# PhishDestroy domain threat record: getvcc.net Content language: English Canonical HTML report: https://phishdestroy.io/domain/getvcc.net/ Machine-readable companion: https://phishdestroy.io/domain/getvcc.net/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: observed active - First observed by PhishDestroy: 2026-10-25 21:31:44 UTC - Last availability or vendor check: 2026-10-26 00:20:47 UTC - Stored record updated: 2026-10-26 00:20:47 UTC - VirusTotal detections in the stored snapshot: 0/92 - Independent public blocklist matches in the stored snapshot: 0 - Google Safe Browsing stored result: no stored flag ## Stored infrastructure - Observed IP address: 216.198.79.1 - Registrar in stored WHOIS data: NICENIC INTERNATIONAL GROUP CO., LIMITED - Last stored HTTP status: 308 - Registration date in stored WHOIS data: 2026-10-21 10:50:22 UTC ## Evidence links - URLScan report: https://urlscan.io/result/01a174f9-3e01-760c-8a96-6192eec64817/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/getvcc.net - Certificate Transparency search: https://crt.sh/?q=%25.getvcc.net - Web Archive lookup: https://web.archive.org/web/*/https://getvcc.net/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview PhishDestroy added getvcc.net to its internal blocklist on 2026-10-25 after an admin report flagged the four‑day‑old domain. The recorded page title is “GetVCC — Virtual cards for media buyers” and the metadata describes a service to issue virtual cards funded by crypto or fiat. The domain was first seen by PhishDestroy on 2026-10-25, four days after its registration on 2026-10-21. How the scam works No specific malicious behavior was observed on the page, but domains that present financial‑service claims can be used to lure users into providing payment details, crypto credentials, or personal information. Such schemes typically rely on the appearance of legitimacy to harvest data or convince victims to fund fraudulent services. Evidence VirusTotal scanned the domain on 2026-10-25 with 92 engines and reported 0 malicious and 0 suspicious detections. Google Safe Browsing checked the same day and did not flag the site. OTX listed 4 pulses referencing the domain, and urlscan captured a 200 response with a non‑malicious verdict on 2026-10-25. PhishDestroy’s internal blocklist marks the domain as suspicious, while external blocklists returned no matches. Infrastructure The domain was registered on 2026-10-21 through NICENIC INTERNATIONAL GROUP CO., LIMITED and uses the nameservers ns1.vercel-dns.com and ns2.vercel-dns.com. Recorded A records point to 64.29.17.1 and 64.29.17.65, both belonging to ASN 16509 (Amazon.com, Inc.) and served via Vercel. The TLS certificate, issued by Let’s Encrypt on 2026-10-22, is valid for *.getvcc.net until 2027-01-20. What to do Visitors should avoid entering credentials, payment information, or crypto wallet details on the site until its legitimacy can be verified. Organizations should block getvcc.net at the network perimeter and monitor access logs for any connections to the recorded IP addresses. If any personal data was submitted, users should change affected passwords and consider monitoring their financial accounts for unauthorized activity. Useful links urlscan.io scan and screenshot: https://urlscan.io/result/01a174f9-3e01-760c-8a96-6192eec64817/ Cloudflare Radar report: https://radar.cloudflare.com/scan/2e8b56b7-802a-4444-8602-4cba008718cf Stored capture screenshot: https://i.ibb.co/x8Ft6wCK/0a07d294fe1a.png Cloudflare Radar screenshot (2026-10-25T22:07:06Z): https://screenshots.phishdestroy.io/cf/2e8b56b7-802a-4444-8602-4cba008718cf.png VirusTotal report: https://www.virustotal.com/gui/domain/getvcc.net Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=getvcc.net Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-25 22:08:38 UTC ## Stored page captures - Primary capture: https://i.ibb.co/x8Ft6wCK/0a07d294fe1a.png Captured: 2026-10-25 21:31:44 UTC - URLScan capture: https://screenshots.phishdestroy.io/01a174f9-3e01-760c-8a96-6192eec64817.png Captured: 2026-10-25 21:31:44 UTC Source report: https://urlscan.io/result/01a174f9-3e01-760c-8a96-6192eec64817/ - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/2e8b56b7-802a-4444-8602-4cba008718cf.png Captured: 2026-10-25 22:07:06 UTC Source report: https://radar.cloudflare.com/scan/2e8b56b7-802a-4444-8602-4cba008718cf SHA-256: 6dc3dbec855ded9f1ed75f8ed9fca71500a4063aba292b948f56c11464e89c35 - URLScan · 2026-10-25: https://screenshots.phishdestroy.io/us/01a174fd-d947-7569-81ff-eb6586cef1b6.png Captured: 2026-10-25 21:36:04 UTC Source report: https://urlscan.io/result/01a174fd-d947-7569-81ff-eb6586cef1b6/ SHA-256: 516b53c89aeab9a07e3450685ebe310fa5cff860cef22e0737a9d2f9fbc8458c ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-25T21:46:51Z", "uuid": "01a174f9-3e01-760c-8a96-6192eec64817", "scanned_at": "2026-10-25T21:31:02Z", "final_url": "https://www.getvcc.net/", "status": 200, "redirected": "parent-domain", "redirects": [ { "to": "https://www.getvcc.net/", "from": "https://getvcc.net/", "status": 308 } ], "ip": "64.29.17.1", "domains": [ "getvcc.net" ], "ips": [ "64.29.17.1", "216.198.79.1" ], "asns": [ "16509" ], "countries": [ "US" ], "doc_hash": "a9234eecfb4797c62ccc85c07b2f3078c92299cc8a39aed51fc51493e6058fc2", "script_hashes": [ "7c0be00bfd43494dcddc8817168e952d9900555c3e80355686a423eedd2bab22", "5282090385396365ac43c9fd1a8660af608e3ca9d550ca5b2aef9be329f6f19d", "5987486f3909e3232829811a84746249fc866e131b07d337ab0dcc7bd7ba0432", "9979133b088a55aec68e085b741d2dfe7f07eeabac47d3a22de0f190d8e404ad", "5a501ad9bf68057c4883c70f6ca11360cbb6dab61cc4af4ac51ea7966e05ac56", "b5f9b5199b99ab6c141f4540f0b7d0fe803c4ecf6956849ecb6e59d3d439272e", "4f6db2eddf5baa08b5cd31c3e22a12d3a3231889ed883322d9a0c2ae8bf7f8eb", "e98a9bab0ae6cfffc6c8f9b985e70409e32aac1951370f64f79d2dcb096c83ea", "d1f5410f9ddfefac24296e89779bd7855459aba65b8610e46a3a7d592063f7e3", "730540feadd43a880ba6d27c20031c22648152efea2601c5656feaf1432efd2e" ], "globals": [ "TURBOPACK", "__next_f", "next", "__webpack_hash__", "gsapVersions", "_gsap", "_scrollTop", "_scrollLeft", "lenisVersion" ], "tls": { "san": [ "*.getvcc.net", "getvcc.net" ], "cipher": "AES_128_GCM", "issuer": "YR2", "subject": "*.getvcc.net", "protocol": "TLS 1.3", "valid_to": "2027-01-20T10:29:38Z", "valid_from": "2026-10-22T10:29:39Z" }, "domain_age_days": 2937, "apex_age_days": 2937, "tls_age_days": 3, "tls_valid_days": 89, "requests": 18, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": -37, "malicious": false }, "overall": { "score": 0, "malicious": false } }, "headers": { "server": "Vercel", "content-type": "text/html; charset=utf-8", "strict-transport-security": "max-age=63072000; includeSubDomains; preload", "content-security-policy": "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob: https://lehexrjlzgdwijbddfju.supabase.co; font-src 'self' data:; connect-src 'self'", "x-frame-options": "DENY", "x-content-type-options": "nosniff", "referrer-policy": "strict-origin-when-cross-origin", "permissions-policy": "camera=(), microphone=(), geolocation=(), payment=(), usb=(), interest-cohort=()", "cross-origin-opener-policy": "same-origin" } }, "cf": { "v": 1, "fetched_at": "2026-10-25T22:08:26Z", "uuid": "2e8b56b7-802a-4444-8602-4cba008718cf", "scanned_at": "2026-10-25T22:07:06Z", "final_url": "https://www.getvcc.net/", "status": 200, "redirected": "subdomain", "history": [ { "url": "https://getvcc.net/", "status": 308 }, { "url": "https://www.getvcc.net/", "status": 200 } ], "dom_hash": "f4d551037b482a4b630689796a21219f3f0da8f98aa2e0805133f04265f58f69", "doc_hash": "360232adf071b4991ebe0dee1f0ab7a2800011e19f9c850283b01e832f4a4222", "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "getvcc.net", "type": "A", "value": "64.29.17.65" }, { "name": "getvcc.net", "type": "A", "value": "64.29.17.1" }, { "name": "www.getvcc.net", "type": "A", "value": "64.29.17.65" }, { "name": "www.getvcc.net", "type": "A", "value": "64.29.17.1" } ], "dnssec_valid": false, "ip": "64.29.17.65", "whois": { "registrar": "NICENIC INTERNATIONAL GROUP CO., LIMITED", "created": "2026-10-21T12:50:22Z", "updated": "2026-10-22T08:33:29Z", "expires": "2028-10-21T12:50:22Z", "nameservers": [ "ns1.vercel-dns.com", "ns2.vercel-dns.com" ] } }, "vt": { "v": 1, "fetched_at": "2026-10-25T22:06:24Z", "analysis_at": "2026-10-25T21:53:18Z", "stats": { "timeout": 0, "harmless": 55, "malicious": 0, "suspicious": 0, "undetected": 37 }, "reputation": 0, "registrar": "NICENIC INTERNATIONAL GROUP CO., LIMITED", "created": "2026-10-21T12:50:22Z", "expires": "2028-10-21T12:50:22Z", "updated": "2026-10-22T08:33:29Z", "first_seen": "2026-10-22T11:43:00Z", "dns": [ { "ttl": 3600, "type": "SOA", "rname": "hostmaster.nsone.net", "value": "ns1.vercel-dns.com" }, { "ttl": 21600, "type": "NS", "value": "ns1.vercel-dns.com" }, { "ttl": 60, "type": "CAA", "value": "sectigo.com" }, { "ttl": 1800, "type": "A", "value": "216.198.79.65" }, { "ttl": 1800, "type": "A", "value": "64.29.17.1" }, { "ttl": 21600, "type": "NS", "value": "ns2.vercel-dns.com" }, { "ttl": 60, "type": "CAA", "value": "pki.goog" }, { "ttl": 60, "type": "CAA", "value": "letsencrypt.org" } ], "dns_at": "2026-10-25T21:59:08Z", "jarm": "3fd3fd00000000000043d43d00043dc3b2afa8a5ec09b510a8559aff7899fb", "cert": { "san": [ "*.getvcc.net", "getvcc.net" ], "issuer": "Let's Encrypt / YR2", "serial": "6df2549f7dd8d566eb7f1ad9333dc307b5b", "sha256": "35be4a47c9b4982b79dc4c1c3a5e1b2f9ea469e045de5ca99ebb049e8e1875d4", "subject": "*.getvcc.net", "valid_to": "2027-01-20T10:29:38Z", "valid_from": "2026-10-22T10:29:39Z" }, "whois": { "registrar": "NICENIC INTERNATIONAL GROUP CO., LIMITED", "registrar_iana_id": "3765", "registrar_url": "https://nicenic.com", "created": "2026-10-21T12:50:22Z", "updated": "2026-10-21T12:50:22Z", "expires": "2028-10-21T12:50:22Z", "status": [ "clientDeleteProhibited", "clientTransferProhibited" ], "nameservers": [ "ns1.vercel-dns.com", "ns2.vercel-dns.com" ], "dnssec": "unsigned" }, "rdap": { "status": [ "client delete prohibited", "client transfer prohibited" ], "events": { "expiration": "2028-10-21T12:50:22Z", "registration": "2026-10-21T12:50:22Z", "registrar expiration": "2028-10-21T12:50:22Z", "last update of RDAP database": "2026-10-21T12:50:22Z" } } }, "webcheck": { "v": 1, "fetched_at": "2026-10-25T22:04:15Z", "mail_config": { "spf_lookups": 0 }, "caa_records": { "count": 3, "domain": "getvcc.net", "issuers": [ "pki.goog", "sectigo.com", "letsencrypt.org" ] }, "block_lists": { "resolvers": 12, "blocked_count": 0 }, "archives": { "last": "2026-10-25T21:32:28Z", "first": "2013-07-15T03:43:24Z", "changes": 47, "days_archived": 64, "scans_per_day": 0.01, "avg_page_bytes": 6000 }, "robots_txt": { "present": true, "llms_txt": true, "sitemaps": [ "https://www.getvcc.net/sitemap.xml" ] }, "sitemap": { "present": true, "url_count": 28 }, "social_tags": { "ogUrl": "https://www.getvcc.net", "title": "GetVCC — Virtual cards for media buyers", "author": "GetVCC", "ogType": "website", "ogImage": "https://www.getvcc.net/opengraph-image", "ogTitle": "GetVCC — Virtual cards for media buyers", "ogSiteName": "GetVCC", "themeColor": "#15191d", "description": "Issue virtual cards in seconds, fund them from crypto or fiat, and keep every ad campaign under control from one calm dashboard.", "twitterCard": "summary_large_image", "canonicalUrl": "https://www.getvcc.net", "ogDescription": "Issue virtual cards in seconds, fund them from crypto or fiat, and keep every ad campaign under control from one calm dashboard." }, "trackers": { "requests": 17 }, "mixed_content": { "upgrade_insecure": true, "third_party_scripts": 0 }, "status": { "up": true, "code": 308, "timings": { "dns": 6, "tls": 35, "wait": 14, "connect": 105, "download": 0 }, "response_ms": 160 }, "tls_connection": { "alpn": "h2", "cipher": "TLS_AES_128_GCM_SHA256", "protocol": "TLSv1.3", "versions": [ "TLSv1.2", "TLSv1.3" ], "authorized": true, "forward_secrecy": true }, "ports": { "open": [ 80, 443 ] }, "carbon": { "bytes": 192723, "co2_grams": 0.007, "cleaner_than": 8 }, "dns_server": { "ns": [ { "ip": "198.51.44.13", "host": "ns1.vercel-dns.com" }, { "ip": "198.51.45.13", "host": "ns2.vercel-dns.com" } ], "zone": "getvcc.net" }, "location": { "ip": "64.29.17.1", "asn": "16509", "org": "Amazon.com, Inc.", "city": "Walnut", "country": "US" }, "ssl": { "issuer": "Let's Encrypt / YR2", "subject": "*.getvcc.net" }, "dns": { "A": [ "64.29.17.1", "216.198.79.65" ], "NS": [ "ns2.vercel-dns.com", "ns1.vercel-dns.com" ], "SOA": "{\"nsname\": \"ns1.vercel-dns.com\", \"hostmaster\": \"hostmaster.nsone.net\", \"serial\": 1792657956, \"refresh\": 43200, \"retry\": 7200, \"expire\": 1209600, \"minttl\": 600}" }, "dnssec": { "ds": false, "rrsig": false, "dnskey": false }, "hsts": { "header": "max-age=63072000", "message": "HSTS header does not include all subdomains." }, "http_security": { "xFrameOptions": "DENY", "referrerPolicy": "strict-origin-when-cross-origin", "xXSSProtection": false, "permissionsPolicy": "camera=(), microphone=(), geolocation=(), payment=(), usb=(), interest-cohort=()", "xContentTypeOptions": "nosniff", "contentSecurityPolicy": "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob: http", "strictTransportPolicy": "max-age=63072000; includeSubDomains; preload", "crossOriginOpenerPolicy": "same-origin", "crossOriginEmbedderPolicy": false, "crossOriginResourcePolicy": false }, "get_ip": { "ip": "64.29.17.1", "family": 4 }, "redirects": { "chain": [ "https://getvcc.net", "https://www.getvcc.net/" ], "count": 1 }, "linked_pages": { "internal_count": 30 }, "whois": { "registrar": "NICENIC INTERNATIONAL GROUP CO., LIMITED", "created": "2026-10-21T12:50:22Z", "updated": "2026-10-22T08:33:29Z", "expires": "2028-10-21T12:50:22Z", "status": [ "clientDeleteProhibited https://icann.org/epp", "clientTransferProhibited https://icann.org/epp" ], "nameservers": [ "ns1.vercel-dns.com", "ns2.vercel-dns.com" ] }, "headers": { "headers": { "server": "Vercel", "content-type": "text/html; charset=utf-8", "strict-transport-security": "max-age=63072000; includeSubDomains; preload", "content-security-policy": "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob: https://lehexrjlzgdwijbddfju.supabase.co; font-src 'self' data:; connect-src 'self' https://lehexrjlzgdwijbddfju.supabase.co wss://lehexrjlzgdwijbddfju.supabase.co; frame-ancestors 'no", "x-frame-options": "DENY", "x-content-type-options": "nosniff", "referrer-policy": "strict-origin-when-cross-origin", "permissions-policy": "camera=(), microphone=(), geolocation=(), payment=(), usb=(), interest-cohort=()", "cross-origin-opener-policy": "same-origin" } } } } ```