# PhishDestroy domain threat record: helpingvotes.forum

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/helpingvotes.forum/
Machine-readable companion: https://phishdestroy.io/domain/helpingvotes.forum/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-09-27 02:36:04 UTC
- Last availability or vendor check: 2026-10-22 10:28:41 UTC
- Stored record updated: 2026-10-22 16:07:29 UTC
- VirusTotal detections in the stored snapshot: 6/92
- Independent public blocklist matches in the stored snapshot: 2
- Matching public blocklists: MetaMask, SEAL
- Google Safe Browsing stored result: no stored flag

## Stored classification

- Targeted brand: MetaMask

## Stored infrastructure

- Observed IP address: 93.152.224.220
- Registrar in stored WHOIS data: Registrar.eu
- Registrar country in stored WHOIS data: NL
- Last stored HTTP status: 200
- Registration date (registry RDAP, helpingvotes.forum): 2026-09-25 21:56:10 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a0e0b8-da40-744e-8d6c-5785b8aeb935/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/helpingvotes.forum
- Certificate Transparency search: https://crt.sh/?q=%25.helpingvotes.forum
- Web Archive lookup: https://web.archive.org/web/*/https://helpingvotes.forum/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
helpingvotes.forum is an impersonation phishing page that presents itself under the plain title "Vote" and asks visitors to help someone by casting a vote. PhishDestroy first detected it on 2026-09-27. The wallet-focused MetaMask and SEAL blocklists also list it, which places it in the crypto scam ecosystem. As of 2026-10-19 the site was still online and serving its phishing content.

How the scam works
Voting lures usually arrive as a personal message from a friend or community member asking for a quick vote in a contest or poll. The link opens a page dressed up as a trusted service. To vote, the visitor must log in or connect a wallet. Whatever is entered goes to the operators, who can then take over the account or wallet and send the same "please vote" message to the victim's contacts. Victims lose control of their accounts and, where a wallet is involved, the funds the attackers can reach.

Evidence
On 2026-10-07, 6 of 92 VirusTotal engines flagged the domain: alphaMountain.ai, Forcepoint ThreatSeeker, Fortinet, Gridinsoft, SOCRadar and Sophos. That count is modest, so many security tools will not block the page yet. Independent listings back the verdict. MetaMask and SEAL list it alongside PhishDestroy, and Spamhaus DBL classifies the domain as spam, which points to it being pushed through unsolicited messages.

Infrastructure
The domain was registered through Registrar.eu on 2026-09-25, only two days before PhishDestroy caught it. That short gap fits a throwaway domain set up for a single campaign. It resolves to 93.152.224.220 on the DEDIK-IO DEDIK SERVICES LIMITED network, a provider registered in Great Britain, with the server located in Germany. A Let's Encrypt certificate gives the page a padlock, which says nothing about whether the site is safe.

What to do
If you entered a password on this page, change it at once on every service that shares it, turn on app-based two-factor authentication and sign out other active sessions. Warn your contacts, because hijacked accounts are used to spread the same vote request. If you connected a wallet, revoke any approvals granted around that time. If you typed a seed phrase, move your funds to a new wallet immediately. Defenders should block the domain and its IP, and treat incoming "vote for me" messages with links as suspicious.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a0e0b8-da40-744e-8d6c-5785b8aeb935/
VirusTotal report: https://www.virustotal.com/gui/domain/helpingvotes.forum
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=helpingvotes.forum
Archived copy: https://web.archive.org/web/20260927023710/https://helpingvotes.forum/
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-19 09:34:12 UTC

## Stored page captures

- Primary capture: https://i.ibb.co/CsYg6FfL/92f75336537a.png
  Captured: 2026-09-27 02:37:44 UTC
- URLScan capture 1: https://screenshots.phishdestroy.io/01a0e0b8-da40-744e-8d6c-5785b8aeb935.png
  Captured: 2026-09-27 02:37:44 UTC
  Source report: https://urlscan.io/result/01a0e0b8-da40-744e-8d6c-5785b8aeb935/
- URLScan capture 2: https://urlscan.io/screenshots/01a0daa3-13d3-77e3-90a5-2d3c2ca6f988.png
  Captured: 2026-09-27 02:36:04 UTC
  Source report: https://urlscan.io/result/01a0e0b8-da40-744e-8d6c-5785b8aeb935/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/a2523e6a-0edc-4a1d-90e4-d9fced7fb90c.png
  Captured: 2026-09-27 02:37:24 UTC
  Source report: https://radar.cloudflare.com/scan/a2523e6a-0edc-4a1d-90e4-d9fced7fb90c
  SHA-256: feb5e6e005a51ef26d5eb1677212ed35b12f11d79887e35852f3869be031fbc3
- URLScan · 2026-09-25: https://screenshots.phishdestroy.io/us/01a0daa3-0e87-7380-b38c-4cb742aa34bd.png
  Captured: 2026-09-25 22:15:20 UTC
  Source report: https://urlscan.io/result/01a0daa3-0e87-7380-b38c-4cb742aa34bd/
  SHA-256: 67cb29f79585fe7ac5bd6e1c15a57e20d1e07cdf75ae649b4ee6e4be24dae39b
- URLScan · 2026-09-27: https://screenshots.phishdestroy.io/us/01a0e216-7f96-759f-ab0d-870bca64b06d.png
  Captured: 2026-09-27 08:58:48 UTC
  Source report: https://urlscan.io/result/01a0e216-7f96-759f-ab0d-870bca64b06d/
  SHA-256: a8f747ef954a3e8221067896c0692b3c89140f20046d4b6fafcb68a973993e9d
- URLScan · 2026-10-17: https://screenshots.phishdestroy.io/us/01a14a6f-622f-72c1-99ec-ce093948acaa.png
  Captured: 2026-10-17 15:16:23 UTC
  Source report: https://urlscan.io/result/01a14a6f-622f-72c1-99ec-ce093948acaa/
  SHA-256: c721b7b0506c0507e0a314b1384cd931f9e59012b73b97c7d3fffa04421b8051
- URLScan · 2026-10-17: https://screenshots.phishdestroy.io/us/01a14a6f-63be-75e8-8a40-34f249b988d5.png
  Captured: 2026-10-17 15:16:25 UTC
  Source report: https://urlscan.io/result/01a14a6f-63be-75e8-8a40-34f249b988d5/
  SHA-256: 6f2d0bfc67b67c5b5d0a670e0a3198daf9896bfc6169f070d1f1e622f596571d
- URLScan · 2026-10-17: https://screenshots.phishdestroy.io/us/01a14a6f-aa6b-71fe-adf7-54bd479f0f96.png
  Captured: 2026-10-17 15:16:43 UTC
  Source report: https://urlscan.io/result/01a14a6f-aa6b-71fe-adf7-54bd479f0f96/
  SHA-256: d5a230c9340e65eb6f091864f5fe1c6e193bfa9a8506971ac8d79826cc7aab2f
- URLScan · 2026-10-17: https://screenshots.phishdestroy.io/us/01a14bdb-d2dd-7242-aac5-624504183387.png
  Captured: 2026-10-17 21:54:33 UTC
  Source report: https://urlscan.io/result/01a14bdb-d2dd-7242-aac5-624504183387/
  SHA-256: bed631c202cf45fb1fb9b799cdb424a886eba811b3524af548553e522a1c6cea

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-20T20:56:51Z",
        "uuid": "01a0e0b8-da40-744e-8d6c-5785b8aeb935",
        "scanned_at": "2026-09-27T02:36:52Z",
        "final_url": "https://helpingvotes.forum/",
        "status": 200,
        "redirected": "https-only",
        "redirects": [
            {
                "to": "https://helpingvotes.forum/",
                "from": "http://helpingvotes.forum/",
                "status": 307
            }
        ],
        "ip": "93.152.224.220",
        "domains": [
            "coinmarketcap.com"
        ],
        "ips": [
            "3.174.46.19",
            "93.152.224.220"
        ],
        "asns": [
            "16509",
            "207043"
        ],
        "countries": [
            "US",
            "DE"
        ],
        "doc_hash": "f57588e96630cf47119a66ea608300ca5ca507a669f1364320e28901d75cdea4",
        "globals": [
            "requestResize"
        ],
        "tls": {
            "san": [
                "helpingvotes.forum"
            ],
            "cipher": "AES_256_GCM",
            "issuer": "YR1",
            "subject": "helpingvotes.forum",
            "protocol": "TLS 1.3",
            "valid_to": "2026-12-24T21:05:02Z",
            "valid_from": "2026-09-25T21:05:03Z"
        },
        "domain_age_days": 1,
        "apex_age_days": 1,
        "tls_age_days": 1,
        "tls_valid_days": 89,
        "requests": 2,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 95,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "server": "SimpleHTTP/0.6 Python/3.10.12",
            "content-type": "text/html; charset=utf-8"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-20T21:04:54Z",
        "uuid": "a2523e6a-0edc-4a1d-90e4-d9fced7fb90c",
        "scanned_at": "2026-09-27T02:37:24Z",
        "final_url": "https://helpingvotes.forum/",
        "status": 200,
        "history": [
            {
                "url": "https://helpingvotes.forum/",
                "status": 200
            }
        ],
        "dom_hash": "bf1f50c49efdc3a8f59c23f3e6d8d1c64a8b3996227f608f3c0d8f6867a700c6",
        "doc_hash": "f57588e96630cf47119a66ea608300ca5ca507a669f1364320e28901d75cdea4",
        "domain_risks": [
            "New Domains",
            "Security Risks"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "helpingvotes.forum",
                "type": "A",
                "value": "93.152.224.220"
            }
        ],
        "dnssec_valid": false,
        "ip": "93.152.224.220",
        "whois": {
            "registrar": "Registrar.eu",
            "created": "2026-09-25T21:56:10Z",
            "updated": "2026-09-25T21:56:13Z",
            "expires": "2027-09-25T21:56:10Z",
            "nameservers": [
                "kanye.ns.cloudflare.com",
                "martha.ns.cloudflare.com"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-21T18:07:01Z",
        "analysis_at": "2026-10-21T09:54:19Z",
        "stats": {
            "timeout": 0,
            "harmless": 55,
            "malicious": 0,
            "suspicious": 0,
            "undetected": 37
        },
        "reputation": 0,
        "registrar": "Registrar.eu",
        "created": "2026-09-25T21:56:10Z",
        "expires": "2027-09-25T21:56:10Z",
        "updated": "2026-09-25T21:56:13Z",
        "first_seen": "2026-09-25T22:15:45Z",
        "dns": [
            {
                "ttl": 1800,
                "type": "SOA",
                "rname": "dns.cloudflare.com",
                "value": "kanye.ns.cloudflare.com"
            },
            {
                "ttl": 60,
                "type": "A",
                "value": "93.152.224.220"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "kanye.ns.cloudflare.com"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "martha.ns.cloudflare.com"
            }
        ],
        "dns_at": "2026-10-21T09:58:13Z",
        "jarm": "2ad2ad0002ad2ad00042d42d00000051af7d8070a18e002eaaedf620fa118c",
        "cert": {
            "san": [
                "helpingvotes.forum"
            ],
            "issuer": "Let's Encrypt / YR1",
            "serial": "5d2771a6f0eeabaa6713536e594b5ba74a2",
            "sha256": "c1c890596732e0c534cf04257b8254721fe2118292dcc70ec546631270be3475",
            "subject": "helpingvotes.forum",
            "valid_to": "2026-12-24T21:05:02Z",
            "valid_from": "2026-09-25T21:05:03Z"
        },
        "whois": {
            "registrar": "Registrar.eu",
            "registrar_iana_id": "1647",
            "registrar_url": "www.registrar.eu",
            "created": "2026-09-25T21:56:10Z",
            "updated": "2026-09-25T21:56:13Z",
            "expires": "2027-09-25T21:56:10Z",
            "status": [
                "addPeriod",
                "clientTransferProhibited"
            ],
            "nameservers": [
                "kanye.ns.cloudflare.com",
                "martha.ns.cloudflare.com"
            ],
            "dnssec": "unsigned"
        },
        "rdap": {
            "status": [
                "client transfer prohibited"
            ],
            "events": {
                "expiration": "2027-09-25T21:56:10Z",
                "registration": "2026-09-25T21:56:10Z",
                "registrar expiration": "2027-09-25T21:56:10Z",
                "last update of RDAP database": "2026-10-17T15:16:47Z"
            }
        }
    }
}
```