helixlightgrams[.]com

The domain helixlightgrams.com was registered on July 16, 2025 through GMO Internet, Inc. and resolves to the IPv4 address 49.212.202.203, which is assigned to AS9371 SAKURA Internet Inc. in Japan. The authoritative nameservers dns01.muumuu-domain.com and dns02.muumuu-domain.com are actively serving the zone, indicating that the domain is currently live and reachable over the public Internet.

Technical probing reveals a web service built on a UNIX platform, employing Apache HTTP Server and OpenSSL for TLS termination. The site presents a valid SSL certificate issued by Let’s Encrypt (certificate identifier E8) and returns an HTTP 200 status code for the root path. The page title, rendered in Japanese, reads "学習塾に関連する情報を紹介します｜学習塾の選び方　2025年9月更新," suggesting that the content is oriented toward educational services, though the actual page content has not been examined.

Reputation services flag the domain as malicious. VirusTotal reports a single detection out of ninety‑five scanned security vendors, and Gridinsoft assigns a trust score of zero out of one hundred. The domain appears on one known blocklist and is actively blocked by the PhishDestroy service. These signals, combined with the high‑risk classification of generic_phishing, indicate that the infrastructure is being used for credential‑harvesting or related phishing activities.

Defenders should add the IP address 49.212.202.203 and the domain helixlightgrams.com to outbound and inbound filtering rules, monitor DNS queries for the associated nameservers, and ensure that any traffic to the Let’s Encrypt‑secured site is logged and inspected. Continuous re‑evaluation of the domain’s detection status is advised, as additional security vendors may increase their detection counts over time. Organizations that reference educational services in their communications should be particularly vigilant for potential lure attempts targeting users of Japanese tutoring or academy platforms.