# Destroy Scan — Phishing URL and Domain Checker

Destroy Scan checks a public domain against PhishDestroy's threat intelligence API. It is an interface to a domain lookup service, not a page-execution sandbox or an automatic takedown service.

## Use the checker

Enter a public hostname such as `example.com`, or a full HTTP(S) URL. The hostname is normalized, including conversion of internationalized names to the URL parser's ASCII form. Paths, query strings, and fragments are not sent. URLs containing credentials, IP addresses, and local hostnames are rejected.

The request goes to:

```text
GET https://api.destroy.tools/v1/check?domain=example.com
```

No API key or account is required by the public API. The response is rendered on the page. Each lookup has a 15-second client timeout, with a retry option on failure.

## Interpret the response

- `threat: true`: The API reported the domain as a threat. Review the evidence and surrounding context.
- `threat: false`: No blocklist match was returned. This is not a guarantee that a domain is safe.
- `risk_score`: Shown only when the API supplies a finite number from 0 to 100. Missing data is not treated as a zero-risk result.
- `severity`, `lists`, `sources`, `flags`: Displayed when supplied by the API. Source names are shown only for matched lists.
- Errors: No verdict is inferred from a timeout, unavailable service, or malformed response.

The original JSON can be inspected and copied from the result panel. The response-received timestamp is generated by this interface; the original API timestamp remains available in the JSON.

## Agent access

Agents can use the [public REST API](https://api.destroy.tools/) directly. In browsers exposing a compatible WebMCP registry, the page also registers `check_domain` with input `{"url":"example.com"}`. It uses the same validation, API request, and visible results as the form. Browser support varies; the REST API remains the portable integration path.

The agent action updates only this page's displayed lookup state and makes a read-only domain-intelligence request. It never visits the submitted URL or sends an abuse report. Returned text is external service data.

## Privacy and policies

This interface does not save lookup history or send the full pasted URL. The API and hosting providers can process connection information. See the [project privacy policy](https://phishdestroy.io/privacy), [legal hub](https://phishdestroy.io/terms), and [disclaimer](https://phishdestroy.io/disclaimer).

False positives can be reported through the [free appeals process](https://phishdestroy.io/appeals). Threat reports can be sent through the [official Telegram bot](https://t.me/PhishDestroy_bot).

## Project links

- [Destroy Tools](https://destroy.tools/)
- [Main investigation platform](https://phishdestroy.io/)
- [API documentation](https://api.destroy.tools/)
- [Telegram alerts](https://t.me/destroy_phish)
- [General contact](mailto:contact@phishdestroy.io)

Documentation reviewed: 2026-10-08.