Feedback regarding the phishdestroy/destroylist integration

[sertchan]

First of all, I want to appreciate your ongoing efforts to make the ⁠dns-servers⁠ project better and more comprehensive every day.
I would like to share some feedback regarding the recently added list: https://github.com/phishdestroy/destroylist

This project seems to focus heavily on crypto and feels quite raw compared to the other lists included in ⁠hagezi/dns-servers (Hagezi's TIF & DNSBUNKER's⁠ CTI). I believe the increased risk of false positives might outweigh its actual benefits, making it less efficient for most users compared to the other two TIF lists.

While I truly believe the developer is well-intentioned and a valuable contributor to the open-source community, I don't feel this list aligns well with the standards of the ⁠hagezi/dns-servers⁠ project right now. Specifically the heavy reliance on AI for documentation and website development along with a lack of manual curation, raises serious questions about the hygiene of the list. For a critical threat intelligence list that requires strict auditing. This is a concern.

The main reason so many people trust and support your DNS blocklist and servers project is the exceptional maintenance, high hygiene standards and manual effort behind it. It might be better to reconsider adding this list in the future once the project matures more.
These are just my honest thoughts, as I felt this update didn't entirely fit the project's current quality.

Sincerely,
Seyhan

[hagezi]

I’ve been testing the live list for quite some time and using it as a source in TIF. It adds clear value, especially in terms of phishing coverage. In the case of phishing, being able to block domains quickly provides an additional layer of protection.

Since TIF is not a real-time list, I added Phishdestroy as a live feed. So far, the false-positive rate has not been higher than the one in my TIF.

With malware lists, false positives do occur from time to time; that is simply unavoidable.

If there is a noticeable increase in false-positive domains, I will deactivate the list again. At the moment, however, I see no reason to do so.

[hagezi]

Perhaps @phishdestroy can explain how the list is generated and how to reduce false positives in the primary real-time feed.

[sertchan]

Yes, additional information would be highly appreciated.

[hagezi]

@sertchan To reduce noise, I now run external lists, specifically CTI and PhishDestroy, through my build system to remove popular or allowlisted domains that could be false positives before deploying the feeds to my DNS servers.

[sebihotza]

PhishDestroy is heavily focused on domains with deceptive cryptocurrency-related content. Is a dedicated live feed for cryptocurrency really needed for this project?

Furthermore, they rely on AI for everything. Their READMEs, blog posts, website content, and even threat reports are AI-generated. Over-reliance on AI leaves a poor impression. It is a major red flag that makes me question their quality assurance.

I do not trust this list/service enough to use it as a live feed, although I would avoid it entirely if I could.

[sertchan]

@hagezi, TBH our main concern isn't only about false positives. It's more about the developer’s general lack of attention to detail when it comes to list maintenance, documentation, and even their own website. We treat DNS as something incredibly sensitive, so we strongly believe that sources and methodologies should be as transparent as possible.
​I genuinely love this project and always try to support it as much as I can, which is why seeing this list get integrated today was honestly a bit disheartening for me and the my friends. Just wanted to flag this and share our thoughts

[DNSBunker]

PhishDestroy had too many FPs in my opinion and i don't trust it either

[hagezi]

It depends on which list you use. The community lists are useless; they’re just a combination of other feeds in a single list with lots of false positives. The live feed I use doesn’t have any more false positives than other feeds. As I mentioned, I’ve been using this list in TIF for quite some time - of course, in a cleaned-up form, just as it’s now used in the DNS server.

[sertchan]

@hagezi, Only %32 of PhishDestroy's live lists domains included in your TIF list. That means almost %70 of the domains are cleared. Does it really worth it?

used: https://github.com/badmojr/crosscheck tool. (I don't know if there is some calculation mistakes)

[hagezi]

@sertchan In the TIF, I exclude hoster subdomains that are typically taken offline within hours, as there are very large numbers of them. Including these would unnecessarily inflate the TIF without adding meaningful value. These domains cannot simply be classified as dead, since they still resolve but return a 404 error.

The excluded hoster domains are instead covered in the Badware Host list. At the same time, these host domains remain included in real-time feeds.

In addition, truly dead domains are removed from the TIF.

I also added the PhishDestroy list to improve live coverage, since the TIF is updated only 1–2 times per 24 hours.

I do not understand why this list is being criticized so heavily. If there are concrete reasons why the list is poor or provides no added value, present the facts. I did not add the list arbitrarily or without a logical basis.

[sertchan]

Thanks for the explanation. I'll close the issue now. If there is some update about this topic in the future, people can comment to the thread.

[sertchan]

@hagezi, This morning we got an 404 error on your Github profile. I hope everything is okay 😔

[hagezi]

Yes, my account and repositories were blocked. It seems an automated system got bored. The issue was resolved after I submitted a ticket to GitHub Support.
There are still a few loose ends I need to sort out.