How the scam database is built.
Three public threat feeds plus reviewed community reports, refreshed once a day and published as a static site. Here is exactly what that means — including its limits.
The pipeline
Once a day the feeds are fetched, cleaned and committed; the site is then rebuilt from that snapshot. Last refresh: November 10, 2026.
Where the data comes from
974 entries are currently listed. All three feeds are free and public; none is individually reviewed by us.
URLhaus (abuse.ch)
Hosts currently serving malware or phishing payloads. Carries a real "last online" time per entry. The feed could not be fetched on the last refresh, so entries shown are from the last successful one.
OpenPhish (community feed)
Phishing pages that are live right now. No per-entry timestamps, so we record when we first saw each one.
MyEtherWallet darklist
A curated blocklist of crypto scam and wallet-drainer domains. Listing means flagged, not necessarily active today.
Community reports
Submitted through the report form and read by a person before anything is published. Reporter contact details are never published.
What each entry records
Every entry is the same small record, whichever source it came from.
not a per-site analysis
What happens when you look something up
The lookup runs in your browser. What you type is not sent to us.
The index comes with the page
The homepage ships a compact index of every currently listed entry. There is no search server.
Your input is normalised
Lower-cased, with https://, www., spaces and punctuation stripped, so different ways of writing the same thing match.
It's matched against the index
An exact or partial match takes you to that entry's page, which names the source that listed it and when.
No match is not a clean bill of health
It only means the item isn't on these three feeds or in our reports today. New scam sites appear faster than any list can track.
Limits you should know about
We would rather be clear about these than have you rely on something the site can't do.
Updated daily, not live
A site that started scamming this morning may not appear until tomorrow, or at all.
Feed listings are automated
We don't verify each one. Feeds can be wrong, and a listed address can later be reassigned to someone legitimate — which is why delisted entries are marked and removed after 30 days.
Mostly websites
The feeds cover domains and hosts. Phone numbers, emails and wallets only appear through community reports.
Shared platforms are excluded
Feeds sometimes list a host like github.com because one malicious file sits on it. We drop those: the platform isn't the scam.