heliumswap[.]org

Analysis indicates that heliumswap.org was registered on 2026-07-06 through Spaceship, Inc. and is hosted on IP 186.2.175.35. The domain resolves to the authoritative name servers launch1.spaceship.net and launch2.spaceship.net, both operated by the same registrar. It has already been listed on the PhishDestroy blocklist, marking it as a known malicious resource. A VirusTotal scan involving 91 antivirus and URL‑checking engines returned no detections, but the absence of alerts does not constitute a safety assurance, especially given the early registration date and blocklist inclusion.

No additional intelligence such as Safe Browsing, OTX, SSL certificate details, HTTP response codes, or page‑title information is currently available, limiting the depth of the present profile. No TLS certificate was observed during the initial lookup, which may indicate the site is served over plain HTTP, a common trait of early‑stage phishing infrastructure. The lack of a publicly disclosed page title or brand targeting further hampers attribution, but the presence on a dedicated phishing blocklist implies intent to harvest credentials or personal data. Defenders should proactively block connections to 186.2.175.35 and to heliumswap.org at the DNS level, monitor for any outbound traffic to the associated name servers, and flag any emails or web requests that reference the domain for further investigation.

Network defenders should also consider filtering outbound connections to launch1.spaceship.net and launch2.spaceship.net, as these servers could be used for command‑and‑control or further domain resolution. Correlation with endpoint logs that show DNS queries for heliumswap.org or its name servers within the last 24 hours can help identify compromised hosts. Continuous re‑scanning on VirusTotal and integration of real‑time threat feeds is recommended to capture any future changes in detection status.