# PhishDestroy domain threat record: getvotes.forum

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/getvotes.forum/
Machine-readable companion: https://phishdestroy.io/domain/getvotes.forum/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: not observed active
- First observed by PhishDestroy: 2026-09-27 14:39:39 UTC
- Last availability or vendor check: 2026-10-21 01:21:10 UTC
- Stored record updated: 2026-10-22 14:22:27 UTC
- VirusTotal detections in the stored snapshot: 6/91
- Independent public blocklist matches in the stored snapshot: 3
- Matching public blocklists: MetaMask, ScamSniffer, SEAL
- Google Safe Browsing stored result: no stored flag

## Stored classification

- Targeted brand: MetaMask

## Stored infrastructure

- Observed IP address: 93.152.220.66
- Registrar in stored WHOIS data: Registrar.eu
- Registrar country in stored WHOIS data: Unknown
- Registration date (registry RDAP, getvotes.forum): 2026-09-27 09:24:24 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a0e350-a669-73da-9460-4ec6eb2e0e9c/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/getvotes.forum
- Certificate Transparency search: https://crt.sh/?q=%25.getvotes.forum
- Web Archive lookup: https://web.archive.org/web/*/https://getvotes.forum/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
getvotes.forum is an impersonation phishing page that presents itself under the plain title "Vote", posing as a legitimate poll or governance vote. Its appearance on the MetaMask, ScamSniffer and SEAL blocklists points to crypto wallet holders as the intended audience. PhishDestroy first detected it on 2026-09-27, the same day the domain was registered. As of 2026-10-19 the site was still online and serving its content.

How the scam works
Fake voting pages work by borrowing the trust of a real project. Links are spread through social media replies, Discord or Telegram, urging holders to "cast their vote" before a deadline. To vote, the visitor is asked to log in or connect a wallet. That step hands over credentials or prompts a signature or token approval, which lets the operator take control of the account or move assets out of the wallet.

Evidence
Six of 91 VirusTotal engines flagged the domain as of 2026-10-03: alphaMountain.ai, Forcepoint ThreatSeeker, Fortinet, Gridinsoft, SOCRadar and URLQuery. That is a modest share, so many generic scanners may still let it through. The crypto-specific lists are stronger signals. MetaMask, ScamSniffer and SEAL all block it alongside PhishDestroy. Spamhaus lists the domain in its DBL as spam, and four AlienVault OTX threat pulses reference it.

Infrastructure
The domain was registered through Registrar.eu on 2026-09-27 and was already being flagged that same day. That fits a throwaway domain set up for a short campaign rather than an established service. It resolves to 93.152.220.66 on the DEDIK SERVICES LIMITED network in the Netherlands. A free Let's Encrypt certificate gives it the browser padlock, which says nothing about whether the site is legitimate.

What to do
Do not vote, sign or log in on getvotes.forum. If you connected a wallet, use a token approval checker to revoke any permissions granted around that time. If you signed anything you did not understand, move remaining funds to a fresh wallet. If you entered a password or seed phrase, treat it as compromised: change the password, enable app-based 2FA, and migrate assets out of any wallet whose recovery phrase was typed in. Defenders should block the domain and its IP at DNS and proxy level and add it to community moderation filters. They can also warn users that genuine project votes are announced only through official channels.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a0e350-a669-73da-9460-4ec6eb2e0e9c/
VirusTotal report: https://www.virustotal.com/gui/domain/getvotes.forum
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=getvotes.forum
Archived copy: https://web.archive.org/web/20260927144649/https://getvotes.forum/
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-19 09:33:26 UTC

## Stored page captures

- Primary capture: https://i.ibb.co/kgTzk7VS/6ce42ed3013a.png
  Captured: 2026-09-27 14:42:40 UTC
- URLScan capture 1: https://screenshots.phishdestroy.io/01a0e350-a669-73da-9460-4ec6eb2e0e9c.png
  Captured: 2026-09-27 14:42:40 UTC
  Source report: https://urlscan.io/result/01a0e350-a669-73da-9460-4ec6eb2e0e9c/
- URLScan capture 2: https://urlscan.io/screenshots/01a0e247-24c9-720c-b586-daee6dd2630a.png
  Captured: 2026-09-27 14:39:39 UTC
  Source report: https://urlscan.io/result/01a0e350-a669-73da-9460-4ec6eb2e0e9c/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/071f09ea-d049-4f22-b4b7-13a862025142.png
  Captured: 2026-09-27 14:41:01 UTC
  Source report: https://radar.cloudflare.com/scan/071f09ea-d049-4f22-b4b7-13a862025142
  SHA-256: 6a2a4e05c676d5a1a0c5c7f7710ac6c577ada9d543730a64a3fca6235e9bce9a
- URLQuery: https://screenshots.phishdestroy.io/uq/92bea4da-3cfb-43f1-b7a6-889b6f1b29ec.png
  Source report: https://urlquery.net/report/92bea4da-3cfb-43f1-b7a6-889b6f1b29ec
  SHA-256: bbae91430728e1971f459976b245436c4ba2588b69934dbfd1ec2a009d30bb57
- URLScan · 2026-09-27: https://screenshots.phishdestroy.io/us/01a0e247-2038-75fa-b8b8-7c8869efe9a6.png
  Captured: 2026-09-27 09:51:56 UTC
  Source report: https://urlscan.io/result/01a0e247-2038-75fa-b8b8-7c8869efe9a6/
  SHA-256: e3b6291396b6342be5c53d1d75e4a30a7c0daad04686090ee8bee56f0925ed70
- URLScan · 2026-09-27: https://screenshots.phishdestroy.io/us/01a0e247-24c9-720c-b586-daee6dd2630a.png
  Captured: 2026-09-27 09:51:58 UTC
  Source report: https://urlscan.io/result/01a0e247-24c9-720c-b586-daee6dd2630a/
  SHA-256: 224ca941783b527b4452cbc477f11bb779dfa52ce9340832a2cab9eb2f4c8e96
- URLScan · 2026-09-27: https://screenshots.phishdestroy.io/us/01a0e353-3240-75ef-b05b-2047c40e96a1.png
  Captured: 2026-09-27 14:44:41 UTC
  Source report: https://urlscan.io/result/01a0e353-3240-75ef-b05b-2047c40e96a1/
  SHA-256: 70dea85763d2ce54bc44fc54a82873e0d2bd3a54c3186bf0947e372c916ff5f3
- URLScan · 2026-10-17: https://screenshots.phishdestroy.io/us/01a14a6e-e937-733a-9806-578b535eafd4.png
  Captured: 2026-10-17 15:15:51 UTC
  Source report: https://urlscan.io/result/01a14a6e-e937-733a-9806-578b535eafd4/
  SHA-256: 59986d49f2b04fc932db933e8c278b67c0a40de7dbbd4912d62bb2fc599f2efc
- URLScan · 2026-10-17: https://screenshots.phishdestroy.io/us/01a14a6e-eb87-73ac-9111-061a7475880d.png
  Captured: 2026-10-17 15:15:51 UTC
  Source report: https://urlscan.io/result/01a14a6e-eb87-73ac-9111-061a7475880d/
  SHA-256: 8e6b40a3560f13fd0e65bbe88735d7ecbdbde66351771131841cd0cb6616be74
- URLScan · 2026-10-17: https://screenshots.phishdestroy.io/us/01a14bda-42da-72cc-bf5c-01c77b6efc20.png
  Captured: 2026-10-17 21:52:43 UTC
  Source report: https://urlscan.io/result/01a14bda-42da-72cc-bf5c-01c77b6efc20/
  SHA-256: 45360fddaa2a9535d2e4150d41f5bdc375465da4a4cfd0f56e1923db4e952a58

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-20T20:56:21Z",
        "uuid": "01a0e350-a669-73da-9460-4ec6eb2e0e9c",
        "scanned_at": "2026-09-27T14:41:55Z",
        "final_url": "https://getvotes.forum/",
        "status": 200,
        "redirected": "https-only",
        "redirects": [
            {
                "to": "https://getvotes.forum/",
                "from": "http://getvotes.forum/",
                "status": 307
            }
        ],
        "ip": "93.152.220.66",
        "domains": [
            "coinmarketcap.com"
        ],
        "ips": [
            "3.174.46.81",
            "93.152.220.66"
        ],
        "asns": [
            "16509",
            "207043"
        ],
        "countries": [
            "US",
            "NL"
        ],
        "doc_hash": "4b95d9dd874a6092f119b4e1b960e3a232c01ea98e6b9430ad7ba088d98087cc",
        "globals": [
            "requestResize"
        ],
        "tls": {
            "san": [
                "getvotes.forum"
            ],
            "cipher": "AES_256_GCM",
            "issuer": "YR1",
            "subject": "getvotes.forum",
            "protocol": "TLS 1.3",
            "valid_to": "2026-12-26T08:31:01Z",
            "valid_from": "2026-09-27T08:31:02Z"
        },
        "domain_age_days": 0,
        "apex_age_days": 0,
        "tls_age_days": 0,
        "tls_valid_days": 89,
        "requests": 2,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 95,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "server": "SimpleHTTP/0.6 Python/3.10.12",
            "content-type": "text/html; charset=utf-8"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-20T21:04:39Z",
        "uuid": "071f09ea-d049-4f22-b4b7-13a862025142",
        "scanned_at": "2026-09-27T14:41:01Z",
        "final_url": "https://getvotes.forum/",
        "status": 200,
        "history": [
            {
                "url": "https://getvotes.forum/",
                "status": 200
            }
        ],
        "dom_hash": "fa151566b5b2b76a94921867a304b9380f08a5ada4e30efdfa28788f3bffbe89",
        "doc_hash": "4b95d9dd874a6092f119b4e1b960e3a232c01ea98e6b9430ad7ba088d98087cc",
        "domain_risks": [
            "Newly Seen Domains",
            "Security Risks"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "getvotes.forum",
                "type": "A",
                "value": "93.152.220.66"
            }
        ],
        "dnssec_valid": false,
        "ip": "93.152.220.66",
        "whois": {
            "registrar": "Registrar.eu",
            "created": "2026-09-27T09:24:24Z",
            "updated": "2026-09-27T09:24:27Z",
            "expires": "2027-09-27T09:24:24Z",
            "nameservers": [
                "cortney.ns.cloudflare.com",
                "lou.ns.cloudflare.com"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-21T16:45:45Z",
        "analysis_at": "2026-10-18T00:09:38Z",
        "stats": {
            "timeout": 0,
            "harmless": 47,
            "malicious": 8,
            "suspicious": 2,
            "undetected": 35
        },
        "detections": {
            "CRDF": "malicious",
            "G-Data": "phishing",
            "Sophos": "phishing",
            "Fortinet": "spam",
            "SOCRadar": "phishing",
            "Kaspersky": "phishing",
            "Gridinsoft": "suspicious",
            "BitDefender": "phishing",
            "alphaMountain.ai": "phishing",
            "Forcepoint ThreatSeeker": "phishing"
        },
        "reputation": 0,
        "registrar": "Registrar.eu",
        "created": "2026-09-27T09:24:24Z",
        "expires": "2027-09-27T09:24:24Z",
        "updated": "2026-09-27T09:24:27Z",
        "first_seen": "2026-09-27T09:51:58Z",
        "dns": [
            {
                "ttl": 1800,
                "type": "SOA",
                "rname": "dns.cloudflare.com",
                "value": "cortney.ns.cloudflare.com"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "lou.ns.cloudflare.com"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "cortney.ns.cloudflare.com"
            },
            {
                "ttl": 60,
                "type": "A",
                "value": "93.152.220.66"
            }
        ],
        "dns_at": "2026-10-18T00:09:54Z",
        "jarm": "2ad2ad0002ad2ad00042d42d00000051af7d8070a18e002eaaedf620fa118c",
        "cert": {
            "san": [
                "getvotes.forum"
            ],
            "issuer": "Let's Encrypt / YR1",
            "serial": "51e1f2c9b40c305093c5c31d616158e47e4",
            "sha256": "70697adfd0a92e701a18d32a1a13c825b9bbaa7dd2bc32442bc81c94abfaef38",
            "subject": "getvotes.forum",
            "valid_to": "2026-12-26T08:31:01Z",
            "valid_from": "2026-09-27T08:31:02Z"
        },
        "whois": {
            "registrar": "Registrar.eu",
            "registrar_iana_id": "1647",
            "registrar_url": "www.registrar.eu",
            "created": "2026-09-27T09:24:24Z",
            "updated": "2026-09-27T09:24:27Z",
            "expires": "2027-09-27T09:24:24Z",
            "status": [
                "addPeriod",
                "clientTransferProhibited"
            ],
            "nameservers": [
                "cortney.ns.cloudflare.com",
                "lou.ns.cloudflare.com"
            ],
            "dnssec": "unsigned"
        },
        "rdap": {
            "status": [
                "client transfer prohibited"
            ],
            "events": {
                "expiration": "2027-09-27T09:24:24Z",
                "registration": "2026-09-27T09:24:24Z",
                "registrar expiration": "2027-09-27T09:24:24Z",
                "last update of RDAP database": "2026-10-17T15:16:11Z"
            }
        }
    }
}
```