heliumswap[.]xyz

This domain, heliumswap.xyz, poses a generic phishing threat, likely designed to drain cryptocurrency wallets by impersonating the Helium (HNT) blockchain platform. Analysis indicates it targeted users seeking legitimate Helium swap services, using a deceptive interface to harvest private keys or seed phrases. The domain is currently offline, but its infrastructure suggests it was a sophisticated phishing kit.

Technical evidence from security scans reveals a VirusTotal detection rate of 5 out of 95 vendors, confirming malicious classification by multiple engines. The domain was registered on July 22, 2024, via registrar GMO Internet Group, Inc. d/b/a Onamae.com, and resolves to the IPv6 address 2a02:26f0:1700:11::b856:679f hosted on Akamai infrastructure. The SSL certificate was issued by GoDaddy.com, Inc., and the domain appears on one security blocklist. Technologies detected include Node.js, Envoy, Express, HSTS, and Akamai, indicating a custom-built backend rather than a simple cloned site.

Users who visited heliumswap.xyz should immediately rotate any passwords or recovery phrases used on the site, enable two-factor authentication on all crypto accounts, and monitor wallets for unauthorized transactions. If credentials were entered, assume the account is compromised and transfer remaining funds to a new, secure wallet. Run a full antivirus scan and report the incident to relevant blockchain security forums.