heleket-in[.]casa

The domain heleket-in.casa has been identified as a crypto drainer site, designed to trick users into making cryptocurrency payments. The site impersonates a legitimate service, offering cryptocurrency payment solutions for websites under the brand Heleket. This domain is particularly concerning due to its elevated risk level.

Infrastructure analysis reveals that the domain is registered through Global Domain Group LLC and resolves to the IP address 91.227.114.5. The domain was created on May 05, 2026, and is currently listed on one security blocklist. Additionally, the site uses technologies such as Node.js, React, Nginx, Next.js, Zendesk, Yandex.Metrika, and Google Tag Manager. The SSL certificate is issued by Let's Encrypt, which adds a layer of trust that can be exploited by attackers. As of the latest scan, 8 out of 95 security vendors on VirusTotal have flagged this domain as malicious.

The domain is currently offline, indicating that it may have been taken down by the registrar or through coordinated efforts by security organizations. However, the presence of the domain on a security blocklist and the number of security vendors flagging it suggest that it posed a significant threat while active. It is recommended that any users who interacted with this domain monitor their cryptocurrency accounts for unauthorized transactions and consider changing their passwords if any credentials were compromised. Organizations should ensure their network security policies are updated to block this domain and educate employees about the risks of crypto drainer sites.