heliumswap[.]net

Analysis of heliumswap.net as of August 05 2026 indicates that the domain was registered on July 31 2026 through Fewmoretaps OU doing business as Trustname.com. The authoritative name servers are elijah.ns.cloudflare.com and teagan.ns.cloudflare.com, and DNS resolution points to the address 104.21.37.172, a Cloudflare‑hosted IP. The domain appears on a single external blocklist and has been actively blocked by the PhishDestroy service, reflecting that it is being treated as malicious by at least one reputable sinkhole. VirusTotal records show that the domain was submitted to 91 scanning engines, none of which returned a positive classification at the time of the scan; the absence of detections does not constitute a safety guarantee.

No additional public reputation services, such as Google Safe Browsing or OTX, are referenced in the current intelligence set. Consequently, the confidence level regarding the domain’s malicious purpose remains limited to the observed blocklist entry and the PhishDestroy block. The short lifespan of the domain—created only a few days before the report date—combined with the rapid deployment of defensive listings suggests an opportunistic campaign, but the underlying payload, targeted brands, or phishing kit have not been disclosed.

Defenders should continue to monitor DNS queries for 104.21.37.172 and enforce existing blocklist rules that include heliumswap.net. Adding the domain to internal deny lists, instrumenting proxy logs for HTTP requests to the host, and correlating any user‑initiated connections with endpoint telemetry will help identify potential compromise attempts. Given the limited public evidence, periodic re‑scanning with multi‑vendor services is advisable to capture any future changes in classification.