helicopterhelicopter[.]pages[.]dev

This domain, helicopterhelicopter.pages.dev, presents a direct financial threat by operating as a crypto drainer under the guise of the GasBack Protocol. Analysis of the page title and infrastructure indicates an intent to deceive users into connecting wallets to malicious smart contracts, which automatically siphon cryptocurrency assets without consent. The use of a legitimate-sounding protocol name suggests targeting of users familiar with gas refund or rebate services, increasing the likelihood of successful exploitation through social engineering tactics. Evidence supporting the malicious classification includes detection by 6 out of 95 security vendors on VirusTotal, with the domain appearing on four distinct security blocklists. The domain was registered on April 13, 2026, through Cloudflare, Inc., and resolves to the IP address 172.66.46.220. Additional technical indicators include the use of Google Trust Services for SSL certification, Cloudflare hosting infrastructure, and the presence of technologies such as jsDelivr, HSTS, and HTTP/3, which are often leveraged to enhance credibility and evade detection. A Gridinsoft trust score of 0/100 further corroborates the domain's malicious intent. Users who visited helicopterhelicopter.pages.dev or interacted with the GasBack Protocol interface should immediately disconnect any connected wallets and revoke permissions for all suspicious smart contracts. It is critical to audit wallet transaction histories for unauthorized transfers and monitor for signs of compromise, such as unexpected token approvals or balance discrepancies. If assets were transferred, report the incident to relevant blockchain analytics platforms and local cybercrime authorities. Additionally, reset credentials for any accounts accessed during the interaction and enable multi-factor authentication where available. Proactive monitoring of associated wallet addresses for further unauthorized activity is strongly advised.