# heleket-payment.com — SUSPICIOUS

> Explore the potential risks of heleket-payment.com, a recently created domain flagged for phishing investigations. Stay informed on its activity.

## Summary
PhishDestroy identifies heleket-payment.com as a domain under investigation for generic phishing activities, with its risk level currently unconfirmed.

Despite zero detections on VirusTotal, the domain’s recent creation date and registration via NICENIC INTERNATIONAL GROUP CO., LIMITED suggest caution. Its IP resolution points to 172.67.180.119, a factor warranting further analysis.

The domain remains active, and PhishDestroy advises monitoring and applying standard phishing defenses until conclusive threat validation is available.

## Threat Details
- Verdict: SUSPICIOUS
- Site status: dead (HTTP 0)
- Page title: Heleket Payment

## Domain Intelligence
- Registered: 2026-03-07 01:07:01
- Registrar: NiceNIC International Group Co., Limited
- Country: HK
- IP: 172.67.180.119
- IP Country: US
- IP City: San Francisco
- IP Org: AS13335 Cloudflare, Inc.
- Nameservers: kurt.ns.cloudflare.com maxine.ns.cloudflare.com
- SSL Issuer: none

## Detection Status
- VirusTotal: 1 vendors flagged
  Vendors: ["Fortinet"]
- Google Safe Browsing: clean
- Blocklists: 3 hits
  Lists: ["PhishDestroy", "MetaMask", "SEAL"]

## Evidence
- Screenshot: https://i.ibb.co/Fb0JRqJM/9d996ae1a3a6.png
- Cloudflare Radar: https://radar.cloudflare.com/scan/1cc186f8-f742-4f2d-b3ed-a51bda2ba88b
- Wayback Machine: https://web.archive.org/web/https://heleket-payment.com
- PhishDestroy: https://phishdestroy.io/domain/heleket-payment.com/
- LLM endpoint: https://phishdestroy.io/domain/heleket-payment.com/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/heleket-payment.com/
Last updated: 2026-03-19