destroylist

Free

No page or API response opened on 19 Oct 2026 printed a dollar, euro, or pound price for destroylist. The SPDX field is MIT. The stats endpoint, the search endpoint, and the check endpoint answered without a key. The README presents the hosts file and the API as something you can add to a blocker. MIT describes the published list. It does not promise that every downstream format stays free if someone else repackages it, and this listing did not find a paid tier to warn about either. The counts, including 226612 and 223,719, are sizes of lists. They are not fees. The api_version 3.3 is a version string, not a plan. If a commercial feed later resells this list, cite that seller's price separately. The appeal URL on the example.com check is a review path, not a checkout.

The GitHub repository phishdestroy/destroylist describes a real-time phishing and scam domain blocklist, and its description line says 205k+. That shorthand is not the count this listing uses. count.json, fetched the same morning, has schemaVersion 1, label Primary Entries, and message 223,719. metrics.json, generatedAt 2026-10-19T07:41:20.355501Z, says counts are exact entries in each published feed and that the API may report smaller normalized-unique domain counts after URL, www, and duplicate normalization. Its primary value is 223719, defined as entries in list.json, not a liveness count. primary_dns is 136685. community is 1132946. community_dns is 490645.

• 205k+ is the description. The GitHub description says 205k+. count.json the same morning said Primary Entries 223,719. They are different sentences.
• The API is a later sync. api_version 3.3 at 2026-10-19T08:08:03Z reported primary 226612 and total_unique 1135315.
• paypal returned five hosts. limit 5 came back with count 5, each a paypal-impersonation name under antimoney-laundering.org.

1. 1

   Name the field you counted: description, count.json, metrics primary, or API primary.

2. 2

   Search a brand keyword and read the hostnames as impersonation leads, not as the brand.

3. 3

   Use the check message as written when a domain is marked as a reviewed false positive.

• A blocker config needs a count and a URL. On 19 Oct 2026 the GitHub description said 205k+, count.json said Primary Entries 223,719, and the API primary field said 226612 at lastSync 2026-10-19T08:08:03Z, api_version 3.3. metrics.json said primary 223719 and warned that the API can be a smaller normalized-unique count. Pick the field and name it. The SPDX field is MIT. The hosts file URL is the one in the README.
• A brand search is the check you can show. GET /v1/search?q=paypal&limit=5 returned count 5 and five hostnames under antimoney-laundering.org. Those names imitate PayPal. They are not PayPal. A list hit is a lead. It is not a finding that the brand itself was compromised, and it is not a conviction.
• example.com is about to be described as absent. The check on 19 Oct 2026 returned whitelisted true and the message Reviewed and cleared as a false positive, checked_at 2026-10-19T08:03:22.377Z. That is a reviewed clear. It is not the same sentence as a domain the list has never carried. The API repo field points at GitLab. The README read here is the GitHub clone.

Hard cases

The case where the first result is easy to over-read.

Questions

Titled sources. These public pages are what the quotes on this listing come from.