# PhishDestroy domain threat record: listhelps.forum

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/listhelps.forum/
Machine-readable companion: https://phishdestroy.io/domain/listhelps.forum/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: not observed active
- First observed by PhishDestroy: 2026-09-27 03:21:45 UTC
- Last availability or vendor check: 2026-10-21 01:21:25 UTC
- Stored record updated: 2026-10-22 14:23:06 UTC
- VirusTotal detections in the stored snapshot: 10/92
- Independent public blocklist matches in the stored snapshot: 3
- Matching public blocklists: MetaMask, ScamSniffer, SEAL
- Google Safe Browsing stored result: no stored flag

## Stored classification

- Targeted brand: MetaMask

## Stored infrastructure

- Observed IP address: 91.92.43.8
- Registrar in stored WHOIS data: Registrar.eu
- Registrar country in stored WHOIS data: Unknown
- Registration date (registry RDAP, listhelps.forum): 2026-09-26 10:10:24 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a0e0e3-4096-70c5-a82a-29da417b47e1/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/listhelps.forum
- Certificate Transparency search: https://crt.sh/?q=%25.listhelps.forum
- Web Archive lookup: https://web.archive.org/web/*/https://listhelps.forum/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
listhelps.forum is an impersonation phishing page that presents itself under the simple title "Vote". The site is listed by MetaMask, ScamSniffer and SEAL, which points to crypto wallet users as the intended audience. PhishDestroy first detected it on 2026-09-27, one day after the domain was registered. As of 2026-10-19 the site was still online and serving its phishing content.

How the scam works
Voting lures are simple. A victim receives a link asking them to support a project, proposal or contestant, and the "Vote" page then demands a login or a wallet connection before the vote can be cast. On a page that impersonates a trusted service, that step hands over either account credentials or a wallet signature. A signature can authorize transfers or token approvals that let the operators empty the wallet. The vote itself never matters, because the connection or login is the prize.

Evidence
Ten of 92 VirusTotal engines flagged the domain on 2026-10-07. Those engines included BitDefender, Kaspersky, Fortinet, Forcepoint ThreatSeeker, G-Data, Gridinsoft, alphaMountain.ai and LevelBlue, a spread of independent vendors rather than a single outlier. Wallet-focused blocklists from MetaMask, ScamSniffer and SEAL list it alongside PhishDestroy, so many wallet users may already see a warning. Spamhaus carries the domain in its DBL as spam, and it appears in four AlienVault OTX threat pulses.

Infrastructure
The domain was registered through Registrar.eu on 2026-09-26 and was already phishing the next day. That fast turnaround is typical of throwaway domains built for a short campaign. It resolves to 91.92.43.8 on the DEDIK SERVICES LIMITED network (registered in GB), with the server located in Germany. Its Let's Encrypt certificate is free and automated, so the browser padlock says nothing about whether the site is legitimate.

What to do
If you connected a wallet or signed anything on this "Vote" page, use a token-approval checker right away to revoke any permissions you granted. If you approved transactions or revealed a seed phrase, move remaining funds to a fresh wallet. If you entered a password, change it wherever you reuse it and turn on two-factor authentication. Treat any unsolicited request to "vote" with a wallet as hostile. Defenders should block the domain and its IP at DNS and proxy level, and report it to the registrar and hosting provider while it remains live.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a0e0e3-4096-70c5-a82a-29da417b47e1/
VirusTotal report: https://www.virustotal.com/gui/domain/listhelps.forum
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=listhelps.forum
Archived copy: https://web.archive.org/web/20260927032354/https://listhelps.forum/
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-19 10:57:27 UTC

## Stored page captures

- Primary capture: https://i.ibb.co/Y7ZtwhGg/2b2d6073ed21.png
  Captured: 2026-09-27 03:24:46 UTC
- URLScan capture 1: https://screenshots.phishdestroy.io/01a0e0e3-4096-70c5-a82a-29da417b47e1.png
  Captured: 2026-09-27 03:24:46 UTC
  Source report: https://urlscan.io/result/01a0e0e3-4096-70c5-a82a-29da417b47e1/
- URLScan capture 2: https://urlscan.io/screenshots/01a0de6d-8195-7358-ae13-b3f617458452.png
  Captured: 2026-09-27 03:21:45 UTC
  Source report: https://urlscan.io/result/01a0e0e3-4096-70c5-a82a-29da417b47e1/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/bda368ba-95b1-42dc-8581-6ecaf2435cc8.png
  Captured: 2026-09-27 03:23:34 UTC
  Source report: https://radar.cloudflare.com/scan/bda368ba-95b1-42dc-8581-6ecaf2435cc8
  SHA-256: 077a43b809fcac2a154bf2698c47b9d010a77fe17c66ca7b5a110155c409afb5
- URLQuery: https://screenshots.phishdestroy.io/uq/8e1137d4-fc14-41bb-8f01-6db6f61fe21a.png
  Source report: https://urlquery.net/report/8e1137d4-fc14-41bb-8f01-6db6f61fe21a
  SHA-256: 8c84a2d2558fb1caeed0295da8d1ee6c64af6888d4d5133d1dfcf48ff998fb73
- URLScan · 2026-09-26: https://screenshots.phishdestroy.io/us/01a0de6d-7caf-72a4-8e8a-0017a3fb82dd.png
  Captured: 2026-09-26 15:55:19 UTC
  Source report: https://urlscan.io/result/01a0de6d-7caf-72a4-8e8a-0017a3fb82dd/
  SHA-256: 1dab9203fe11a5d904a04b48a84eb63506ac7182a4b570ea175c043b82645a6d
- URLScan · 2026-09-26: https://screenshots.phishdestroy.io/us/01a0de6d-8195-7358-ae13-b3f617458452.png
  Captured: 2026-09-26 15:55:20 UTC
  Source report: https://urlscan.io/result/01a0de6d-8195-7358-ae13-b3f617458452/
  SHA-256: c223c793c3934e24afbec482a7c1dde9743a8436d2a0d37a298d257ce5010220
- URLScan · 2026-09-27: https://screenshots.phishdestroy.io/us/01a0e0e8-64c6-737a-a3b7-35117650608f.png
  Captured: 2026-09-27 03:28:47 UTC
  Source report: https://urlscan.io/result/01a0e0e8-64c6-737a-a3b7-35117650608f/
  SHA-256: 010d73ba4c7b00f21d02e84e459de50a74f7e7b178c9780b4d940187231afc02
- URLScan · 2026-10-17: https://screenshots.phishdestroy.io/us/01a14a6f-234a-774b-b3f4-936fdaaa7d3f.png
  Captured: 2026-10-17 15:16:05 UTC
  Source report: https://urlscan.io/result/01a14a6f-234a-774b-b3f4-936fdaaa7d3f/
  SHA-256: b894ddaac24f136a36db1932f255f8d6e4f10107307152ec59113664d8446dc6
- URLScan · 2026-10-17: https://screenshots.phishdestroy.io/us/01a14a6f-22fe-715e-8df5-d081e1682a9a.png
  Captured: 2026-10-17 15:16:05 UTC
  Source report: https://urlscan.io/result/01a14a6f-22fe-715e-8df5-d081e1682a9a/
  SHA-256: 8e6b40a3560f13fd0e65bbe88735d7ecbdbde66351771131841cd0cb6616be74
- URLScan · 2026-10-17: https://screenshots.phishdestroy.io/us/01a14bda-d559-75b8-94fc-34212c923e18.png
  Captured: 2026-10-17 21:53:21 UTC
  Source report: https://urlscan.io/result/01a14bda-d559-75b8-94fc-34212c923e18/
  SHA-256: 45360fddaa2a9535d2e4150d41f5bdc375465da4a4cfd0f56e1923db4e952a58

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-20T20:56:35Z",
        "uuid": "01a0e0e3-4096-70c5-a82a-29da417b47e1",
        "scanned_at": "2026-09-27T03:23:11Z",
        "final_url": "https://listhelps.forum/",
        "status": 200,
        "redirected": "https-only",
        "redirects": [
            {
                "to": "https://listhelps.forum/",
                "from": "http://listhelps.forum/",
                "status": 307
            }
        ],
        "ip": "91.92.43.8",
        "domains": [
            "coinmarketcap.com"
        ],
        "ips": [
            "18.165.98.33",
            "91.92.43.8"
        ],
        "asns": [
            "16509",
            "207043"
        ],
        "countries": [
            "US",
            "DE"
        ],
        "doc_hash": "444dff0672da5169cf663f2a4d7f8f8edd16d87e2b25a9c7d95ad5c3c837389c",
        "globals": [
            "requestResize"
        ],
        "tls": {
            "san": [
                "listhelps.forum"
            ],
            "cipher": "AES_256_GCM",
            "issuer": "YR2",
            "subject": "listhelps.forum",
            "protocol": "TLS 1.3",
            "valid_to": "2026-12-25T09:20:53Z",
            "valid_from": "2026-09-26T09:20:54Z"
        },
        "domain_age_days": 0,
        "apex_age_days": 0,
        "tls_age_days": 0,
        "tls_valid_days": 89,
        "requests": 2,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 96,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "server": "SimpleHTTP/0.6 Python/3.10.12",
            "content-type": "text/html; charset=utf-8"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-20T21:04:47Z",
        "uuid": "bda368ba-95b1-42dc-8581-6ecaf2435cc8",
        "scanned_at": "2026-09-27T03:23:34Z",
        "final_url": "https://listhelps.forum/",
        "status": 200,
        "history": [
            {
                "url": "https://listhelps.forum/",
                "status": 200
            }
        ],
        "dom_hash": "fa151566b5b2b76a94921867a304b9380f08a5ada4e30efdfa28788f3bffbe89",
        "doc_hash": "444dff0672da5169cf663f2a4d7f8f8edd16d87e2b25a9c7d95ad5c3c837389c",
        "domain_risks": [
            "Newly Seen Domains",
            "Security Risks"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "listhelps.forum",
                "type": "A",
                "value": "91.92.43.8"
            }
        ],
        "dnssec_valid": false,
        "ip": "91.92.43.8",
        "whois": {
            "registrar": "Registrar.eu",
            "created": "2026-09-26T10:10:24Z",
            "updated": "2026-09-26T10:10:28Z",
            "expires": "2027-09-26T10:10:24Z",
            "nameservers": [
                "cosmin.ns.cloudflare.com",
                "pola.ns.cloudflare.com"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-21T16:46:24Z",
        "analysis_at": "2026-10-17T17:01:28Z",
        "stats": {
            "timeout": 0,
            "harmless": 46,
            "malicious": 10,
            "suspicious": 2,
            "undetected": 34
        },
        "detections": {
            "CRDF": "malicious",
            "G-Data": "phishing",
            "Lionic": "phishing",
            "Sophos": "phishing",
            "Fortinet": "spam",
            "SOCRadar": "phishing",
            "Kaspersky": "phishing",
            "LevelBlue": "phishing",
            "Gridinsoft": "suspicious",
            "BitDefender": "phishing",
            "alphaMountain.ai": "phishing",
            "Forcepoint ThreatSeeker": "phishing"
        },
        "reputation": 0,
        "registrar": "Registrar.eu",
        "created": "2026-09-26T10:10:24Z",
        "expires": "2027-09-26T10:10:24Z",
        "updated": "2026-09-26T10:10:28Z",
        "first_seen": "2026-09-26T10:36:16Z",
        "dns": [
            {
                "ttl": 1800,
                "type": "SOA",
                "rname": "dns.cloudflare.com",
                "value": "cosmin.ns.cloudflare.com"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "pola.ns.cloudflare.com"
            },
            {
                "ttl": 60,
                "type": "A",
                "value": "91.92.43.8"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "cosmin.ns.cloudflare.com"
            }
        ],
        "dns_at": "2026-10-17T17:06:54Z",
        "jarm": "2ad2ad0002ad2ad00042d42d00000051af7d8070a18e002eaaedf620fa118c",
        "cert": {
            "san": [
                "listhelps.forum"
            ],
            "issuer": "Let's Encrypt / YR2",
            "serial": "61dc907f40deb23d2e315329794c653bf23",
            "sha256": "526432e75fcbac0580db82e5ebd4037211ee7a0f4398474d613a1a17eec9e608",
            "subject": "listhelps.forum",
            "valid_to": "2026-12-25T09:20:53Z",
            "valid_from": "2026-09-26T09:20:54Z"
        },
        "whois": {
            "registrar": "Registrar.eu",
            "registrar_iana_id": "1647",
            "registrar_url": "www.registrar.eu",
            "created": "2026-09-26T10:10:24Z",
            "updated": "2026-09-26T10:10:28Z",
            "expires": "2027-09-26T10:10:24Z",
            "status": [
                "addPeriod",
                "clientTransferProhibited"
            ],
            "nameservers": [
                "cosmin.ns.cloudflare.com",
                "pola.ns.cloudflare.com"
            ],
            "dnssec": "unsigned"
        },
        "rdap": {
            "status": [
                "client transfer prohibited"
            ],
            "events": {
                "expiration": "2027-09-26T10:10:24Z",
                "registration": "2026-09-26T10:10:24Z",
                "registrar expiration": "2027-09-26T10:10:24Z",
                "last update of RDAP database": "2026-10-17T15:16:28Z"
            }
        }
    }
}
```