heliumcompliance[.]info

The domain heliumcompliance.info was registered on 2026-07-18 through NICENIC INTERNATIONAL GROUP CO., LIMITED and is served by the Cloudflare authoritative nameservers aryanna.ns.cloudflare.com and gabe.ns.cloudflare.com. DNS resolution points to the IP address 104.21.72.244, which belongs to Cloudflare’s global edge network, indicating that the site is hosted behind Cloudflare’s reverse‑proxy service. The domain appears on the PhishDestroy blocklist and is listed on one additional security blocklist, confirming that at least one external mitigation platform has identified it as malicious.

VirusTotal scans have recorded detections from four of ninety‑five AV engines, providing independent confirmation of suspicious content. No public Safe Browsing, OTX, SSL certificate details, HTTP status codes, or page‑title information are available in the current intelligence set, leaving the exact payload and landing‑page behavior unverified. Analysis indicates that the infrastructure choices—recent registration, Cloudflare DNS, and IP address reuse—are consistent with typical phishing campaigns that rely on fast‑deployment and anonymity.

The presence of multiple detection signals (PhishDestroy block, VirusTotal flags) justifies a high‑risk rating despite the limited forensic detail. Defenders should immediately block heliumcompliance.info at perimeter firewalls and proxy layers, add the domain to URL filtering and email security deny lists, and monitor DNS queries for the associated Cloudflare nameservers. Continuous re‑evaluation is advised: if additional threat‑intel sources (e.g., Safe Browsing, OTX) surface, or if the site begins serving malicious payloads, remediation actions must be escalated accordingly.