# PhishDestroy domain threat record: greencardviet.com

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/greencardviet.com/
Machine-readable companion: https://phishdestroy.io/domain/greencardviet.com/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-10-28 00:45:28 UTC
- Last availability or vendor check: 2026-10-28 01:01:17 UTC
- Stored record updated: 2026-10-28 01:01:17 UTC
- VirusTotal detections in the stored snapshot: 17/92
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored infrastructure

- Observed IP address: 85.159.66.62
- Registrar in stored WHOIS data: Nics Telekomunikasyon A.S.
- Registration date in stored WHOIS data: 2025-10-02 18:00:06 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a18004-ae6e-72cb-94ba-512bb81ebbdd/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/greencardviet.com
- Certificate Transparency search: https://crt.sh/?q=%25.greencardviet.com
- Web Archive lookup: https://web.archive.org/web/*/https://greencardviet.com/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored page captures

- Primary capture: https://urlscan.io/screenshots/01a18004-ae6e-72cb-94ba-512bb81ebbdd.png
  Captured: 2026-10-28 01:01:17 UTC
- URLScan capture 1: https://urlscan.io/screenshots/019fc5c0-5b49-74f9-aac9-238777f1158e.png
  Captured: 2026-10-28 00:45:28 UTC
  Source report: https://urlscan.io/result/01a18004-ae6e-72cb-94ba-512bb81ebbdd/
- URLScan · 2026-04-23: https://screenshots.phishdestroy.io/us/019dba28-bf5e-73b1-acc9-1bd0c658910c.png
  Captured: 2026-04-23 11:45:32 UTC
  Source report: https://urlscan.io/result/019dba28-bf5e-73b1-acc9-1bd0c658910c/
  SHA-256: 4a4697f6bf8e04eb88f48727552946ca2b9bcdefa0f2c9f52a4823fcfc85fe32
- URLScan · 2026-04-24: https://screenshots.phishdestroy.io/us/019dbe5b-f407-719b-bfbc-1f49da52a43f.png
  Captured: 2026-04-24 07:19:57 UTC
  Source report: https://urlscan.io/result/019dbe5b-f407-719b-bfbc-1f49da52a43f/
  SHA-256: 4a4697f6bf8e04eb88f48727552946ca2b9bcdefa0f2c9f52a4823fcfc85fe32
- URLScan · 2026-10-28: https://screenshots.phishdestroy.io/us/01a17ff9-63d2-72ec-a525-04bdc135f54b.png
  Captured: 2026-10-28 00:47:02 UTC
  Source report: https://urlscan.io/result/01a17ff9-63d2-72ec-a525-04bdc135f54b/
  SHA-256: a0b1088bc9e9fbce87a5a2cb966727bbafe04918b54909f28e68d47c70c5756d
- URLScan · 2026-10-28: https://screenshots.phishdestroy.io/us/01a17fff-8bdb-7279-a74e-2dca0ee6f194.png
  Captured: 2026-10-28 00:53:45 UTC
  Source report: https://urlscan.io/result/01a17fff-8bdb-7279-a74e-2dca0ee6f194/
  SHA-256: a0b1088bc9e9fbce87a5a2cb966727bbafe04918b54909f28e68d47c70c5756d

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-28T00:55:41Z",
        "uuid": "ff79742b-7a96-4ef6-936d-c14dea869f5d",
        "scanned_at": "2026-10-28T00:47:16Z"
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-28T00:46:23Z",
        "analysis_at": "2026-10-19T23:51:28Z",
        "stats": {
            "timeout": 0,
            "harmless": 43,
            "malicious": 14,
            "suspicious": 3,
            "undetected": 32
        },
        "detections": {
            "DNS8": "suspicious",
            "ESET": "suspicious",
            "VIPRE": "phishing",
            "G-Data": "phishing",
            "Lionic": "phishing",
            "Sophos": "phishing",
            "CyRadar": "phishing",
            "Webroot": "malicious",
            "Fortinet": "phishing",
            "SOCRadar": "phishing",
            "Kaspersky": "phishing",
            "Seclookup": "malicious",
            "Gridinsoft": "suspicious",
            "BitDefender": "phishing",
            "Chong Lua Dao": "malicious",
            "alphaMountain.ai": "phishing",
            "Forcepoint ThreatSeeker": "phishing"
        },
        "reputation": 0,
        "categories": {
            "alphaMountain.ai": "Phishing (alphaMountain.ai)"
        },
        "created": "2025-10-02T00:00:00Z",
        "updated": "2025-10-02T00:00:00Z",
        "first_seen": "2025-10-04T16:04:52Z",
        "dns": [
            {
                "ttl": 21600,
                "type": "A",
                "value": "85.159.66.62"
            }
        ],
        "dns_at": "2026-10-19T23:57:25Z",
        "jarm": "2ad2ad0002ad2ad00042d42d0000005d86ccb1a0567e012264097a0315d7a7",
        "cert": {
            "san": [
                "greencardviet.com"
            ],
            "issuer": "Let's Encrypt / R13",
            "serial": "55ec19508fe55c201c3db2b02ffc900e2f5",
            "sha256": "ab067bebdcf5252412c1d57e51902c86486be6173a5578ba74769abccfc89c7d",
            "subject": "greencardviet.com",
            "valid_to": "2026-07-22T07:36:51Z",
            "valid_from": "2026-04-23T07:36:52Z"
        },
        "whois": [],
        "rdap": {
            "status": [
                "active",
                "auto renew period"
            ],
            "events": {
                "last changed": "2026-10-02T22:13:18Z",
                "registration": "2025-10-02T20:00:06Z",
                "registrar expiration": "2027-10-02T20:00:06Z",
                "last update of RDAP database": "2026-10-14T22:27:24Z"
            },
            "registrar": "NICS Telekomunikasyon A.S.",
            "registrar_iana_id": "1454"
        }
    },
    "webcheck": {
        "v": 1,
        "fetched_at": "2026-10-28T00:49:04Z",
        "mail_config": {
            "spf_lookups": 0
        },
        "caa_records": {
            "domain": "greencardviet.com"
        },
        "block_lists": {
            "resolvers": 12,
            "blocked_count": 0
        },
        "ports": {
            "open": [
                22,
                53,
                80,
                443
            ]
        },
        "location": {
            "ip": "85.159.66.62",
            "asn": "34619",
            "org": "Cizgi Telekomunikasyon Anonim Sirketi",
            "city": "Beyoğlu",
            "country": "TR"
        },
        "dns": {
            "A": [
                "85.159.66.62"
            ]
        },
        "dnssec": {
            "ds": false,
            "rrsig": false,
            "dnskey": false
        },
        "get_ip": {
            "ip": "85.159.66.62",
            "family": 4
        },
        "whois": {
            "registrar": "Nics Telekomunikasyon A.S.",
            "created": "2025-10-02T20:00:06Z",
            "updated": "2026-10-03T08:42:38Z",
            "expires": "2027-10-02T20:00:06Z",
            "status": [
                "ok https://icann.org/epp"
            ],
            "nameservers": [
                "ex1.natrohost.com",
                "ex2.natrohost.com"
            ]
        }
    }
}
```