# PhishDestroy domain threat record: castvote.forum

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/castvote.forum/
Machine-readable companion: https://phishdestroy.io/domain/castvote.forum/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-09-25 05:40:57 UTC
- Last availability or vendor check: 2026-10-22 10:27:00 UTC
- Stored record updated: 2026-10-22 16:07:29 UTC
- VirusTotal detections in the stored snapshot: 8/92
- Independent public blocklist matches in the stored snapshot: 3
- Matching public blocklists: MetaMask, ScamSniffer, SEAL
- Google Safe Browsing stored result: no stored flag

## Stored classification

- Targeted brand: MetaMask

## Stored infrastructure

- Observed IP address: 2.27.248.227
- Registrar in stored WHOIS data: Registrar.eu
- Registrar country in stored WHOIS data: Unknown
- Last stored HTTP status: 200

## Evidence links

- URLScan report: https://urlscan.io/result/01a0d71c-3e91-71ef-8d76-00df5c760329/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/castvote.forum
- Certificate Transparency search: https://crt.sh/?q=%25.castvote.forum
- Web Archive lookup: https://web.archive.org/web/*/https://castvote.forum/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
castvote.forum is an impersonation phishing page that presents itself as a voting portal under the bare page title "Vote". MetaMask, ScamSniffer and SEAL all list it, which places its targets among crypto wallet users. PhishDestroy first saw it on 2026-09-25, and it was still online and serving live content on 2026-10-19.

How the scam works
Fake "vote" pages usually borrow the look of a governance poll, community ballot or contest. The visitor is told that casting a vote requires logging in or connecting a wallet. That step is where the theft happens. Depending on the lure, victims lose account credentials, or they sign a wallet request that hands an attacker control over their tokens. The single-word title "Vote" and the forum-style domain are the whole pitch: an urgent, low-effort action that seems harmless to complete.

Evidence
On 2026-10-07, 8 of 92 VirusTotal engines flagged the domain: alphaMountain.ai, CRDF, Forcepoint ThreatSeeker, Fortinet, Gridinsoft, Kaspersky, SOCRadar and Sophos. That is a minority of engines, but they are well-known vendors. Wallet-focused blocklists back them up: MetaMask, ScamSniffer and SEAL all list the domain alongside PhishDestroy. Spamhaus carries it in its DBL as spam, and four AlienVault OTX threat pulses reference it. Taken together, these are independent signals from the general security and Web3 communities.

Infrastructure
The domain was registered through Registrar.eu on 2026-09-24, and PhishDestroy detected it the next day. That gap is typical of a site built to be used immediately rather than to build any history. It resolves to 2.27.248.227 on the DEDIK SERVICES LIMITED network in Germany. Its Let's Encrypt certificate is free and automatic, so the padlock in the browser says nothing about who runs the site.

What to do
Do not open castvote.forum or follow links to it, however legitimate the vote sounds. If you entered a password or login there, change it right away, starting with any other account that uses the same password, and turn on two-factor authentication. If you connected a wallet or signed anything, review and revoke token approvals with a trusted revocation tool. Move remaining funds to a fresh wallet if you shared a seed phrase. Defenders should block the domain and its IP at DNS and proxy level and check logs for visits since 2026-09-25.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a0d71c-3e91-71ef-8d76-00df5c760329/
VirusTotal report: https://www.virustotal.com/gui/domain/castvote.forum
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=castvote.forum
Archived copy: https://web.archive.org/web/20260925062940/https://castvote.forum/
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-19 09:34:28 UTC

## Stored page captures

- Primary capture: https://i.ibb.co/S4JMz4F2/c5741399bd25.png
  Captured: 2026-09-25 05:50:49 UTC
- URLScan capture 1: https://screenshots.phishdestroy.io/01a0d71c-3e91-71ef-8d76-00df5c760329.png
  Captured: 2026-09-25 05:50:49 UTC
  Source report: https://urlscan.io/result/01a0d71c-3e91-71ef-8d76-00df5c760329/
- URLScan capture 2: https://urlscan.io/screenshots/01a0d51e-b8a1-7418-9413-0b2c567b0e10.png
  Captured: 2026-09-25 05:40:57 UTC
  Source report: https://urlscan.io/result/01a0d71c-3e91-71ef-8d76-00df5c760329/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/1e3ddd11-ce48-4fa0-bb9a-328b4b05cb40.png
  Captured: 2026-09-25 05:46:23 UTC
  Source report: https://radar.cloudflare.com/scan/1e3ddd11-ce48-4fa0-bb9a-328b4b05cb40
  SHA-256: f2a286e3cce80759c2cc1319f22ab20d826b4f5a2b080fb94aeda25694e4633f
- URLQuery: https://screenshots.phishdestroy.io/uq/17ea38a4-8c97-4b55-9cbf-1325dc84b217.png
  Source report: https://urlquery.net/report/17ea38a4-8c97-4b55-9cbf-1325dc84b217
  SHA-256: dcfa038cef631e56d6ccb2ff89f081d7f39bc31c709e6bcc896e2efecb66f315

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-20T20:58:24Z",
        "uuid": "01a0d71c-3e91-71ef-8d76-00df5c760329",
        "scanned_at": "2026-09-25T05:49:14Z",
        "final_url": "https://castvote.forum/",
        "status": 200,
        "redirected": "https-only",
        "redirects": [
            {
                "to": "https://castvote.forum/",
                "from": "http://castvote.forum/",
                "status": 307
            }
        ],
        "ip": "2.27.248.227",
        "domains": [
            "coinmarketcap.com"
        ],
        "ips": [
            "18.67.93.100",
            "2.27.248.227"
        ],
        "asns": [
            "16509",
            "207043"
        ],
        "countries": [
            "US",
            "DE"
        ],
        "doc_hash": "30ace9b46fc061d9311c25c59f5aa2059ccb8842a105a9fde62a567dcf6ee3d4",
        "globals": [
            "requestResize"
        ],
        "tls": {
            "san": [
                "castvote.forum"
            ],
            "cipher": "AES_256_GCM",
            "issuer": "YR1",
            "subject": "castvote.forum",
            "protocol": "TLS 1.3",
            "valid_to": "2026-12-23T19:12:33Z",
            "valid_from": "2026-09-24T19:12:34Z"
        },
        "domain_age_days": 0,
        "apex_age_days": 0,
        "tls_age_days": 0,
        "tls_valid_days": 89,
        "requests": 2,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 94,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "server": "SimpleHTTP/0.6 Python/3.10.12",
            "content-type": "text/html; charset=utf-8"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-20T21:05:55Z",
        "uuid": "1e3ddd11-ce48-4fa0-bb9a-328b4b05cb40",
        "scanned_at": "2026-09-25T05:46:23Z",
        "final_url": "https://castvote.forum/",
        "status": 200,
        "history": [
            {
                "url": "https://castvote.forum/",
                "status": 200
            }
        ],
        "dom_hash": "bf1f50c49efdc3a8f59c23f3e6d8d1c64a8b3996227f608f3c0d8f6867a700c6",
        "doc_hash": "30ace9b46fc061d9311c25c59f5aa2059ccb8842a105a9fde62a567dcf6ee3d4",
        "domain_risks": [
            "Newly Seen Domains",
            "Security Risks"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "castvote.forum",
                "type": "A",
                "value": "2.27.248.227"
            }
        ],
        "dnssec_valid": false,
        "ip": "2.27.248.227",
        "whois": {
            "registrar": "Registrar.eu",
            "created": "2026-09-24T20:00:38Z",
            "updated": "2026-09-24T20:00:41Z",
            "expires": "2027-09-24T20:00:38Z",
            "nameservers": [
                "janet.ns.cloudflare.com",
                "trevor.ns.cloudflare.com"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-21T18:09:20Z",
        "analysis_at": "2026-10-17T17:01:42Z",
        "stats": {
            "timeout": 0,
            "harmless": 50,
            "malicious": 4,
            "suspicious": 3,
            "undetected": 35
        },
        "detections": {
            "CRDF": "malicious",
            "Sophos": "phishing",
            "Fortinet": "spam",
            "SOCRadar": "phishing",
            "Gridinsoft": "suspicious",
            "alphaMountain.ai": "spam",
            "Forcepoint ThreatSeeker": "phishing"
        },
        "reputation": 0,
        "registrar": "Registrar.eu",
        "created": "2026-09-24T20:00:38Z",
        "expires": "2027-09-24T20:00:38Z",
        "updated": "2026-09-24T20:00:41Z",
        "first_seen": "2026-09-24T20:32:46Z",
        "dns": [
            {
                "ttl": 21600,
                "type": "NS",
                "value": "trevor.ns.cloudflare.com"
            },
            {
                "ttl": 60,
                "type": "A",
                "value": "2.27.248.227"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "janet.ns.cloudflare.com"
            },
            {
                "ttl": 1800,
                "type": "SOA",
                "rname": "dns.cloudflare.com",
                "value": "janet.ns.cloudflare.com"
            }
        ],
        "dns_at": "2026-10-17T17:07:37Z",
        "jarm": "2ad2ad0002ad2ad00042d42d00000051af7d8070a18e002eaaedf620fa118c",
        "cert": {
            "san": [
                "castvote.forum"
            ],
            "issuer": "Let's Encrypt / YR1",
            "serial": "6a18262a5e66870791d81e6d70bdc581b6d",
            "sha256": "d6d6179e114dbbcbee03f5e43a3feb531296eb0f2fa32253ecc92cdff00ae001",
            "subject": "castvote.forum",
            "valid_to": "2026-12-23T19:12:33Z",
            "valid_from": "2026-09-24T19:12:34Z"
        },
        "whois": {
            "registrar": "Registrar.eu",
            "registrar_iana_id": "1647",
            "registrar_url": "www.registrar.eu",
            "created": "2026-09-24T20:00:38Z",
            "updated": "2026-09-24T20:00:41Z",
            "expires": "2027-09-24T20:00:38Z",
            "status": [
                "addPeriod",
                "clientTransferProhibited"
            ],
            "nameservers": [
                "janet.ns.cloudflare.com",
                "trevor.ns.cloudflare.com"
            ],
            "dnssec": "unsigned"
        },
        "rdap": {
            "status": [
                "client transfer prohibited"
            ],
            "events": {
                "expiration": "2027-09-24T20:00:38Z",
                "registration": "2026-09-24T20:00:38Z",
                "registrar expiration": "2027-09-24T20:00:38Z",
                "last update of RDAP database": "2026-10-17T15:17:35Z"
            }
        }
    }
}
```