DestroyScammers is an open-source phishing intelligence dashboard that maps scam domains, registrar records and infrastructure relationships for authorized fraud research and victim-supported investigations.
| Tool | phishdestroy/DestroyScammers — static-site phishing intelligence dashboard linking domains, threat detections, registrars and actor records |
| Primary Use | Exploring domain detections, registrar data and Relationship Graph links to attribute crypto phishing campaigns and preserve source-linked evidence |
| Primary Use | Analyzing crypto-phishing infrastructure and building documented case reports from domain indicators in authorized investigations |
| Safe Use | For authorized professionals: fraud investigators, defensive analysts and researchers working public data on scams they are formally involved with; the README itself frames use around legal OSINT, prior notice and correction channels |
| Telemetry Note | Purely passive: the dashboard runs locally against bundled JSON datasets; collection scripts that call urlscan-style APIs may leave query logs at those third-party services, but the tool touches no victim infrastructure |
phishdestroy/DestroyScammers sits in an interesting niche of the security tooling landscape: rather than an offensive scanner or a defensive sensor, it is an evidence-first intelligence dashboard for crypto phishing and drainer operations. The project, written in JavaScript and MIT-licensed with roughly 325 stars, ships as a static site plus a set of companion OSINT scripts, and its tagline — follow the domains, connect the infrastructure, preserve the evidence — describes the workflow precisely. It is aimed at fraud investigators, threat analysts and victim-side researchers who need to turn a single reported domain into a documented, source-linked picture of an actor's infrastructure.
The dashboard itself organizes data into four views. The Dashboard view summarizes the loaded dataset, detection totals and highlighted records. The Threat Actors view pairs actor records with the domain evidence associated with them, which is where attribution work happens. The Threats view lets you filter domain detections by type and registrar, then follow the underlying source references — scan results, historical pages and registrar records. Finally, the Relationship Graph renders the connections encoded in the dataset, which is the fastest way to see whether a fresh indicator ties into a known cluster or represents new infrastructure.
Architecturally, the project is deliberately simple and that simplicity is a feature. Everything is a static site: css/, js/ and data/ directories served over plain HTTP, with the intelligence payload living in local JSON files that the browser loads. There is no backend, no database and no telemetry. That matters for evidentiary hygiene — the dataset you analyze is pinned to a specific repository revision, and the README explicitly instructs users to record the revision alongside saved screenshots and timestamps when preserving findings. For anyone producing reports that may end up in a formal complaint, that reproducibility discipline is the difference between an assertion and evidence.
Running it locally is a two-command affair: git clone https://github.com/phishdestroy/DestroyScammers.git followed by python -m http.server 8000 from the repository root, then browsing to http://localhost:8000/. The README is careful to note that the HTTP server must run from the root so the asset paths resolve. A hosted instance is also linked (phishdestroy.github.io/DestroyScammers), but for casework the local route is preferable since it freezes both dataset and code against upstream changes. The separate collection utilities documented in scripts/README.md are explicitly called out as having their own dependencies and API-key requirements, so treat the dashboard and the collection tooling as two distinct components.
The investigation workflow the README prescribes is worth reading closely because it encodes a defensible methodology. Start with an indicator: the reported domain, URL or transaction reference plus when it was observed. Follow the sources through scans, historical captures, detection results and registrar records. Preserve everything — source links, timestamps, screenshots, the repo revision. Only then build the report explaining the sequence of events. This mirrors classic intelligence-cycle tradecraft applied to fraud cases, and it is refreshing to see a hobbyist-adjacent project enforce the evidentiary chain rather than jump straight to naming and shaming.
The project is not a standalone silo. It forms a small ecosystem: ScamIntelLogs holds chat exports, panel artifacts and operation-specific evidence; destroylist provides a consumable domain blocklist, which is the piece most directly useful to defenders running DNS filtering or proxy policies. The topics list signals the data plumbing behind the scenes — urlscan for scans, whoxy for registrar and WHOIS-history lookups — and the taxonomy (drainer-detection, brand-impersonation, crypto-phishing, actor-profiling) tells you the dataset is weighted toward wallet-drainer campaigns rather than generic credential phishing.
Where the project gets unusual is in its governance framing, and professionals should read that section before relying on it. The maintainer states that the named threats are not random individuals but correspondents who received at least one emailed request to cease activity before publication, and the README candidly acknowledges that prior correspondence documents notice without by itself resolving GDPR applicability — evidence and the basis for publishing are treated as separate questions. A SECURITY.md correction and security process is offered for factual errors and privacy concerns. That self-awareness is rare, but it also means the actor-attribution layer is fundamentally one researcher's case files, not an adjudicated dataset.
The narrative sections — case studies involving recoveries through UAE and Kazakhstan legal channels — are advocacy as much as documentation, arguing that scammers receive no state protection and that victims should report rather than stay silent. Operationally these anecdotes are not intelligence, but they illustrate the intended outcome of the workflow: enough preserved, source-linked evidence for a police report or cross-border case to actually move. One case detail, attribution aided by the scammer typing in the wrong keyboard layout, is a neat reminder that behavioral artifacts in support chats can be as decisive as infrastructure pivots.
For defenders, the practical takeaways are the dataset and the graph. Detection totals by type and registrar support takedown requests and registrar-abuse reporting, and the relationship data can seed blocklists beyond destroylist itself. Analysts should independently re-verify every indicator against the cited sources before acting on it, since a community-curated dataset cannot carry the same weight as primary telemetry — the dashboard's per-record source references exist precisely to enable that verification.
Caveats to weigh: the data reflects whatever the maintainer has collected, so coverage is anecdotal rather than exhaustive; attribution claims inherit one researcher's methodology and should be treated as leads, not verdicts; and privacy law around naming individuals varies by jurisdiction, so organizational use of the actor view may need legal review. None of this diminishes the engineering, which is clean, passive and reproducible.
As a piece of applied security tooling, DestroyScammers is best understood as a case-file explorer with graph and evidence discipline bolted on. For authorized fraud investigation, victim-side research and defensive blocklisting against crypto-phishing infrastructure, it offers a genuinely useful pattern: local datasets, source-linked records, revision pinning and a clear separation between collection, analysis and publication. Analysts who adopt its preservation workflow — indicator, sources, artifacts, revision, report — will find the tooling transfers well to any OSINT casework, crypto fraud or otherwise.
phishdestroy/DestroyScammers.Educational analysis for authorized security professionals. Use only in controlled, authorized environments.
Related coverage
0 comentários:
Post a Comment
Note: Only a member of this blog may post a comment.