "indicator_count": 143080, "is_author": false, "is_subscribing": null, "subscriber_count": 69, "modified_text": "26 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69f83caf1bef3609f0eb79e2", "name": "Credit: PhishDestroy Clone [\"phish detroy- open domains\"]", "description": "", "modified": "2026-05-04T06:29:03.120000", "created": "2026-05-04T06:29:03.120000", "tags": [ "phishing", "crypto", "scam", "drainer", "fraud", "blocklist", "phishdestroy" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": "69c081afa2bd54a9599b7c07", "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 88564, "hostname": 54516 }, "indicator_count": 143080, "is_author": false, "is_subscribing": null, "subscriber_count": 69, "modified_text": "26 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69f83cac7d6c947de6c080f9", "name": "Credit: PhishDestroy Clone [\"phish detroy- open domains\"]", "description": "", "modified": "2026-05-04T06:29:00.417000", "created": "2026-05-04T06:29:00.417000", "tags": [ "phishing", "crypto", "scam", "drainer", "fraud", "blocklist", "phishdestroy" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": "69c081afa2bd54a9599b7c07", "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 88564, "hostname": 54516 }, "indicator_count": 143080, "is_author": false, "is_subscribing": null, "subscriber_count": 68, "modified_text": "26 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69f83cab9769e92b3285a2b4", "name": "Credit: PhishDestroy Clone [\"phish detroy- open domains\"]", "description": "", "modified": "2026-05-04T06:28:59.770000", "created": "2026-05-04T06:28:59.770000", "tags": [ "phishing", "crypto", "scam", "drainer", "fraud", "blocklist", "phishdestroy" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": "69c081afa2bd54a9599b7c07", "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 88564, "hostname": 54516 }, "indicator_count": 143080, "is_author": false, "is_subscribing": null, "subscriber_count": 68, "modified_text": "26 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69f83cab7e03b19c5f1078e3", "name": "Credit: PhishDestroy Clone [\"phish detroy- open domains\"]", "description": "", "modified": "2026-05-04T06:28:59.113000", "created": "2026-05-04T06:28:59.113000", "tags": [ "phishing", "crypto", "scam", "drainer", "fraud", "blocklist", "phishdestroy" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": "69c081afa2bd54a9599b7c07", "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 88564, "hostname": 54516 }, "indicator_count": 143080, "is_author": false, "is_subscribing": null, "subscriber_count": 69, "modified_text": "26 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69f83ca9411c8ab5d294a7e2", "name": "Credit: PhishDestroy Clone [\"phish detroy- open domains\"]", "description": "", "modified": "2026-05-04T06:28:57.479000", "created": "2026-05-04T06:28:57.479000", "tags": [ "phishing", "crypto", "scam", "drainer", "fraud", "blocklist", "phishdestroy" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": "69c081afa2bd54a9599b7c07", "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 88564, "hostname": 54516 }, "indicator_count": 143080, "is_author": false, "is_subscribing": null, "subscriber_count": 68, "modified_text": "26 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69f83ca77d6c947de6c080f8", "name": "Credit: PhishDestroy Clone [\"phish detroy- open domains\"]", "description": "", "modified": "2026-05-04T06:28:55.093000", "created": "2026-05-04T06:28:55.093000", "tags": [ "phishing", "crypto", "scam", "drainer", "fraud", "blocklist", "phishdestroy" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": "69c081afa2bd54a9599b7c07", "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 88564, "hostname": 54516 }, "indicator_count": 143080, "is_author": false, "is_subscribing": null, "subscriber_count": 68, "modified_text": "26 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6895baa2f44f0d6a1f832067", "name": "destroylist", "description": "A curated snapshot of malicious domains targeting the cryptocurrency ecosystem \u2014 mainly wallet drainers and crypto phishing sites.\nCollected and verified from open threat-hunting operations between July 1, 2025 and the present date.\nAll indicators are cleaned from duplicates and provided as-is for analysts, SOC teams, and automated defenses.\n\nKey Details:\nFocus: Crypto drainers & phishing domains\n\nTimeframe: July 1, 2025 \u2014 August 2025\nVerified, deduplicated, and ready for integration\nSuitable for research, blocking lists, and enrichment", "modified": "2026-03-02T21:00:09.122000", "created": "2025-08-08T08:51:46.066000", "tags": [ "destroylist", "drainer", "crypto scam", "phishdestroy", "Cryptocurrency", "Blockchain" ], "references": [ "" ], "public": 1, "adversary": "Multiple unidentified threat actors targeting cryptocurrency ecosystem", "targeted_countries": [], "malware_families": [ { "id": "drainer", "display_name": "drainer", "target": null } ], "attack_ids": [], "industries": [ "web3", "crypto" ], "TLP": "white", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "phishdestroy", "id": "348394", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 13, "URL": 1361, "domain": 5908, "hostname": 1143 }, "indicator_count": 8425, "is_author": false, "is_subscribing": null, "subscriber_count": 28, "modified_text": "89 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6802e4dc666f09bb71e49460", "name": "Twitter Feed - skocherhan - 18-04-2025", "description": "", "modified": "2025-05-18T23:01:09.323000", "created": "2025-04-18T23:48:44.056000", "tags": [ "C2", "AgentTesla", "phishing", "Lumma", "malware", "opendir", "APT", "SocGholish" ], "references": [ "https://x.com/skocherhan/status/1913031370021953787", "https://x.com/skocherhan/status/1913038264472137798", "https://x.com/skocherhan/status/1913045029385355732", "https://x.com/skocherhan/status/1913047738238771543", "https://x.com/skocherhan/status/1913050816534937667", "https://x.com/skocherhan/status/1913065085599096931", "https://x.com/skocherhan/status/1913095316041060536", "https://x.com/skocherhan/status/1913109554499314004", "https://x.com/skocherhan/status/1913111161425244261", "https://x.com/skocherhan/status/1913112893014294914", "https://x.com/skocherhan/status/1913115160966767015", "https://x.com/skocherhan/status/1913116627932971313", "https://x.com/skocherhan/status/1913117650269413644", "https://x.com/skocherhan/status/1913119475555070215", "https://x.com/skocherhan/status/1913123020626964484", "https://x.com/skocherhan/status/1913128341734912437", "https://x.com/skocherhan/status/1913131101498777664", "https://x.com/skocherhan/status/1913134813273374770", "https://x.com/skocherhan/status/1913136876967297515", "https://x.com/skocherhan/status/1913141025863786748", "https://x.com/skocherhan/status/1913142488698691785", "https://x.com/skocherhan/status/1913259203868623137", "https://x.com/skocherhan/status/1912941291857490015", "https://x.com/skocherhan/status/1913322074879242253", "https://x.com/skocherhan/status/1913325523670794663", "https://x.com/skocherhan/status/1913344822598836621", "https://x.com/skocherhan/status/1913353390966321360" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 15, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 26, "URL": 59, "hostname": 3, "domain": 36 }, "indicator_count": 124, "is_author": false, "is_subscribing": null, "subscriber_count": 1620, "modified_text": "377 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "67e9d2b0491b6f5882daa47d", "name": "Twitter Feed - Phish_Destroy - 30-03-2025", "description": "", "modified": "2025-03-30T23:24:31.983000", "created": "2025-03-30T23:24:31.983000", "tags": [ "phishing", "malware", "scam" ], "references": [ "https://x.com/Phish_Destroy/status/1906135908144877676", "https://x.com/Phish_Destroy/status/1906136188072685700", "https://x.com/Phish_Destroy/status/1906312838357880892", "https://x.com/Phish_Destroy/status/1906313385693610447", "https://x.com/Phish_Destroy/status/1906313792239153501", "https://x.com/Phish_Destroy/status/1906314594525520300", "https://x.com/Phish_Destroy/status/1906314921786122351", "https://x.com/Phish_Destroy/status/1906315095480660149", "https://x.com/Phish_Destroy/status/1906315272274792498", "https://x.com/Phish_Destroy/status/1906315943652757561", "https://x.com/Phish_Destroy/status/1906316025563316586", "https://x.com/Phish_Destroy/status/1906316349120413836", "https://x.com/Phish_Destroy/status/1906316493421261038", "https://x.com/Phish_Destroy/status/1906316612224897040", "https://x.com/Phish_Destroy/status/1906316686120169806", "https://x.com/Phish_Destroy/status/1906317536091582667", "https://x.com/Phish_Destroy/status/1906319505753530653", "https://x.com/Phish_Destroy/status/1906319573499945182", "https://x.com/Phish_Destroy/status/1906319749316841608", "https://x.com/Phish_Destroy/status/1906320934123848166", "https://x.com/Phish_Destroy/status/1906321568873001075", "https://x.com/Phish_Destroy/status/1906322010382184528", "https://x.com/Phish_Destroy/status/1906322265152610621", "https://x.com/Phish_Destroy/status/1906322427388330188", "https://x.com/Phish_Destroy/status/1906322892578529568", "https://x.com/Phish_Destroy/status/1906323104067932290", "https://x.com/Phish_Destroy/status/1906323234837893365", "https://x.com/Phish_Destroy/status/1906323398986240327", "https://x.com/Phish_Destroy/status/1906323481983066412", "https://x.com/Phish_Destroy/status/1906323743141450089", "https://x.com/Phish_Destroy/status/1906325787239702974", "https://x.com/Phish_Destroy/status/1906326166241182096", "https://x.com/Phish_Destroy/status/1906326303168450639", "https://x.com/Phish_Destroy/status/1906326427101737339", "https://x.com/Phish_Destroy/status/1906326756404949051", "https://x.com/Phish_Destroy/status/1906327090380546377", "https://x.com/Phish_Destroy/status/1906327468048343192", "https://x.com/Phish_Destroy/status/1906327554224493040", "https://x.com/Phish_Destroy/status/1906327885847073075", "https://x.com/Phish_Destroy/status/1906328013043536181", "https://x.com/Phish_Destroy/status/1906328280401166805", "https://x.com/Phish_Destroy/status/1906328566561702319", "https://x.com/Phish_Destroy/status/1906330917477462118", "https://x.com/Phish_Destroy/status/1906331824780874016", "https://x.com/Phish_Destroy/status/1906358474226671684", "https://x.com/Phish_Destroy/status/1906358843530990034", "https://x.com/Phish_Destroy/status/1906377840750104927", "https://x.com/Phish_Destroy/status/1906378562359136543", "https://x.com/Phish_Destroy/status/1906399584844124534", "https://x.com/Phish_Destroy/status/1906400070271955382", "https://x.com/Phish_Destroy/status/1906400420286607592", "https://x.com/Phish_Destroy/status/1906400494085365950", "https://x.com/Phish_Destroy/status/1906403524830961968", "https://x.com/Phish_Destroy/status/1906403770902139165", "https://x.com/Phish_Destroy/status/1906404754722263399", "https://x.com/Phish_Destroy/status/1906405271603183890", "https://x.com/Phish_Destroy/status/1906405350611296330", "https://x.com/Phish_Destroy/status/1906406888176263456", "https://x.com/Phish_Destroy/status/1906407680211566979", "https://x.com/Phish_Destroy/status/1906408279150063999", "https://x.com/Phish_Destroy/status/1906408450428731903", "https://x.com/Phish_Destroy/status/1906408539721241028", "https://x.com/Phish_Destroy/status/1906409284528685463", "https://x.com/Phish_Destroy/status/1906409377579295065", "https://x.com/Phish_Destroy/status/1906409671230914693", "https://x.com/Phish_Destroy/status/1906409787832627389", "https://x.com/Phish_Destroy/status/1906410302050058319", "https://x.com/Phish_Destroy/status/1906410409986572652", "https://x.com/Phish_Destroy/status/1906410483919290561", "https://x.com/Phish_Destroy/status/1906410556850065684", "https://x.com/Phish_Destroy/status/1906410611753541670", "https://x.com/Phish_Destroy/status/1906411051668660230", "https://x.com/Phish_Destroy/status/1906411555429700092", "https://x.com/Phish_Destroy/status/1906426412526870670", "https://x.com/Phish_Destroy/status/1906426736952144106", "https://x.com/Phish_Destroy/status/1906442960658395189", "https://x.com/Phish_Destroy/status/1906444571187232882", "https://x.com/Phish_Destroy/status/1906444990038884818", "https://x.com/Phish_Destroy/status/1906445047609847824", "https://x.com/Phish_Destroy/status/1906445459540873463", "https://x.com/Phish_Destroy/status/1906445520366674328", "https://x.com/Phish_Destroy/status/1906445592349348294", "https://x.com/Phish_Destroy/status/1906445654294966478", "https://x.com/Phish_Destroy/status/1906446588009959840", "https://x.com/Phish_Destroy/status/1906446664031719552", "https://x.com/Phish_Destroy/status/1906467644473233759", "https://x.com/Phish_Destroy/status/1906468329696473163" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 5, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 59, "URL": 87, "hostname": 28 }, "indicator_count": 174, "is_author": false, "is_subscribing": null, "subscriber_count": 1620, "modified_text": "426 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 } ], "references": [ "", "https://x.com/Phish_Destroy/status/1906321568873001075", "https://x.com/skocherhan/status/1912941291857490015", "https://x.com/Phish_Destroy/status/1906316025563316586", "https://x.com/Phish_Destroy/status/1906328013043536181", "https://x.com/skocherhan/status/1913109554499314004", "https://x.com/Phish_Destroy/status/1906410483919290561", "https://x.com/Phish_Destroy/status/1906426412526870670", "https://x.com/Phish_Destroy/status/1906410302050058319", "https://x.com/Phish_Destroy/status/1906445047609847824", "https://x.com/Phish_Destroy/status/1906319573499945182", "https://x.com/Phish_Destroy/status/1906312838357880892", "https://x.com/Phish_Destroy/status/1906328566561702319", "https://x.com/skocherhan/status/1913047738238771543", "https://x.com/skocherhan/status/1913134813273374770", "https://x.com/skocherhan/status/1913123020626964484", "https://x.com/skocherhan/status/1913128341734912437", "https://x.com/Phish_Destroy/status/1906317536091582667", "https://x.com/Phish_Destroy/status/1906322892578529568", "https://x.com/skocherhan/status/1913142488698691785", "https://x.com/Phish_Destroy/status/1906445459540873463", "https://x.com/Phish_Destroy/status/1906136188072685700", "https://x.com/Phish_Destroy/status/1906326427101737339", "https://x.com/skocherhan/status/1913131101498777664", "https://x.com/Phish_Destroy/status/1906445654294966478", "https://x.com/Phish_Destroy/status/1906410409986572652", "https://x.com/skocherhan/status/1913117650269413644", "https://x.com/Phish_Destroy/status/1906408539721241028", "https://x.com/Phish_Destroy/status/1906426736952144106", "https://x.com/Phish_Destroy/status/1906400494085365950", "https://x.com/skocherhan/status/1913259203868623137", "https://x.com/Phish_Destroy/status/1906135908144877676", "https://x.com/Phish_Destroy/status/1906411555429700092", "https://x.com/Phish_Destroy/status/1906400420286607592", "https://x.com/Phish_Destroy/status/1906358843530990034", "https://x.com/Phish_Destroy/status/1906358474226671684", "https://x.com/Phish_Destroy/status/1906442960658395189", "https://x.com/Phish_Destroy/status/1906325787239702974", "https://x.com/skocherhan/status/1913112893014294914", "https://x.com/Phish_Destroy/status/1906326756404949051", "https://x.com/Phish_Destroy/status/1906404754722263399", "https://x.com/skocherhan/status/1913095316041060536", "https://x.com/Phish_Destroy/status/1906410556850065684", "https://x.com/skocherhan/status/1913136876967297515", "https://x.com/Phish_Destroy/status/1906315943652757561", "https://x.com/Phish_Destroy/status/1906403524830961968", "https://x.com/Phish_Destroy/status/1906313792239153501", "https://x.com/Phish_Destroy/status/1906313385693610447", "https://x.com/Phish_Destroy/status/1906328280401166805", "https://x.com/Phish_Destroy/status/1906405271603183890", "https://x.com/Phish_Destroy/status/1906326303168450639", "https://x.com/Phish_Destroy/status/1906405350611296330", "https://x.com/skocherhan/status/1913031370021953787", "https://x.com/Phish_Destroy/status/1906467644473233759", "https://x.com/Phish_Destroy/status/1906444571187232882", "https://x.com/Phish_Destroy/status/1906407680211566979", "https://x.com/Phish_Destroy/status/1906320934123848166", "https://x.com/Phish_Destroy/status/1906314594525520300", "https://x.com/skocherhan/status/1913322074879242253", "https://x.com/Phish_Destroy/status/1906411051668660230", "https://x.com/Phish_Destroy/status/1906403770902139165", "https://x.com/Phish_Destroy/status/1906327468048343192", "https://x.com/Phish_Destroy/status/1906445592349348294", "https://x.com/Phish_Destroy/status/1906322265152610621", "https://x.com/Phish_Destroy/status/1906323398986240327", "https://x.com/Phish_Destroy/status/1906316493421261038", "https://x.com/Phish_Destroy/status/1906378562359136543", "https://x.com/Phish_Destroy/status/1906323234837893365", "https://x.com/Phish_Destroy/status/1906331824780874016", "https://x.com/Phish_Destroy/status/1906316612224897040", "https://x.com/Phish_Destroy/status/1906316686120169806", "https://x.com/skocherhan/status/1913038264472137798", "https://x.com/Phish_Destroy/status/1906314921786122351", "https://x.com/Phish_Destroy/status/1906409377579295065", "https://x.com/skocherhan/status/1913111161425244261", "https://x.com/Phish_Destroy/status/1906323104067932290", "https://x.com/skocherhan/status/1913050816534937667", "https://x.com/Phish_Destroy/status/1906330917477462118", "https://x.com/Phish_Destroy/status/1906316349120413836", "https://x.com/Phish_Destroy/status/1906327554224493040", "https://x.com/Phish_Destroy/status/1906327885847073075", "https://x.com/skocherhan/status/1913115160966767015", "https://x.com/Phish_Destroy/status/1906409284528685463", "https://x.com/Phish_Destroy/status/1906408279150063999", "https://x.com/skocherhan/status/1913045029385355732", "https://x.com/Phish_Destroy/status/1906323481983066412", "https://x.com/Phish_Destroy/status/1906446664031719552", "https://x.com/skocherhan/status/1913344822598836621", "https://x.com/Phish_Destroy/status/1906327090380546377", "https://x.com/skocherhan/status/1913141025863786748", "https://x.com/skocherhan/status/1913353390966321360", "https://x.com/Phish_Destroy/status/1906319749316841608", "https://x.com/skocherhan/status/1913119475555070215", "https://x.com/Phish_Destroy/status/1906468329696473163", "https://x.com/Phish_Destroy/status/1906315272274792498", "https://x.com/Phish_Destroy/status/1906445520366674328", "https://x.com/Phish_Destroy/status/1906377840750104927", "https://x.com/Phish_Destroy/status/1906446588009959840", "https://x.com/Phish_Destroy/status/1906406888176263456", "https://x.com/Phish_Destroy/status/1906315095480660149", "https://x.com/skocherhan/status/1913325523670794663", "https://x.com/skocherhan/status/1913065085599096931", "https://x.com/Phish_Destroy/status/1906408450428731903", "https://x.com/Phish_Destroy/status/1906319505753530653", "https://x.com/Phish_Destroy/status/1906322010382184528", "https://x.com/Phish_Destroy/status/1906399584844124534", "https://x.com/Phish_Destroy/status/1906323743141450089", "https://x.com/Phish_Destroy/status/1906410611753541670", "https://x.com/Phish_Destroy/status/1906409671230914693", "https://x.com/skocherhan/status/1913116627932971313", "https://x.com/Phish_Destroy/status/1906409787832627389", "https://x.com/Phish_Destroy/status/1906322427388330188", "https://x.com/Phish_Destroy/status/1906444990038884818", "https://x.com/Phish_Destroy/status/1906326166241182096", "https://x.com/Phish_Destroy/status/1906400070271955382" ], "related": { "alienvault": { "adversary": [], "malware_families": [], "industries": [] }, "other": { "adversary": [ "Multiple unidentified threat actors targeting cryptocurrency ecosystem" ], "malware_families": [ "Drainer" ], "industries": [ "Web3", "Crypto" ] } } }, "false_positive": [] }, "geo": {}, "geo_ipapicom": {}, "pulse_count": 12, "pulses": [ { "id": "69c081afa2bd54a9599b7c07", "name": "PhishDestroy \u2014 Active Phishing & Crypto Scam Domains", "description": "Real-time feed of phishing, crypto drainer, and scam domains detected by PhishDestroy (phishdestroy.io). Updated hourly. 108K+ domains tracked, 55K+ currently active. Source: github.com/phishdestroy/destroylist", "modified": "2026-05-24T00:00:03.049000", "created": "2026-03-22T23:56:29.438000", "tags": [ "phishing", "crypto", "scam", "drainer", "fraud", "blocklist", "phishdestroy" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 33, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "phishdestroy", "id": "348394", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 93266, "hostname": 57600 }, "indicator_count": 150866, "is_author": false, "is_subscribing": null, "subscriber_count": 99, "modified_text": "6 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69c08867316c564ade394c69", "name": "PhishDestroy \u2014 Content Active Threats (Live)", "description": "Live feed of phishing and crypto scam domains with ACTIVE malicious content from PhishDestroy. These domains are verified to have live phishing/scam pages. Updated hourly. Source: github.com/phishdestroy/destroylist/dns/content_active.json", "modified": "2026-05-21T12:06:19.702000", "created": "2026-03-23T00:25:09.116000", "tags": [ "phishing", "crypto", "scam", "drainer", "fraud", "blocklist", "phishdestroy", "active", "content" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "phishdestroy", "id": "348394", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 132502, "hostname": 66217 }, "indicator_count": 198719, "is_author": false, "is_subscribing": null, "subscriber_count": 44, "modified_text": "9 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69f83cb0ce73bef5c452bfb0", "name": "Credit: PhishDestroy Clone [\"phish detroy- open domains\"]", "description": "", "modified": "2026-05-04T06:29:04.332000", "created": "2026-05-04T06:29:04.332000", "tags": [ "phishing", "crypto", "scam", "drainer", "fraud", "blocklist", "phishdestroy" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": "69c081afa2bd54a9599b7c07", "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 88564, "hostname": 54516 }, "indicator_count": 143080, "is_author": false, "is_subscribing": null, "subscriber_count": 69, "modified_text": "26 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69f83caf1bef3609f0eb79e2", "name": "Credit: PhishDestroy Clone [\"phish detroy- open domains\"]", "description": "", "modified": "2026-05-04T06:29:03.120000", "created": "2026-05-04T06:29:03.120000", "tags": [ "phishing", "crypto", "scam", "drainer", "fraud", "blocklist", "phishdestroy" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": "69c081afa2bd54a9599b7c07", "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 88564, "hostname": 54516 }, "indicator_count": 143080, "is_author": false, "is_subscribing": null, "subscriber_count": 69, "modified_text": "26 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69f83cac7d6c947de6c080f9", "name": "Credit: PhishDestroy Clone [\"phish detroy- open domains\"]", "description": "", "modified": "2026-05-04T06:29:00.417000", "created": "2026-05-04T06:29:00.417000", "tags": [ "phishing", "crypto", "scam", "drainer", "fraud", "blocklist", "phishdestroy" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": "69c081afa2bd54a9599b7c07", "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 88564, "hostname": 54516 }, "indicator_count": 143080, "is_author": false, "is_subscribing": null, "subscriber_count": 68, "modified_text": "26 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69f83cab9769e92b3285a2b4", "name": "Credit: PhishDestroy Clone [\"phish detroy- open domains\"]", "description": "", "modified": "2026-05-04T06:28:59.770000", "created": "2026-05-04T06:28:59.770000", "tags": [ "phishing", "crypto", "scam", "drainer", "fraud", "blocklist", "phishdestroy" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": "69c081afa2bd54a9599b7c07", "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 88564, "hostname": 54516 }, "indicator_count": 143080, "is_author": false, "is_subscribing": null, "subscriber_count": 68, "modified_text": "26 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69f83cab7e03b19c5f1078e3", "name": "Credit: PhishDestroy Clone [\"phish detroy- open domains\"]", "description": "", "modified": "2026-05-04T06:28:59.113000", "created": "2026-05-04T06:28:59.113000", "tags": [ "phishing", "crypto", "scam", "drainer", "fraud", "blocklist", "phishdestroy" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": "69c081afa2bd54a9599b7c07", "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 88564, "hostname": 54516 }, "indicator_count": 143080, "is_author": false, "is_subscribing": null, "subscriber_count": 69, "modified_text": "26 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69f83ca9411c8ab5d294a7e2", "name": "Credit: PhishDestroy Clone [\"phish detroy- open domains\"]", "description": "", "modified": "2026-05-04T06:28:57.479000", "created": "2026-05-04T06:28:57.479000", "tags": [ "phishing", "crypto", "scam", "drainer", "fraud", "blocklist", "phishdestroy" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": "69c081afa2bd54a9599b7c07", "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 88564, "hostname": 54516 }, "indicator_count": 143080, "is_author": false, "is_subscribing": null, "subscriber_count": 68, "modified_text": "26 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69f83ca77d6c947de6c080f8", "name": "Credit: PhishDestroy Clone [\"phish detroy- open domains\"]", "description": "", "modified": "2026-05-04T06:28:55.093000", "created": "2026-05-04T06:28:55.093000", "tags": [ "phishing", "crypto", "scam", "drainer", "fraud", "blocklist", "phishdestroy" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": "69c081afa2bd54a9599b7c07", "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 88564, "hostname": 54516 }, "indicator_count": 143080, "is_author": false, "is_subscribing": null, "subscriber_count": 68, "modified_text": "26 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6895baa2f44f0d6a1f832067", "name": "destroylist", "description": "A curated snapshot of malicious domains targeting the cryptocurrency ecosystem \u2014 mainly wallet drainers and crypto phishing sites.\nCollected and verified from open threat-hunting operations between July 1, 2025 and the present date.\nAll indicators are cleaned from duplicates and provided as-is for analysts, SOC teams, and automated defenses.\n\nKey Details:\nFocus: Crypto drainers & phishing domains\n\nTimeframe: July 1, 2025 \u2014 August 2025\nVerified, deduplicated, and ready for integration\nSuitable for research, blocking lists, and enrichment", "modified": "2026-03-02T21:00:09.122000", "created": "2025-08-08T08:51:46.066000", "tags": [ "destroylist", "drainer", "crypto scam", "phishdestroy", "Cryptocurrency", "Blockchain" ], "references": [ "" ], "public": 1, "adversary": "Multiple unidentified threat actors targeting cryptocurrency ecosystem", "targeted_countries": [], "malware_families": [ { "id": "drainer", "display_name": "drainer", "target": null } ], "attack_ids": [], "industries": [ "web3", "crypto" ], "TLP": "white", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "phishdestroy", "id": "348394", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 13, "URL": 1361, "domain": 5908, "hostname": 1143 }, "indicator_count": 8425, "is_author": false, "is_subscribing": null, "subscriber_count": 28, "modified_text": "89 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 } ], "error": null, "vt": { "error": "VirusTotal rate limit reached. Try again shortly.", "indicator": "30eth.com", "type": "Domain" }, "abuseipdb": null, "urlhaus": { "indicator": "30eth.com", "found": false, "verdict": "clean", "urls": [], "error": null }, "from_cache": true, "_cached_at": 1780184952.7804272 }