500k+ domains taken down with under 0.5% false positives is seriously impressive for a volunteer effort. Something that might help your detection side: phishing kits often reuse the same registrant details, nameservers or mail servers across dozens of domains, so pivoting on those shared attributes catches the siblings of a reported domain early.

That's how the WhoisFreaks phishing domain feed is built (whoisfreaks.com/products/threat-intelligence-feed). It starts from verified seeds, expands through shared WHOIS and DNS pivots, and gives every record a 0 to 1 confidence value, delivered as a daily CSV. There's a free sample if you want to cross-check it against your destroylist. Respect for the work you're doing.