heliora[.]io

Analysis of heliora.io indicates a brand-impersonation campaign delivering a fake airdrop scam. The domain was registered on September 01, 2025 and is currently taken offline, yet historical resolution points to the IP address 64.29.17.1, hosted by Amazon.com, Inc. (AS16509) in the United States. Nameserver delegation uses three Njalla services (1-you.njalla.no, 2-can.njalla.in, 3-get.njalla.fo), a pattern frequently observed in disposable or rapidly‑re‑hosted malicious infrastructure. The site presented the page title "Heliora" but did not present an SSL certificate, leaving communications unencrypted and facilitating easy content alteration.

Reputation scoring from Gridinsoft assigned a trust score of 0 out of 100, reflecting a complete lack of confidence in the host. The domain appears on two independent security blocklists and has been flagged by the PhishDestroy and ScamSniffer detection engines, confirming its classification as a malicious actor. VirusTotal scans recorded detections from two of ninety‑five vendors, reinforcing the presence of malicious indicators despite the relatively low detection count. The campaign’s stated target is listed as "across," suggesting a broad impersonation of multiple brands rather than a single entity.

Defenders should immediately block heliora.io at DNS and proxy layers, add the associated IP 64.29.17.1 to network‑level deny lists, and monitor for re‑registration or re‑use of the same nameservers. Continuous scanning of the IP range owned by AS16509 for new domains using similar naming patterns is advisable. Given the absence of TLS, any future re‑activation would expose users to unsecured content delivery, so enforcing HTTPS‑only policies where feasible can mitigate exposure. Organizations should also update threat intelligence feeds with the observed indicators and consider sharing the domain’s metadata with industry‑wide blocklist providers to enhance collective defenses.