hcba[.]ltd

Analysis of the domain hcba.ltd indicates that it is currently active and associated with a high‑risk generic phishing campaign. The domain is registered through Dynadot Inc and resolves to the authoritative nameservers ns1.peatechnology.com and ns2.peatechnology.com. Public reputation checks show that hcba.ltd appears on a single security blocklist and has been explicitly blocked by the PhishDestroy service, confirming that trusted filtering platforms consider the domain malicious.

An HTTP request to the root of the site returns a 200 OK status, suggesting that a web server is actively delivering content, although the page title and visual characteristics have not been publicly disclosed. VirusTotal records reveal that 13 of 91 scanning vendors flagged the domain as malicious, providing independent corroboration of its threat profile. No additional intelligence such as ASN, geographic location, SSL certificate details, or observed payloads is presently available, leaving those aspects of the infrastructure unverified.

Given the confirmed blocklist listings, the presence on PhishDestroy, and the multiple vendor detections, defenders should treat hcba.ltd as hostile. Recommended mitigations include adding the domain to outbound web filtering rules, updating intrusion detection signatures to include its known nameservers, and monitoring DNS queries for lookups to ns1.peatechnology.com and ns2.peatechnology.com. Continuous re‑evaluation is advised, as changes to hosting or content could affect the threat posture, but current evidence firmly supports treating hcba.ltd as a phishing threat.