# PhishDestroy domain threat record: btint46826.wcard.me Content language: English Canonical HTML report: https://phishdestroy.io/domain/btint46826.wcard.me/ Machine-readable companion: https://phishdestroy.io/domain/btint46826.wcard.me/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: unknown - First observed by PhishDestroy: 2026-10-23 17:04:29 UTC - Stored record updated: 2026-10-23 20:55:16 UTC - VirusTotal detections in the stored snapshot: 15/92 - Independent public blocklist matches in the stored snapshot: 0 - Google Safe Browsing stored result: no stored flag ## Stored infrastructure - Observed IP address: 165.232.181.150 - Registrar in stored WHOIS data: GoDaddy.com, LLC - Last stored HTTP status: 200 - Registration date (registry RDAP, wcard.me): 2023-08-01 07:00:08 UTC ## Evidence links - URLScan report: https://urlscan.io/result/01a100ba-3489-72ca-a185-990a9d11d150/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/btint46826.wcard.me - Certificate Transparency search: https://crt.sh/?q=%25.btint46826.wcard.me - Web Archive lookup: https://web.archive.org/web/*/https://btint46826.wcard.me/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview PhishDestroy added btint46826.wcard.me to its internal blocklist on 2026-10-23 based on a trusted intake report. The prior automated assessment on the same day could not determine malicious behavior because the page content was insufficient for analysis. The recorded page title reads “Bt Internet - Important Notice from Bt”. An HTTP 200 response was observed on 2026-10-23. How the scam works The detections label the domain as phishing, a category where attackers impersonate legitimate brands to lure users into revealing credentials or personal data. The page title suggests an attempt to appear as an official notice from the brand “Bt”, but no specific credential‑collection form or malicious payload was observed. Without concrete evidence of a particular technique, the risk remains the generic threat of brand‑spoofing phishing. Evidence VirusTotal scanned the domain on 2026-10-20 and reported 15 malicious detections out of 92 engines, with vendors such as BitDefender, ESET and Fortinet flagging it as phishing. Google Safe Browsing checked the URL on 2026-10-23 and did not flag it. urlscan.io captured the site on 2026-10-03; its machine‑learning engine gave a malicious score of 61, but the overall verdict was clean. Cloudflare Radar scanned the site on 2026-10-23 and marked it malicious with a phishing category. OTX listed zero pulses on the same day, and no external blocklists reported the domain. Infrastructure The recorded observation showed the domain pointed to 165.232.181.150, which was hosted by DigitalOcean, LLC in Bengaluru, India, and used a Let’s Encrypt certificate for HTTPS. The domain was created 446 days ago and its apex domain is 1,576 days old; the TLS certificate was issued on 2026-09-21 and expires on 2026-12-20. Nameservers are ns1‑ns3.digitalocean.com and DNSSEC is not enabled. What to do If you entered any login credentials on the site, change those passwords immediately and enable multi‑factor authentication where possible. Monitor associated accounts for unauthorized activity and consider blocking the domain at the network perimeter. Defenders should add btint46826.wcard.me to web filtering rules and review server logs for any requests to the recorded IP address. Useful links urlscan.io scan and screenshot: https://urlscan.io/result/01a100ba-3489-72ca-a185-990a9d11d150/ Cloudflare Radar report: https://radar.cloudflare.com/scan/2391c3e1-502c-4e45-bc8b-213e8b381337 Stored capture screenshot: https://urlscan.io/screenshots/01a100ba-3489-72ca-a185-990a9d11d150.png Cloudflare Radar screenshot (2026-10-23T17:17:24Z): https://screenshots.phishdestroy.io/cf/2391c3e1-502c-4e45-bc8b-213e8b381337.png VirusTotal report: https://www.virustotal.com/gui/domain/btint46826.wcard.me Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=btint46826.wcard.me Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-23 17:18:53 UTC ## Stored page captures - Primary capture: https://urlscan.io/screenshots/01a100ba-3489-72ca-a185-990a9d11d150.png Captured: 2026-10-23 17:04:29 UTC - URLScan capture: https://screenshots.phishdestroy.io/01a100ba-3489-72ca-a185-990a9d11d150.png Source report: https://urlscan.io/result/01a100ba-3489-72ca-a185-990a9d11d150/ - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/2391c3e1-502c-4e45-bc8b-213e8b381337.png Captured: 2026-10-23 17:17:24 UTC Source report: https://radar.cloudflare.com/scan/2391c3e1-502c-4e45-bc8b-213e8b381337 SHA-256: 9b2c3478dd6830fa0227198503d1e39def0c46a8863900ae7743c29880d5b084 ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-23T17:18:08Z", "uuid": "01a100ba-3489-72ca-a185-990a9d11d150", "scanned_at": "2026-10-03T07:46:41Z", "final_url": "https://btint46826.wcard.me/", "status": 200, "redirected": "https-only", "redirects": [ { "to": "https://btint46826.wcard.me/", "from": "http://btint46826.wcard.me/", "status": 307 } ], "ip": "165.232.181.150", "domains": [ "www.googletagmanager.com", "connect.facebook.net", "www.google-analytics.com", "wcardcdn.b-cdn.net", "c.clarity.ms", "a.clarity.ms", "www.facebook.com", "analytics.google.com", "c.bing.com", "scripts.clarity.ms", "stats.g.doubleclick.net", "www.clarity.ms", "fonts.gstatic.com", "wcmedia.b-cdn.net", "fonts.googleapis.com" ], "ips": [ "150.171.27.10", "150.171.109.77", "51.8.71.184", "57.144.180.1", "150.171.109.72", "142.250.31.156", "142.251.45.206", "57.144.180.128", "4.153.187.221", "216.239.34.178", "142.250.72.3", "142.250.191.8", "138.199.40.58", "79.127.243.187", "142.251.211.106" ], "asns": [ "8075", "32934", "15169", "60068", "14061" ], "countries": [ "US", "IN" ], "link_domains": [ "internetconnect.framer.website", "wcard.io" ], "doc_hash": "32ee6200751ccb1990456e1d8cd90665f55f929f39665e46ea22b349bb566387", "globals": [ "central_url", "base_url", "cdn_url", "isOwner", "wcard", "pageCache", "country", "dataLayer", "webpackChunk", "_t", "GoogleAnalyticsObject", "ga", "eventTracking", "google_tag_data", "google_tag_manager", "clarity", "fbq", "_fbq", "gaplugins", "gaGlobal", "gaData", "onYouTubeIframeAPIReady", "__clr" ], "cookies": [ "_gid", "_gat", "_gat_UA-198465076-1", "XSRF-TOKEN", "btint46826_wcard_me_session", "_ga", "_ga_WKLXMXK95G", "CLID", "_clck", "_fbp", "fr", "_clsk", "MUID", "MR", "SRM_B", "SM", "ANONCHK" ], "storage_keys": [ "_cltk", "lastExternalReferrer", "lastExternalReferrerTime" ], "tls": { "san": [ "*.wcard.me", "wcard.me" ], "cipher": "AES_256_GCM", "issuer": "YR2", "subject": "wcard.me", "protocol": "TLS 1.3", "valid_to": "2026-12-20T13:12:23Z", "valid_from": "2026-09-21T13:12:24Z" }, "domain_age_days": 446, "apex_age_days": 1576, "tls_age_days": 11, "tls_valid_days": 89, "requests": 33, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 61, "malicious": true }, "overall": { "score": 0, "malicious": false } }, "headers": { "server": "Apache", "content-type": "text/html; charset=UTF-8", "x-content-type-options": "nosniff", "referrer-policy": "same-origin" } }, "cf": { "v": 1, "fetched_at": "2026-10-23T17:18:10Z", "uuid": "2391c3e1-502c-4e45-bc8b-213e8b381337", "scanned_at": "2026-10-23T17:17:24Z", "final_url": "https://btint46826.wcard.me/", "status": 200, "history": [ { "url": "https://btint46826.wcard.me/", "status": 200 } ], "dom_hash": "a984829cf07cf0faf25dfdb4f038786271dae84827818a7775daa39c04a3920c", "doc_hash": "924e55107f00b53973072a8d75fc81bf2d58a99d01c7f92f45a04791e924a9e4", "domain_risks": [ "Phishing", "Security threats", "CIPA Filter", "CIPA" ], "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "btint46826.wcard.me", "type": "A", "value": "165.232.181.150" } ], "dnssec_valid": false, "ip": "165.232.181.150", "verdict": { "tags": [ "phishing" ], "malicious": true, "categories": [ "phishing" ] }, "whois": { "registrar": "GoDaddy.com, LLC", "created": "2023-08-01T07:00:08Z", "updated": "2026-08-12T08:11:53Z", "expires": "2028-08-01T07:00:08Z", "nameservers": [ "ns1.digitalocean.com", "ns2.digitalocean.com", "ns3.digitalocean.com" ] } }, "vt": { "v": 1, "fetched_at": "2026-10-23T17:16:39Z", "analysis_at": "2026-10-20T10:09:08Z", "stats": { "timeout": 0, "harmless": 44, "malicious": 15, "suspicious": 0, "undetected": 33 }, "detections": { "ESET": "phishing", "VIPRE": "malware", "G-Data": "phishing", "Lionic": "phishing", "Sophos": "phishing", "CyRadar": "phishing", "Webroot": "malicious", "Fortinet": "phishing", "Kaspersky": "phishing", "Seclookup": "malicious", "Gridinsoft": "phishing", "BitDefender": "phishing", "Chong Lua Dao": "malicious", "alphaMountain.ai": "phishing", "Forcepoint ThreatSeeker": "phishing" }, "reputation": 0, "categories": { "alphaMountain.ai": "Phishing (alphaMountain.ai)" }, "registrar": "GoDaddy.com, LLC", "created": "2023-08-01T07:00:08Z", "expires": "2028-08-01T07:00:08Z", "updated": "2026-08-12T08:11:53Z", "first_seen": "2025-07-13T11:29:53Z", "dns": [ { "ttl": 3600, "type": "A", "value": "165.232.181.150" } ], "dns_at": "2026-10-20T10:17:33Z", "jarm": "3fd3fd15d3fd3fd00042d42d000000cd600c085f371f8533aaf66051f8e5b1", "cert": { "san": [ "*.wcard.me", "wcard.me" ], "issuer": "Let's Encrypt / YR2", "serial": "6d9c1be97e58ad9caab6c867be4dd39110d", "sha256": "a1ed56d167a45b6737323f124cdb911d82136579591ebf35cfe2d6bc4bd802b5", "subject": "wcard.me", "valid_to": "2026-12-20T13:12:23Z", "valid_from": "2026-09-21T13:12:24Z" }, "whois": { "registrar": "GoDaddy.com, LLC", "registrar_iana_id": "146", "registrar_url": "http://www.godaddy.com/domains/search.aspx", "created": "2023-08-01T07:00:08Z", "updated": "2026-08-12T08:11:53Z", "expires": "2028-08-01T07:00:08Z", "status": [ "clientDeleteProhibited", "clientRenewProhibited", "clientTransferProhibited", "clientUpdateProhibited" ], "nameservers": [ "ns1.digitalocean.com", "ns2.digitalocean.com", "ns3.digitalocean.com" ], "dnssec": "unsigned" } }, "webcheck": { "v": 1, "fetched_at": "2026-10-23T17:18:26Z", "caa_records": { "domain": "btint46826.wcard.me" }, "block_lists": { "resolvers": 12, "blocked_by": [ "CloudFlare Family" ], "blocked_count": 1 }, "archives": { "last": "2026-10-23T17:09:38Z", "first": "2026-10-23T17:09:38Z", "changes": 0, "days_archived": 1, "avg_page_bytes": 5610 }, "robots_txt": { "agents": [ "Twitterbot", "*", "Googlebot", "Googlebot-Mobile" ], "present": true, "sitemaps": [ "https://wcard.io/sitemap.xml" ] }, "sitemap": { "present": true, "url_count": 78 }, "social_tags": { "ogUrl": "https://btint46826.wcard.me", "title": "Bt Internet - Important Notice from Bt", "ogType": "website", "robots": "noindex,nofollow", "ogImage": "https://wcardcdn.b-cdn.net/api/og/image.jpg", "ogTitle": "Bt Internet - Important Notice from Bt", "description": "Digital Business Card of Bt Internet Important Notice from Bt", "twitterCard": "summary", "twitterSite": "@officialwcard", "canonicalUrl": "https://btint46826.wcard.me", "ogDescription": "Digital Business Card of Bt Internet Important Notice from Bt" }, "trackers": { "requests": 11, "trackers": [ { "name": "Google Tag", "company": "Google", "country": "US", "category": "Advertising", "requests": 1 }, { "name": "Bunny CDN", "company": "BunnyWay", "country": "SI", "category": "Hosting", "requests": 4 }, { "name": "Google Fonts", "company": "Google", "country": "US", "category": "Hosting", "requests": 1 }, { "name": "Google Static", "company": "Google", "country": "US", "category": "Hosting", "requests": 1 }, { "name": "Google Analytics", "company": "Google", "country": "US", "category": "Site Analytics", "requests": 2 }, { "name": "Google Tag Manager", "company": "Google", "country": "US", "category": "Utilities", "requests": 1 } ] }, "mixed_content": { "no_sri": [ "https://wcardcdn.b-cdn.net/themes/wcard/js/app.js" ], "third_party_scripts": 1 }, "status": { "up": true, "code": 200, "timings": { "dns": 71, "tls": 149, "wait": 632, "connect": 144, "download": 0 }, "response_ms": 996 }, "tls_connection": { "alpn": "h2", "cipher": "TLS_AES_256_GCM_SHA384", "protocol": "TLSv1.3", "versions": [ "TLSv1.2", "TLSv1.3" ], "authorized": true, "forward_secrecy": true }, "ports": { "open": [ 22, 80, 443 ] }, "carbon": { "bytes": 12923, "co2_grams": 0.0005, "cleaner_than": 66 }, "dns_server": { "ns": [ { "ip": "172.64.52.210", "host": "ns1.digitalocean.com" }, { "ip": "172.64.49.209", "host": "ns3.digitalocean.com" }, { "ip": "172.64.53.21", "host": "ns2.digitalocean.com" } ], "zone": "wcard.me" }, "cookies": { "cookies": [ { "name": "_ga" }, { "name": "_gid" }, { "name": "_gat" }, { "name": "XSRF-TOKEN", "secure": true, "same_site": "Lax" }, { "name": "btint46826_wcard_me_session", "secure": true, "http_only": true, "same_site": "Lax" } ] }, "location": { "ip": "165.232.181.150", "asn": "14061", "org": "DigitalOcean, LLC", "city": "Bengaluru", "country": "IN" }, "ssl": { "issuer": "Let's Encrypt / YR2", "subject": "wcard.me" }, "dns": { "A": [ "165.232.181.150" ] }, "dnssec": { "ds": false, "rrsig": false, "dnskey": false }, "hsts": { "message": "Site does not serve any HSTS headers." }, "http_security": { "xFrameOptions": false, "referrerPolicy": "same-origin", "xXSSProtection": "1; mode=block", "permissionsPolicy": false, "xContentTypeOptions": "nosniff", "contentSecurityPolicy": false, "strictTransportPolicy": false, "crossOriginOpenerPolicy": false, "crossOriginEmbedderPolicy": false, "crossOriginResourcePolicy": false }, "get_ip": { "ip": "165.232.181.150", "family": 4 }, "redirects": { "chain": [ "https://btint46826.wcard.me" ] }, "social_presence": { "profiles": [ "https://x.com/officialwcard" ] }, "whois": { "registrar": "GoDaddy.com, LLC", "created": "2023-08-01T07:00:08Z", "updated": "2026-08-12T08:11:53Z", "expires": "2028-08-01T07:00:08Z", "status": [ "clientDeleteProhibited https://icann.org/epp", "clientRenewProhibited https://icann.org/epp", "clientTransferProhibited https://icann.org/epp", "clientUpdateProhibited https://icann.org/epp" ], "nameservers": [ "ns1.digitalocean.com", "ns2.digitalocean.com", "ns3.digitalocean.com" ] }, "headers": { "headers": { "server": "Apache", "content-type": "text/html; charset=UTF-8", "x-content-type-options": "nosniff", "referrer-policy": "same-origin" } } } } ```