hatcas[.]com

Analysis of hatcas.com, observed as offline on July 23, 2026, indicates that the domain was used for a generic phishing campaign. The site presented the page title "HATCAS | Open the world of luck and rewards!" and was registered on February 21, 2026 through GMO Internet Group, Inc. d/b/a Onamae.com. The domain resolves to IP address 188.114.97.3, which belongs to AS13335 Cloudflare, Inc. in the United States. Nameservers listed for the domain are ns1.verification-hold.suspended-domain.com and ns2.verification-hold.suspended-domain.com, suggesting a verification‑hold status typical of recently seized or takedown‑initiated domains.

The SSL certificate was issued by GoDaddy.com, Inc. under the Go Daddy Secure Certificate Authority - G2, confirming the presence of a valid TLS layer despite the malicious intent. Technical fingerprints show the server stack includes Nginx and OpenResty. Threat intelligence sources have flagged the domain on a single security blocklist, specifically PhishDestroy, and VirusTotal reports three of ninety‑three scanning engines as positive, reinforcing the suspicion of malicious activity.

While the exact phishing payload or targeted brand is not disclosed, the combination of a reward‑oriented page title, recent registration, Cloudflare hosting, and detection by reputable blocklists aligns with typical phishing infrastructure. Defenders should add hatcas.com to deny‑list controls, monitor DNS queries for the associated IP and nameservers, and enforce web‑gateway filtering for any traffic to the domain. Continuous re‑evaluation is advised in case the domain is re‑activated or repurposed, but current evidence supports treating hatcas.com as a malicious phishing asset.