helis[.]vn

This domain is flagged as a high-risk generic phishing site and remains active as of July 12, 2026. It is blocked by PhishDestroy and PhishingDB, and appears on two additional security blocklists. VirusTotal analysis shows 11 of 95 security vendors flag this domain as malicious. The page title indicates it is presenting itself as Helis, a solar energy grid solution provider in Vietnam. The domain resolves to IP 14.177.232.31, hosted in Vietnam by VNPT Corp (AS45899), and was registered through the same provider. SSL encryption is provided by a Let's Encrypt certificate (R13), and the site enforces HSTS. Nameservers are ns1.pavietnam.vn, ns2.pavietnam.vn, and nsbak.pavietnam.net. AlienVault OTX has identified this domain in 18 threat intelligence pulses, and Gridinsoft gives it a trust score of 0/100, indicating high confidence in its malicious nature. The exact phishing method or targeted brand beyond the Helis name is not specified in available intelligence; defenders should treat any unsolicited emails, links, or credentials submitted to this domain as compromised. Infrastructure analysis confirms the domain is actively serving content (HTTP 200) and is likely part of a broader phishing campaign against Vietnamese energy or utility users. Defenders should block the domain at network and email gateways, monitor for related subdomains or IPs on the same ASN, and investigate any user interactions for credential theft or data exfiltration. No additional technical details about the phishing kit or landing page content are available at this time.