hellovaulto[.]com

This domain, hellovaulto.com, is flagged as an active credential phishing site targeting users through impersonation of a pedicure studio based in Amsterdam, as indicated by its page title 'Hello Vaulto — Pedicure Studio Amsterdam'. Registered on April 24, 2026, the domain remains operational with a 301 HTTP redirect, resolving to the IP address 95.143.172.246, hosted on infrastructure located in Germany under the rh-tec IP network. The domain is served by nameservers ares.trustname.com and zeus.trustname.com, and was registered through Fewmoretaps OU operating as Trustname.com. Analysis reveals the use of Nginx as the web server technology, alongside HTTP Strict Transport Security (HSTS) enforcement, which may be employed to lend an appearance of legitimacy. The SSL certificate is issued by Let's Encrypt (R13), a common choice for both legitimate and malicious sites. The domain appears on at least one security blocklist and is detected by 5 out of 94 security vendors on VirusTotal, though the specific nature of these detections is not detailed in available intelligence. Gridinsoft assigns a trust score of 0/100, further indicating malicious intent. No specific phishing kit or brand impersonation beyond the pedicure studio context is confirmed. The exact content and mechanics of the credential harvesting page remain unanalyzed, but the domain’s classification as a phishing threat is supported by its presence on blocklists and low trust scores. Defenders should treat this domain as high-risk and consider blocking it at the DNS or network level. Monitoring for related infrastructure, such as shared IPs or nameservers, may help identify additional threats from the same actor.