helmorixy-nl[.]live

This domain, helmorixy-nl.live, is flagged as an active high-risk phishing infrastructure impersonating the Helmorixy brand, as indicated by its page title 'Helmorixy | Officieel Platform voor AI-ondersteunde Handel' and classification as brand impersonation. Registered on May 15, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, the domain resolves to IP 188.114.96.3, hosted on Cloudflare infrastructure in Canada, with nameservers todd.ns.cloudflare.com and karsyn.ns.cloudflare.com. The SSL certificate is issued by Let's Encrypt (E8), a common choice for both legitimate and malicious sites. As of July 13, 2026, the domain returns an HTTP 200 status, confirming active hosting, and appears on one security blocklist. It has been identified in one AlienVault OTX threat intelligence pulse, suggesting limited but confirmed malicious activity. Analysis of available data indicates the domain is designed to deceive users into believing it is an official AI-assisted trading platform. The use of Cloudflare nameservers and hosting is consistent with phishing campaigns seeking to obscure origin and evade takedowns. While three of 92 security vendors on VirusTotal flag the domain, this detection rate is not conclusive and should not be interpreted as definitive proof of maliciousness or safety. The domain's registration age (under two months) and use of a Let's Encrypt certificate are typical of both legitimate and fraudulent sites, offering no standalone indicators of compromise. Defenders should treat this domain as high-risk due to its active status, brand impersonation classification, and presence on security blocklists. Recommended actions include blocking the domain at DNS and proxy levels, monitoring for connections to 188.114.96.3, and alerting users to the impersonation of AI trading platforms.