heleket[.]lat

Analysis indicates that the domain heleket.lat was registered on June 05, 2026 through Global Domain Group LLC. Within weeks of registration, multiple security services flagged the domain as malicious: four of ninety‑one VirusTotal scanners reported it as malicious, and the domain is currently listed on a single external blocklist. Independent mitigation platform PhishDestroy has also placed the domain in its blocklist, confirming that it is being used for phishing‑related activity. No public information about the hosting infrastructure, IP address, ASN, or SSL certificate has been disclosed in the available intelligence, and page‑level metadata such as title or brand targeting has not been published.

Consequently, the full scope of the phishing campaign—such as the specific credential‑harvesting pages, targeted brands, or victim demographics—remains uncertain. Given the early registration date and the rapid appearance on threat‑intel feeds, defenders should treat heleket.lat as high‑confidence malicious. Recommended actions include adding the domain to network‑level deny lists, configuring web‑proxy and DNS filtering solutions to block resolution, and ensuring endpoint protection products receive the latest indicator updates.

Continuous monitoring of VirusTotal and other sandbox services for additional detections is advised, as further analysis may reveal hosting details or payload characteristics. Organizations that rely on email filtering should also consider the domain for inclusion in phishing‑specific rule sets, especially if any observed malicious emails reference URLs that resolve to heleket.lat. Until more detailed forensic data becomes available, the precautionary stance of outright blocking is the most effective mitigation.