pay-heleket[.]cc

PhishDestroy identifies pay-heleket.cc as an active crypto-drainer phishing domain designed to steal cryptocurrency from unsuspecting users. The domain masquerades as a legitimate Helket payment portal, presenting a convincing fake login or checkout page to harvest wallet credentials and initiate unauthorized transfers. This threat is elevated due to its live status, use of HTTPS (via Let’s Encrypt), and recent infrastructure setup aimed at evading detection. This domain was flagged by PhishDestroy with concrete evidence: VirusTotal detection ratio of 1 out of 95 security vendors, registration through Global Domain Group LLC, and a domain creation date of March 15, 2026. The infrastructure resolves to IP address 188.114.97.3, indicating recent provisioning of malicious hosting resources. Despite low initial detection, behavioral analysis confirms redirection chains typical of crypto-drainer toolkits intercepting transactions. Users who visited pay-heleket.cc should immediately disconnect from the site, clear browser cache and cookies, and scan devices for malware. Revoke any permissions granted to wallet connections via blockchain explorers and report the domain to PhishDestroy for blocklisting. Do not interact further—this domain is part of an active campaign targeting crypto holders with drainer scripts. Protect your assets by verifying payment portals on official platforms only.