# PhishDestroy domain threat record: listshelping.forum

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/listshelping.forum/
Machine-readable companion: https://phishdestroy.io/domain/listshelping.forum/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-09-25 05:39:47 UTC
- Last availability or vendor check: 2026-10-22 10:29:39 UTC
- Stored record updated: 2026-10-22 16:07:29 UTC
- VirusTotal detections in the stored snapshot: 10/92
- Independent public blocklist matches in the stored snapshot: 3
- Matching public blocklists: MetaMask, ScamSniffer, SEAL
- Google Safe Browsing stored result: no stored flag

## Stored classification

- Targeted brand: MetaMask

## Stored infrastructure

- Observed IP address: 91.92.43.159
- Registrar in stored WHOIS data: Registrar.eu
- Registrar country in stored WHOIS data: Unknown
- Last stored HTTP status: 200
- Registration date (registry RDAP, listshelping.forum): 2026-09-23 20:01:01 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a0d71b-3b7d-745d-a0a7-b1cc7ed97891/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/listshelping.forum
- Certificate Transparency search: https://crt.sh/?q=%25.listshelping.forum
- Web Archive lookup: https://web.archive.org/web/*/https://listshelping.forum/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
listshelping.forum is an impersonation phishing site whose page carries the bare title "Vote", dressing itself up as a voting or polling portal. Wallet-security blocklists maintained by MetaMask, ScamSniffer and SEAL carry it, so its likely targets are crypto wallet holders. PhishDestroy first flagged it on 2026-09-25. As of 2026-10-19 the site was still online and serving its phishing content.

How the scam works
Fake "Vote" pages usually ride on a sense of urgency: a governance proposal, a community poll or a reward round that supposedly requires you to take part now. To cast the vote, the visitor is asked to connect a wallet and sign, or to log in with an account they trust. Each step looks routine, but a signature or approval can hand control of tokens to the operator, and a recovery phrase or password typed into the page goes straight to them. The victim loses whatever that wallet or account holds, often within minutes.

Evidence
Ten of 92 VirusTotal engines marked the domain malicious on 2026-10-07. The vendors that flagged it include alphaMountain.ai, BitDefender, CRDF, Forcepoint ThreatSeeker, Fortinet, G-Data, Gridinsoft and Kaspersky. That is a modest share of engines, but the vendors are independent of one another. The listings on MetaMask, ScamSniffer and SEAL matter more for crypto users, because those lists exist to warn wallet users. Spamhaus also lists the domain in its DBL as spam.

Infrastructure
The domain was registered through Registrar.eu on 2026-09-23, only two days before PhishDestroy caught it. That short gap fits a freshly built, disposable lure. The site runs on DEDIK SERVICES LIMITED infrastructure in Germany. Its free Let's Encrypt certificate gives it the padlock icon, which shows only that the connection is encrypted and says nothing about whether the site is honest.

What to do
If you connected a wallet or signed anything on this page, revoke its token approvals and permissions right away with a reputable approval-checking tool. Then move your remaining assets to a fresh wallet. If you typed a recovery phrase, treat that wallet as fully compromised and stop using it. If you entered an account password, change it everywhere you reuse it and turn on app-based 2FA. Defenders should block the domain at DNS and web proxies, and anyone who receives "vote now" links should check them against official project channels before clicking.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a0d71b-3b7d-745d-a0a7-b1cc7ed97891/
VirusTotal report: https://www.virustotal.com/gui/domain/listshelping.forum
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=listshelping.forum
Archived copy: https://web.archive.org/web/20260925062446/https://listshelping.forum/
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-19 09:34:28 UTC

## Stored page captures

- Primary capture: https://i.ibb.co/PZp5Hd37/e5a63700be5c.png
  Captured: 2026-09-25 05:49:27 UTC
- URLScan capture 1: https://screenshots.phishdestroy.io/01a0d71b-3b7d-745d-a0a7-b1cc7ed97891.png
  Captured: 2026-09-25 05:49:27 UTC
  Source report: https://urlscan.io/result/01a0d71b-3b7d-745d-a0a7-b1cc7ed97891/
- URLScan capture 2: https://urlscan.io/screenshots/01a0d0dd-8b6e-73cf-b7c8-5b675138a8a7.png
  Captured: 2026-09-25 05:39:47 UTC
  Source report: https://urlscan.io/result/01a0d71b-3b7d-745d-a0a7-b1cc7ed97891/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/06f02431-517a-4ca9-a787-33bf036efc8e.png
  Captured: 2026-09-25 05:42:11 UTC
  Source report: https://radar.cloudflare.com/scan/06f02431-517a-4ca9-a787-33bf036efc8e
  SHA-256: 9ac21b73d753c67ff1997ba5f14c6999af25425ddc2478340e28606377650a10
- URLQuery: https://screenshots.phishdestroy.io/uq/d3ea36b2-a67a-4eff-8347-14e5294c64ce.png
  Source report: https://urlquery.net/report/d3ea36b2-a67a-4eff-8347-14e5294c64ce
  SHA-256: 8f0023ece6ca5fb486b4f771cc8f148099c582ab26a436966068f824241c387a
- URLScan · 2026-09-23: https://screenshots.phishdestroy.io/us/01a0cffe-5d58-7218-b3d0-2da1dadc2dd8.png
  Captured: 2026-09-23 20:39:14 UTC
  Source report: https://urlscan.io/result/01a0cffe-5d58-7218-b3d0-2da1dadc2dd8/
  SHA-256: 6e3f304ec8e81309e80cb7b02885248b6cb4a1dbfcf703c810db49f8c5546fdc
- URLScan · 2026-09-23: https://screenshots.phishdestroy.io/us/01a0cffe-5f99-75dc-af76-880e24ee1136.png
  Captured: 2026-09-23 20:39:15 UTC
  Source report: https://urlscan.io/result/01a0cffe-5f99-75dc-af76-880e24ee1136/
  SHA-256: 2a6ca55391911bc3e4e8993d05156948c31c70bf5655d0af2017abfe47392ff9
- URLScan · 2026-09-25: https://screenshots.phishdestroy.io/us/01a0d72d-86a6-743b-9b96-a7ab9cfc17b5.png
  Captured: 2026-09-25 06:08:06 UTC
  Source report: https://urlscan.io/result/01a0d72d-86a6-743b-9b96-a7ab9cfc17b5/
  SHA-256: c2488e7c1748d29572c382d1e93b2458e8a2cecd7edb0df971afd34e206d0e0d
- URLScan · 2026-09-25: https://screenshots.phishdestroy.io/us/01a0d7c5-b931-77ce-9a8d-d5a7657d1f31.png
  Captured: 2026-09-25 08:54:19 UTC
  Source report: https://urlscan.io/result/01a0d7c5-b931-77ce-9a8d-d5a7657d1f31/
  SHA-256: 9ec31cce6d6f48c33d0f0101147e30f3b183f8c1ad362f38405727f2dc7cb14b
- URLScan · 2026-10-17: https://screenshots.phishdestroy.io/us/01a14a71-5d2a-74cf-8a54-42e142674a49.png
  Captured: 2026-10-17 15:18:34 UTC
  Source report: https://urlscan.io/result/01a14a71-5d2a-74cf-8a54-42e142674a49/
  SHA-256: db7966fd6572162c0e96c5a991c72089681361957d407c6df81189e1b9e8c7cf
- URLScan · 2026-10-17: https://screenshots.phishdestroy.io/us/01a14bdf-67fe-722b-a05c-7bdf75db6acb.png
  Captured: 2026-10-17 21:58:21 UTC
  Source report: https://urlscan.io/result/01a14bdf-67fe-722b-a05c-7bdf75db6acb/
  SHA-256: cbd3a21229b8c2254aefb86bede6e77d3f083ee57fedfd0c9e21d4509d7e199b

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-20T20:58:29Z",
        "uuid": "01a0d71b-3b7d-745d-a0a7-b1cc7ed97891",
        "scanned_at": "2026-09-25T05:48:10Z",
        "final_url": "https://listshelping.forum/",
        "status": 200,
        "redirected": "https-only",
        "redirects": [
            {
                "to": "https://listshelping.forum/",
                "from": "http://listshelping.forum/",
                "status": 307
            }
        ],
        "ip": "91.92.43.159",
        "domains": [
            "coinmarketcap.com"
        ],
        "ips": [
            "13.225.196.89",
            "91.92.43.159"
        ],
        "asns": [
            "16509",
            "207043"
        ],
        "countries": [
            "US",
            "DE"
        ],
        "doc_hash": "ac08131f5db61f87adb0bce7272f77091e2834d091ab807a21752430caceb279",
        "globals": [
            "requestResize"
        ],
        "tls": {
            "san": [
                "listshelping.forum"
            ],
            "cipher": "AES_256_GCM",
            "issuer": "YR1",
            "subject": "listshelping.forum",
            "protocol": "TLS 1.3",
            "valid_to": "2026-12-22T19:35:59Z",
            "valid_from": "2026-09-23T19:36:00Z"
        },
        "domain_age_days": 1,
        "apex_age_days": 1,
        "tls_age_days": 1,
        "tls_valid_days": 89,
        "requests": 2,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 95,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "server": "SimpleHTTP/0.6 Python/3.10.12",
            "content-type": "text/html; charset=utf-8"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-20T21:05:59Z",
        "uuid": "06f02431-517a-4ca9-a787-33bf036efc8e",
        "scanned_at": "2026-09-25T05:42:11Z",
        "final_url": "https://listshelping.forum/",
        "status": 200,
        "history": [
            {
                "url": "https://listshelping.forum/",
                "status": 200
            }
        ],
        "dom_hash": "bf1f50c49efdc3a8f59c23f3e6d8d1c64a8b3996227f608f3c0d8f6867a700c6",
        "doc_hash": "ac08131f5db61f87adb0bce7272f77091e2834d091ab807a21752430caceb279",
        "domain_risks": [
            "Newly Seen Domains",
            "Security Risks",
            "New Domains"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "listshelping.forum",
                "type": "A",
                "value": "91.92.43.159"
            }
        ],
        "dnssec_valid": false,
        "ip": "91.92.43.159",
        "whois": {
            "registrar": "Registrar.eu",
            "created": "2026-09-23T20:01:01Z",
            "updated": "2026-09-23T20:01:14Z",
            "expires": "2027-09-23T20:01:01Z",
            "nameservers": [
                "ray.ns.cloudflare.com",
                "vera.ns.cloudflare.com"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-21T18:10:01Z",
        "analysis_at": "2026-10-17T17:01:33Z",
        "stats": {
            "timeout": 0,
            "harmless": 49,
            "malicious": 6,
            "suspicious": 3,
            "undetected": 34
        },
        "detections": {
            "CRDF": "malicious",
            "G-Data": "phishing",
            "Fortinet": "spam",
            "SOCRadar": "phishing",
            "Kaspersky": "phishing",
            "Gridinsoft": "suspicious",
            "BitDefender": "phishing",
            "alphaMountain.ai": "spam",
            "Forcepoint ThreatSeeker": "phishing"
        },
        "reputation": 0,
        "registrar": "Registrar.eu",
        "created": "2026-09-23T20:01:01Z",
        "expires": "2027-09-23T20:01:01Z",
        "updated": "2026-09-23T20:01:14Z",
        "first_seen": "2026-09-23T20:38:19Z",
        "dns": [
            {
                "ttl": 21600,
                "type": "NS",
                "value": "ray.ns.cloudflare.com"
            },
            {
                "ttl": 60,
                "type": "A",
                "value": "91.92.43.159"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "vera.ns.cloudflare.com"
            },
            {
                "ttl": 1800,
                "type": "SOA",
                "rname": "dns.cloudflare.com",
                "value": "ray.ns.cloudflare.com"
            }
        ],
        "dns_at": "2026-10-17T17:07:13Z",
        "jarm": "2ad2ad0002ad2ad00042d42d00000051af7d8070a18e002eaaedf620fa118c",
        "cert": {
            "san": [
                "listshelping.forum"
            ],
            "issuer": "Let's Encrypt / YR1",
            "serial": "6ed64fef3140b04129010d1c7449ef871e1",
            "sha256": "960f14c319c8d4dd0e5f747bad4b34ad51c48cefea41e2fd9a66554402214b4f",
            "subject": "listshelping.forum",
            "valid_to": "2026-12-22T19:35:59Z",
            "valid_from": "2026-09-23T19:36:00Z"
        },
        "whois": {
            "registrar": "Registrar.eu",
            "registrar_iana_id": "1647",
            "registrar_url": "www.registrar.eu",
            "created": "2026-09-23T20:01:01Z",
            "updated": "2026-09-23T20:01:14Z",
            "expires": "2027-09-23T20:01:01Z",
            "status": [
                "addPeriod",
                "clientTransferProhibited"
            ],
            "nameservers": [
                "ray.ns.cloudflare.com",
                "vera.ns.cloudflare.com"
            ],
            "dnssec": "unsigned"
        },
        "rdap": {
            "status": [
                "client transfer prohibited"
            ],
            "events": {
                "expiration": "2027-09-23T20:01:01Z",
                "registration": "2026-09-23T20:01:01Z",
                "registrar expiration": "2027-09-23T20:01:01Z",
                "last update of RDAP database": "2026-10-17T15:18:51Z"
            }
        }
    }
}
```