Data Collection Pipeline

Data Collection Pipeline

DestroyScammers uses a multi-stage OSINT pipeline:

1. Domain Acquisition

Domains are collected from:

• URLScan public API
• WebArchive (archived phishing pages)
• WHOIS enumeration through WHOXY (https://www.whoxy.com/)
• Blacklists and threat feeds
• Repository: https://github.com/phishdestroy/destroylist

2. Metadata Extraction

Each domain is enriched with:

• WHOIS data (registrar, registrant patterns, creation dates)
• IP + hosting AS
• NS/Registrar patterns
• Geolocation (if resolvable)
• Brand impersonation tags
• Risk scores from known sources

3. Evidence Snapshots

The pipeline collects:

• Screenshots of phishing pages
• HTML source
• JS drainer fingerprints
• Extracted wallet addresses
• Links to cloned pages

4. Actor Attribution

Domains are grouped by:

• WHOIS patterns
• Shared JS code
• Shared hosting clusters
• Reused phishing templates
• Reused email accounts
• URLScan patterns

Each cluster = one actor.

5. Final JSON Output

Each actor is stored as: data/actors/<actor>.json

Format includes:

• domains
• brand_impersonation
• blacklist_sources
• screenshots
• risk_score
• infrastructure metadata