lhaclkerone[.]com

Analysis of lhaclkerone.com indicates a high‑risk generic phishing operation. The domain was registered on February 21, 2026 through Tucows Domains Inc. and resolves to IP 104.21.40.234, which belongs to Cloudflare (AS13335) in the United States. DNS resolution uses the authoritative nameservers a.ns.hackerone.com and b.ns.hackerone.com, matching the legitimate HackerOne brand but likely chosen to lend credibility. The site presents the page title "HackerOne | Global leader in offensive security | Security for AI | Crowdsourced Security," yet no visual inspection is available. Infrastructure fingerprints show a stack consisting of Drupal, MariaDB, PHP, Varnish, Nginx, Pantheon, Fastly, and TrustArc, all typical of modern web applications. The SSL certificate is issued by Google Trust Services under the WE1 label, confirming the use of a valid TLS chain. HTTP responses return a 302 redirect, a common tactic to obscure the final landing page. Reputation data is poor: Gridinsoft assigns a trust score of 0 / 100, and the domain appears on three external blocklists. It is actively blocked by PhishDestroy, MetaMask, and SEAL. VirusTotal reports that 2 of 93 scanning engines flag the domain, while AlienVault OTX lists it in seven threat‑intel pulses. The combination of recent registration, use of reputable brand names in DNS, a valid TLS certificate, and multiple detections suggests deliberate deception aimed at credential harvesting. Defenders should block lhaclkerone.com at network perimeter and endpoint layers, monitor DNS queries for the domain and its nameservers, and enforce email filtering rules that flag any messages referencing the HackerOne brand from unauthenticated sources. Ongoing observation is recommended to capture any payloads or redirects that may be delivered after the initial 302 response.