This is a feed of ✨ fresh crypto phishing and crypto scam websites/domains/URLs.
It's a mix of various crypto phishing, crypto scams, drainers, crypto romance scams, and pig butchering scam website URLs.
Let's be real, crypto scammers are some of the worst of the worst bottom feeders in the cybercrime world. If you wanna help fuck with scammers and help perhaps prevent future people from being scammed, roll this threat intel feed into places and block lists where it can help. Block these websites and/or report them to help get them taken down.
This list will work if you want to import it into your Pi-hole instance or any other blacklists.
You can also use this list to perform dir scans against them to find interesting/important files. Every now and then it can lead to you finding their infra, setup panels, and even raw data. Check out using the PhishingSecList that I created specifically for scanning these types of finanacial, phishing, and crypto fraud websites. It can reveal a ton of useful intel during your recon and hunting phase.
Block these urls from being able to be inboxed at your org. Block em from being able to be accessed on your networks. Block them from being able to be shared on your platforms messaging system. Block em everywhere!
-
Raw blocklist: here
-
Pi-Hole, AdGuard, uBlock Origin, Sophos Firewall:
https://raw.githubusercontent.com/spmedia/Crypto-Scam-and-Crypto-Phishing-Threat-Intel-Feed/refs/heads/main/detected_urls.txt
- Squid: detected_urls.txt
Analysis of ~700 current crypto scam domains by Top Level Domain (Updated: August 2025)
| Rank | TLD | Count | Percentage |
|---|---|---|---|
| 1 | .com | 358 | 51.2% |
| 2 | .top | 37 | 5.3% |
| 3 | .net | 34 | 4.8% |
| 4 | .io | 34 | 4.8% |
| 5 | .vip | 31 | 4.5% |
| 6 | .cc | 28 | 3.9% |
| 7 | .org | 28 | 3.9% |
| 8 | .co | 12 | 1.7% |
| 9 | .xyz | 12 | 1.7% |
| 10 | .ai | 11 | 1.5% |
| 11 | .live | 10 | 1.4% |
| 12 | .site | 7 | 1.0% |
| 13 | .us | 6 | 0.9% |
| 14 | .info | 6 | 0.9% |
| 15 | .global | 6 | 0.9% |
| 16 | .finance | 5 | 0.7% |
| 17 | .online | 5 | 0.7% |
| 18 | .fun | 5 | 0.7% |
| 19 | .shop | 5 | 0.7% |
| 20 | Others | 60 | 8.6% |
- .com domains still dominate with 51.2% of all current scam URLs
- New TLDs emerging: .finance, .online, .fun, and .shop now appear in top threats
- .ai domains increasing - 11 domains (1.5%), likely exploiting AI hype
- Geographic diversity: 60+ different TLDs across multiple jurisdictions
- Evolution pattern: Scammers adapting to use trendy and legitimate-sounding TLDs
- Trust exploitation: High-trust TLDs (.com, .org, .net) remain heavily abused
Data Source: spmedia Crypto-Scam-and-Crypto-Phishing-Threat-Intel-Feed (this repo duh)
Last Updated: August 2025
Total Domains Analyzed: ~700 active crypto scam domains
- Updated daily via 🤖
- Live scam domains
- Works across firewalls, browsers, proxies, and more
- Works with DNS servers like PowerDNS or BIND9
- All domains added to this list are 1 year old or less (domain age wise) at the time of being added
- Freshest/new domains are added to the bottom of the list
Caution
These websites are actively being used to scam people and steal money/crypto. The author of this list takes no responsibility for any misuse or loss of funds (but if you take down any of these sites, holla at a koala and lmk).
To have your domain removed from this list, open an ISSUE if you believe you have been wrongly listed. State yo case.
All the CTI and threat intel nerds out there, dc225, Cybersecurity Stickers, & people hunting down scammers.
Please share this list with any other researchers you know that might find it useful <3