invoiceheleket[.]com

Analysis indicates that invoiceheleket.com is an active credential-phishing domain targeting users of a service identified by the page title 'Heleket Pay.' The domain was registered on May 3, 2026, through NameSilo, LLC, and currently resolves to the IP address 188.114.97.3, which is associated with Cloudflare, Inc. in Canada. Infrastructure review shows Cloudflare nameservers (leonard.ns.cloudflare.com and michelle.ns.cloudflare.com) and an SSL certificate issued by Let's Encrypt (serial E7), consistent with typical phishing campaigns leveraging CDN services to obscure origin servers. Technologies detected on the domain include Nginx, Zendesk, Yandex.Metrika, Google Tag Manager, Google Analytics, and Cloudflare Browser Insights, suggesting an attempt to mimic legitimate service pages and track victim interactions. As of July 12, 2026, the domain remains active with an HTTP 200 status, indicating the phishing page is operational. One of 91 security vendors on VirusTotal flags this domain, and it appears on two security blocklists (PhishDestroy and ScamSniffer). The Gridinsoft trust score is 0/100, further supporting its classification as malicious. Defenders should treat this domain as high-risk and prioritize blocking it at DNS, proxy, and endpoint layers. No specific victim data or campaign scale is currently available, and the exact content of the phishing page has not been analyzed. Further monitoring is recommended to assess changes in infrastructure or targeting behavior.