heliofinancelimited[.]com

The domain heliofinancelimited.com is currently flagged as a high‑risk generic phishing infrastructure. Registration data shows the domain was created on 12 February 2023 through PDR Ltd. d/b/a PublicDomainRegistry.com, and the authoritative nameservers are ns1.cybercastco.com and ns2.cybercastco.com. DNS resolution points to the IPv4 address 190.97.166.185, which is the sole hosting endpoint observed for this indicator. The address has been listed on at least one external security blocklist, and the domain is actively blocked by the PhishDestroy feed, confirming that defensive communities have identified it as malicious.

VirusTotal analysis recorded detections from two of ninety‑one scanned scanners, reinforcing the suspicion that the site hosts phishing content. No additional public threat‑intelligence sources such as OTX or Google Safe Browsing are referenced in the available data, leaving the broader ecosystem visibility limited to the blocklist entry and the two vendor alerts. The lack of published SSL certificates, HTTP response codes, or page title metadata prevents a deeper content‑level assessment at this time.

Given the confirmed phishing classification, the high risk rating, and the presence of the domain on a blocklist, security operators should block outbound connections to 190.97.166.185 and deny any DNS resolution of heliofinancelimited.com at the network perimeter. Email gateways should add the domain to sender‑reject lists, and endpoint protection solutions should incorporate the two VirusTotal detections into their rule sets. Continuous monitoring of the nameservers ns1.cybercastco.com and ns2.cybercastco.com is advised, as changes could indicate infrastructure scaling. Until further forensic evidence is released, the domain should be treated as actively malicious.