heleket[.]one

heleket.one is currently listed as a high‑risk generic phishing domain. The site returns HTTP 200 and displays the title “Heleket Pay”, suggesting it is designed to mimic a legitimate payment portal. Its content has not been captured in this report, but the presence of a payment‑oriented title aligns with typical credential‑stealing lures that target users seeking to transact online.

The domain resolves to Cloudflare’s infrastructure, using the authoritative nameservers wally.ns.cloudflare.com and alex.ns.cloudflare.com. Cloudflare Browser Insights and HTTP/3 are observed, indicating the site leverages modern web protocols to improve performance and evade simple network‑level detections. The domain was registered on 26 March 2026 through Global Domain Group LLC, a registrar that is commonly used for short‑lived malicious sites.

Threat intelligence corroborates the phishing classification: AlienVault OTX has cited heleket.one in 22 separate pulses, and it appears on one public blocklist. PhishDestroy has already added the domain to its block feed, and two out of ninety‑five VirusTotal scanners have flagged the site as malicious. These signals collectively demonstrate that multiple independent feeds consider the domain active and dangerous.

Defenders should treat heleket.one as hostile. Network perimeter devices ought to block both DNS resolution and HTTP traffic to the domain. Email gateways should add the domain to phishing‑URL filters, and endpoint monitors can watch for processes that open connections to the observed Cloudflare IP ranges. Because the underlying hosting is Cloudflare, sinkholing may be limited; however, rapid takedown requests to the registrar could reduce exposure. Users should be warned that any request to “Heleket Pay” is likely fraudulent and that credentials entered on the site should be assumed compromised.