receiver-heleket[.]com

Analysis of www.receiver-heleket.com shows a newly registered domain (created 21 Feb 2026) hosted on Amazon’s AS16509 network (IP 3.33.193.101, United States). The domain resolves to a single IPv4 address and is served without an SSL/TLS certificate, indicating that any data submitted would be transmitted in clear‑text. The sole page title observed is “Payment – Heleket Pay”, which aligns with a generic payment‑collection phishing lure. Registration information lists Ultahost, Inc. as the registrar and four Ultahost name servers (ns1‑ns4.ultahost.com), a configuration commonly seen in short‑lived malicious sites.

The domain appears on one external security blocklist and is explicitly blocked by the PhishDestroy feed, providing independent confirmation of malicious intent. VirusTotal has processed the domain with 95 scanning engines and reported no detections; however, the absence of a detection does not constitute evidence of benign behavior, especially given the other indicators. The site is currently taken offline, limiting immediate exposure but leaving the infrastructure in place for possible re‑activation.

Uncertainties remain regarding the exact phishing campaign, the content served before takedown, and whether additional infrastructure (e.g., command‑and‑control servers) is associated with the same IP range. Defenders should proactively block the domain and its resolving IP at perimeter and DNS filtering layers, monitor for any resurgence of the host name or similar sub‑domains under the same registrar, and consider adding the observed page title string to web‑gateway detection rules. Ongoing reconnaissance of the Amazon AS16509 block for related malicious activity is advised, as the hosting provider is frequently abused for transient phishing operations.