helius[.]id

The domain helius.id was registered on July 19, 2026 through PT Web Commerce Communications and is currently active. Its authoritative nameservers are dara.ns.cloudflare.com and zeus.ns.cloudflare.com, indicating use of Cloudflare's DNS infrastructure. DNS resolution points to the IPv4 address 104.21.43.57, which is hosted on Cloudflare's edge network. The domain appears on a single security blocklist, specifically PhishDestroy, which has already flagged it as malicious.

VirusTotal reports that the domain was scanned by 91 anti‑malware vendors, with none returning a detection; however, the absence of detections does not constitute proof of benign intent. No additional public intelligence such as Safe Browsing, OTX, SSL certificate details, HTTP response codes, trust scores, or page titles is available at this time. Consequently, the primary indicators of compromise are limited to the recent registration date, the Cloudflare hosting pattern, and the inclusion on the PhishDestroy blocklist. Defenders should consider proactively blocking helius.id at the DNS layer and, where feasible, also block outbound connections to its resolved IP 104.21.43.57.

Network monitoring rules that flag TLS handshakes or HTTP requests to this domain can help detect attempted credential harvesting. Because the site’s content and targeted brand have not been disclosed, security teams should remain vigilant for any related phishing emails or malicious links that reference helius.id, and should update detection signatures as further evidence emerges. Continuous re‑evaluation of the domain’s status on broader threat intelligence feeds is recommended to capture any subsequent classification changes or additional blocklist listings.