heima[.]appendchain[.]world

The domain heima.appendchain.world was registered on February 21, 2026. The site presents the page title “Heima Network” and is classified as a crypto‑scam phishing operation. An SSL certificate labeled R11 is associated with the domain, indicating that HTTPS was offered at some point. As of July 25, 2026 the domain is listed as offline, and the threat intelligence feed records that it has been removed from active service.

The domain appears on a single security blocklist and is specifically blocked by PhishDestroy. Independent analysis on VirusTotal shows that one out of ninety‑three security vendors flagged the domain as malicious, reinforcing the suspicion raised by other sources. Gridinsoft assigns the domain a trust score of 0 out of 100, the lowest possible rating, which aligns with the elevated risk level assigned by the reporting entity. The only observable indicator beyond the title and certificate is the classification as a “Crypto Scam,” with no further detail about the payload or victim interaction.

Because the hosting infrastructure, registrar, and IP address are not disclosed in the current intelligence, those aspects remain uncertain and should be investigated if additional data become available. Defenders should continue to block heima.appendchain.world at perimeter and DNS layers, add it to internal blacklists, and monitor related subdomains or newly registered look‑alike domains that reference “Heima” or “appendchain.” Ongoing correlation with threat‑intel feeds is recommended to capture any re‑use of the same infrastructure. In summary, the available evidence—creation date, page title, SSL certificate, blocklist inclusion, low trust score, and a single vendor detection—supports an elevated‑risk classification for a crypto‑scam phishing campaign, and the domain should be treated as malicious.