hlp0-earn[.]vercel[.]app

Analysis of hlp0-earn.vercel.app indicates that the domain is being used for a phishing operation and has been taken offline as of the reporting date. The site was registered through Tucows Domains Inc. on February 21, 2026 and is hosted on the Vercel platform, as evidenced by the presence of Vercel technology and an HTTP Strict Transport Security (HSTS) header. The domain resolves to IP address 64.29.17.195, which belongs to Amazon.com, Inc. (AS16509) and is geolocated in the United States. TLS termination is provided by Google Trust Services under the WR1 certificate, confirming that a legitimate certificate authority was used for encryption.

An HTTP 451 status was observed, indicating that the content was unavailable for legal reasons, and the site is currently reported as offline. Independent threat‑intelligence feeds have flagged the domain on two blocklists, specifically PhishDestroy and ScamSniffer, and VirusTotal recorded detections from two of ninety‑three security vendors, reinforcing the malicious classification. The page title returned by the server is "HLP0," which does not reveal any legitimate branding or purpose.

While the exact phishing lure (e.g., credential harvesting, payment redirection) is not disclosed in the available data, the combination of registrar, hosting, certificate, blocklist presence, and vendor detections provides strong evidence of a phishing threat. Defenders should continue to block the domain at network and endpoint layers, monitor for any re‑registration attempts, and consider adding the IP address 64.29.17.195 to deny‑list policies. Ongoing observation of related Vercel‑hosted assets is advised, as threat actors often reuse infrastructure across campaigns.