helplists.blog
Category: Phishing
- Don't sign in or pay here. Close it. If you typed a password, change it where you normally use it.
- Already visited? Check your device. A free scan shows whether anything was installed.
- Stop the next one. Combo Cleaner's web protection blocks phishing and scam sites before they load.
Combo Cleaner is PCrisk's own anti-malware tool, owned by RCS LT. Free to scan; removing what it finds needs a licence (7-day free trial).
Quttera Web Malware Removal is a paid subscription service. Pricing, plans, and trial availability are set by Quttera. Quttera is operated by Quttera Ltd, an independent third-party company unrelated to RCS LT. PCrisk.com may earn a referral commission when users sign up through this link.
Description of helplists.blog
helplists.blog appears to be a very recently created website presenting itself as a "community vote" page related to CoinMarketCap. The page title and meta description reference a listing vote, and the screenshot shows a minimal landing page encouraging visitors to click a Continue button to reach a supposed voting page.
Based on the visible content and linked resources, the site appears to borrow branding and references associated with CoinMarketCap, including links to CoinMarketCap pages, social channels, and support resources. However, the domain itself is helplists.blog rather than an official CoinMarketCap domain, and no clear operator identity, company details, or independent site purpose are evident from the available page content.
Safety Assessment for helplists.blog
This domain shows several risk indicators at the time of this scan. It was flagged by 8 security engines, with multiple detections describing the site as phishing or malicious, and an additional malware scan marked one JavaScript file as suspicious. The page also appears to reference a well-known cryptocurrency information brand while operating from an unrelated domain, which may indicate a look-alike setup intended to build trust or redirect visitors.
Additional context increases caution: the domain is only 7 days old, has no established traffic ranking, and the visible page is extremely minimal while prompting users to continue to a "secure voting page." Although major threat databases and blacklist checks did not detect listings at the time of this scan, newly created phishing pages can sometimes appear before broader blocklists catch up. Based on these findings, this website may pose potential risks to visitors.
Technical Description
The site uses a valid Let's Encrypt SSL certificate, which means traffic to the site may be encrypted in transit, but this alone does not indicate legitimacy. DNSSEC appears to be unsigned, the nameservers are hosted through Cloudflare, and the server resolves to an IP in Frankfurt am Main, Germany associated with Dedik Services Limited.
The web server identifies itself as SimpleHTTP/0.6 Python/3.10.12, which is an unusual choice for a polished public-facing service and may suggest a lightweight or temporary deployment. Combined with the domain's very recent registration and the suspicious JavaScript finding, the infrastructure profile appears relatively low-trust at the time of this scan.
Share your experience with this website. Was it safe? Did you encounter any issues?