helicoptershot[.]in[.]net

The domain helicoptershot.in.net was created on April 16, 2013 and is registered through PDR Ltd. d/b/a PublicDomainRegistry.com. DNS resolution points to the IP address 104.18.7.72, which belongs to AS13335 Cloudflare, Inc., located in the United States. The domain’s authoritative nameservers are listed as gemma.ns.cloudflare.com, ns1.nic.in.net, ns2.nic.in.net, ns3.nic.in.net, and ns4.nic.in.net, indicating a mixed delegation that includes both Cloudflare and Indian NIC infrastructure.

No SSL certificate is presented for the host, and an HTTP request returns the page title "FORBIDDEN," suggesting that the site is intentionally inaccessible or has been taken down. The current status is offline; the site was blocked by the PhishDestroy service and carries a Gridinsoft trust score of 0 out of 100, reflecting an extremely low confidence rating. VirusTotal analysis shows that one out of ninety‑three security vendors flagged the domain as malicious, and the domain appears on a single security blocklist.

These indicators together confirm the presence of a phishing‑related threat, but the lack of additional detections and limited public evidence leave the exact payload or targeted brand undefined. Defenders should continue to block the domain at network perimeter devices, ensure that any cached DNS entries are purged, and monitor for future re‑registration attempts. Ongoing surveillance of the associated IP range and Cloudflare‑hosted infrastructure is advised to detect any resurgence of malicious activity.