# PhishDestroy domain threat record: getlist.forum

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/getlist.forum/
Machine-readable companion: https://phishdestroy.io/domain/getlist.forum/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: not observed active
- First observed by PhishDestroy: 2026-09-29 01:26:26 UTC
- Last availability or vendor check: 2026-10-21 01:21:11 UTC
- Stored record updated: 2026-10-22 14:22:26 UTC
- VirusTotal detections in the stored snapshot: 9/91
- Independent public blocklist matches in the stored snapshot: 3
- Matching public blocklists: MetaMask, ScamSniffer, SEAL
- Google Safe Browsing stored result: no stored flag

## Stored classification

- Targeted brand: MetaMask

## Stored infrastructure

- Observed IP address: 91.92.33.241
- Registrar in stored WHOIS data: Registrar.eu
- Registrar country in stored WHOIS data: Unknown
- Registration date (registry RDAP, getlist.forum): 2026-09-27 18:03:25 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a0eacb-f3c6-7561-b56f-472b8fb444cd/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/getlist.forum
- Certificate Transparency search: https://crt.sh/?q=%25.getlist.forum
- Web Archive lookup: https://web.archive.org/web/*/https://getlist.forum/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
getlist.forum is an impersonation phishing page that presents itself under the plain title "Vote", posing as a voting or polling page to draw in visitors. Crypto-focused blocklists maintained by MetaMask, ScamSniffer and SEAL have listed it, which points to crypto wallet holders as the intended targets. PhishDestroy first detected it on 2026-09-29. It was still online with its phishing content live on 2026-10-19.

How the scam works
Scams built on a "Vote" page typically copy a project's governance, community poll or giveaway vote and ask the visitor to log in or connect a wallet before they can take part. The voting step is only a pretext. Whatever the victim hands over, whether credentials, a recovery phrase, a wallet signature or a token approval, goes to the operators. Once they have it, they can take over accounts or move funds out of the connected wallet.

Evidence
On 2026-09-30, 9 of 91 VirusTotal engines flagged the domain, including alphaMountain.ai, BitDefender, CRDF, Forcepoint ThreatSeeker, Fortinet, G-Data, Gridinsoft and Kaspersky. That is a modest count, but it comes from a mix of established antivirus vendors and threat-intel feeds. Inclusion on the MetaMask, ScamSniffer and SEAL lists carries more weight for crypto users, because those lists protect wallets directly. Spamhaus also lists the domain in its DBL under the spam category.

Infrastructure
The domain was registered through Registrar.eu on 2026-09-27, two days before PhishDestroy caught it, which fits a site set up for a short, targeted campaign. It is hosted in Germany on the DEDIK SERVICES LIMITED network. The site uses a free Let's Encrypt certificate, so the padlock in the browser says nothing about whether the page is legitimate.

What to do
Do not vote, log in or connect a wallet on getlist.forum. If you entered a password there, change it everywhere you reuse it and turn on app-based 2FA. If you typed a seed phrase, treat that wallet as compromised and move any remaining assets to a new one immediately. If you connected a wallet or signed anything, review and revoke token approvals with a trusted approval-checker and watch for unexpected transactions. Defenders should block the domain at DNS and proxy level and report it to the registrar and the hosting provider.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a0eacb-f3c6-7561-b56f-472b8fb444cd/
VirusTotal report: https://www.virustotal.com/gui/domain/getlist.forum
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=getlist.forum
Archived copy: https://web.archive.org/web/20260929012828/https://getlist.forum/
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-19 09:33:12 UTC

## Stored page captures

- Primary capture: https://i.ibb.co/7dpD6bjj/03e69bd48a1e.png
  Captured: 2026-09-29 01:34:32 UTC
- URLScan capture 1: https://screenshots.phishdestroy.io/01a0eacb-f3c6-7561-b56f-472b8fb444cd.png
  Captured: 2026-09-29 01:34:32 UTC
  Source report: https://urlscan.io/result/01a0eacb-f3c6-7561-b56f-472b8fb444cd/
- URLScan capture 2: https://urlscan.io/screenshots/01a0e418-ef17-750e-ac13-bbb240503ce6.png
  Captured: 2026-09-29 01:26:26 UTC
  Source report: https://urlscan.io/result/01a0eacb-f3c6-7561-b56f-472b8fb444cd/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/601ef6cc-7912-4522-8ad8-bc67de9f633e.png
  Captured: 2026-09-29 01:29:46 UTC
  Source report: https://radar.cloudflare.com/scan/601ef6cc-7912-4522-8ad8-bc67de9f633e
  SHA-256: d8362305a88f04c300b333f4ade002f7eabda3dcb1c7aac6885ad61f865e171b
- URLQuery: https://screenshots.phishdestroy.io/uq/94df9ff4-65e0-4bc5-aead-9eef959be04e.png
  Source report: https://urlquery.net/report/94df9ff4-65e0-4bc5-aead-9eef959be04e
  SHA-256: 6bfe70497b51401ed202c61113cf2264a1aa184031a6d1d1d233f0db47d0ecdc
- URLScan · 2026-09-27: https://screenshots.phishdestroy.io/us/01a0e418-f1bf-71ad-b3de-95c5dc9548a6.png
  Captured: 2026-09-27 18:20:41 UTC
  Source report: https://urlscan.io/result/01a0e418-f1bf-71ad-b3de-95c5dc9548a6/
  SHA-256: 05cff7990ae3acc816b5bace0ec0bf736f3817faceee4e3d21364cb2b15d0bc7
- URLScan · 2026-09-27: https://screenshots.phishdestroy.io/us/01a0e418-ef17-750e-ac13-bbb240503ce6.png
  Captured: 2026-09-27 18:20:43 UTC
  Source report: https://urlscan.io/result/01a0e418-ef17-750e-ac13-bbb240503ce6/
  SHA-256: 7a9029811f1ed6957dccb0c43663cb9ac89b3b6b19ec95b0ccb488ad1d6ac264
- URLScan · 2026-09-29: https://screenshots.phishdestroy.io/us/01a0eac7-336c-74e8-bbb6-6c9ff65bc163.png
  Captured: 2026-09-29 01:28:50 UTC
  Source report: https://urlscan.io/result/01a0eac7-336c-74e8-bbb6-6c9ff65bc163/
  SHA-256: 55454f4ab3d6e4ea900e87880b5f939f5b5be4640173d552a07c8944dd024d40
- URLScan · 2026-10-17: https://screenshots.phishdestroy.io/us/01a14a6e-ae09-755a-86f0-c3475dea6139.png
  Captured: 2026-10-17 15:15:36 UTC
  Source report: https://urlscan.io/result/01a14a6e-ae09-755a-86f0-c3475dea6139/
  SHA-256: 45360fddaa2a9535d2e4150d41f5bdc375465da4a4cfd0f56e1923db4e952a58
- URLScan · 2026-10-17: https://screenshots.phishdestroy.io/us/01a14a6e-b073-71b8-8414-7588e0d6623d.png
  Captured: 2026-10-17 15:15:38 UTC
  Source report: https://urlscan.io/result/01a14a6e-b073-71b8-8414-7588e0d6623d/
  SHA-256: b894ddaac24f136a36db1932f255f8d6e4f10107307152ec59113664d8446dc6
- URLScan · 2026-10-17: https://screenshots.phishdestroy.io/us/01a14bd9-8df6-777e-9b96-fb02f9fcd54d.png
  Captured: 2026-10-17 21:52:01 UTC
  Source report: https://urlscan.io/result/01a14bd9-8df6-777e-9b96-fb02f9fcd54d/
  SHA-256: c16f136f8b67aa6ce1b6627f25ab6dd633232e6bbda8522b0486112319532cd2

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-20T20:55:14Z",
        "uuid": "01a0eacb-f3c6-7561-b56f-472b8fb444cd",
        "scanned_at": "2026-09-29T01:33:57Z",
        "final_url": "https://getlist.forum/",
        "status": 200,
        "redirected": "https-only",
        "redirects": [
            {
                "to": "https://getlist.forum/",
                "from": "http://getlist.forum/",
                "status": 307
            }
        ],
        "ip": "91.92.33.241",
        "domains": [
            "coinmarketcap.com"
        ],
        "ips": [
            "3.174.46.81",
            "91.92.33.241"
        ],
        "asns": [
            "16509",
            "207043"
        ],
        "countries": [
            "US",
            "DE"
        ],
        "doc_hash": "0490aba0a5f7f69806a8d1df23eda36d442aa39d4811b33de0647ee2e5f43b0b",
        "globals": [
            "requestResize"
        ],
        "tls": {
            "san": [
                "getlist.forum"
            ],
            "cipher": "AES_256_GCM",
            "issuer": "YR1",
            "subject": "getlist.forum",
            "protocol": "TLS 1.3",
            "valid_to": "2026-12-26T17:12:51Z",
            "valid_from": "2026-09-27T17:12:52Z"
        },
        "domain_age_days": 1,
        "apex_age_days": 1,
        "tls_age_days": 1,
        "tls_valid_days": 89,
        "requests": 2,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 94,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "server": "SimpleHTTP/0.6 Python/3.10.12",
            "content-type": "text/html; charset=utf-8"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-20T21:03:50Z",
        "uuid": "601ef6cc-7912-4522-8ad8-bc67de9f633e",
        "scanned_at": "2026-09-29T01:29:46Z",
        "final_url": "https://getlist.forum/",
        "status": 200,
        "history": [
            {
                "url": "https://getlist.forum/",
                "status": 200
            }
        ],
        "dom_hash": "fa151566b5b2b76a94921867a304b9380f08a5ada4e30efdfa28788f3bffbe89",
        "doc_hash": "0490aba0a5f7f69806a8d1df23eda36d442aa39d4811b33de0647ee2e5f43b0b",
        "domain_risks": [
            "Newly Seen Domains",
            "Security Risks"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "getlist.forum",
                "type": "A",
                "value": "91.92.33.241"
            }
        ],
        "dnssec_valid": false,
        "ip": "91.92.33.241",
        "whois": {
            "registrar": "Registrar.eu",
            "created": "2026-09-27T18:03:25Z",
            "updated": "2026-09-27T18:03:30Z",
            "expires": "2027-09-27T18:03:25Z",
            "nameservers": [
                "khloe.ns.cloudflare.com",
                "neil.ns.cloudflare.com"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-21T16:44:04Z",
        "analysis_at": "2026-10-21T06:41:31Z",
        "stats": {
            "timeout": 0,
            "harmless": 46,
            "malicious": 10,
            "suspicious": 2,
            "undetected": 34
        },
        "detections": {
            "CRDF": "malicious",
            "G-Data": "phishing",
            "Lionic": "phishing",
            "Sophos": "phishing",
            "Fortinet": "spam",
            "SOCRadar": "phishing",
            "Kaspersky": "phishing",
            "LevelBlue": "phishing",
            "Gridinsoft": "suspicious",
            "BitDefender": "phishing",
            "alphaMountain.ai": "malicious",
            "Forcepoint ThreatSeeker": "phishing"
        },
        "reputation": 0,
        "categories": {
            "Sophos": "phishing and fraud",
            "alphaMountain.ai": "Spam, Newly Registered (alphaMountain.ai)",
            "Forcepoint ThreatSeeker": "phishing and other frauds"
        },
        "registrar": "Registrar.eu",
        "created": "2026-09-27T18:03:25Z",
        "expires": "2027-09-27T18:03:25Z",
        "updated": "2026-09-27T18:03:30Z",
        "first_seen": "2026-09-27T18:20:45Z",
        "dns": [
            {
                "ttl": 21600,
                "type": "NS",
                "value": "neil.ns.cloudflare.com"
            },
            {
                "ttl": 1800,
                "type": "SOA",
                "rname": "dns.cloudflare.com",
                "value": "khloe.ns.cloudflare.com"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "khloe.ns.cloudflare.com"
            },
            {
                "ttl": 60,
                "type": "A",
                "value": "91.92.33.241"
            }
        ],
        "dns_at": "2026-10-17T17:07:13Z",
        "jarm": "2ad2ad0002ad2ad00042d42d00000051af7d8070a18e002eaaedf620fa118c",
        "cert": {
            "san": [
                "getlist.forum"
            ],
            "issuer": "Let's Encrypt / YR1",
            "serial": "5ae3a6fb97943f1899dc8d454e14ab1269d",
            "sha256": "6a9e971b6e8ad41bf48da823411a2f53fdcfb5104f1dedbcb4319ff78577b535",
            "subject": "getlist.forum",
            "valid_to": "2026-12-26T17:12:51Z",
            "valid_from": "2026-09-27T17:12:52Z"
        },
        "whois": {
            "registrar": "Registrar.eu",
            "registrar_iana_id": "1647",
            "registrar_url": "www.registrar.eu",
            "created": "2026-09-27T18:03:25Z",
            "updated": "2026-09-27T18:03:30Z",
            "expires": "2027-09-27T18:03:25Z",
            "status": [
                "addPeriod",
                "clientTransferProhibited"
            ],
            "nameservers": [
                "khloe.ns.cloudflare.com",
                "neil.ns.cloudflare.com"
            ],
            "dnssec": "unsigned"
        },
        "rdap": {
            "status": [
                "client transfer prohibited"
            ],
            "events": {
                "expiration": "2027-09-27T18:03:25Z",
                "registration": "2026-09-27T18:03:25Z",
                "registrar expiration": "2027-09-27T18:03:25Z",
                "last update of RDAP database": "2026-10-17T15:16:00Z"
            }
        }
    }
}
```