phishdestroy/nicenic-evidence: nICENIC Zone Scan — Complete Registrar Investigation

🔴 LIVE INVESTIGATION FEED · Auto-updated · Last fetch 2026-06-29

🏷️ Top TLD Zones

🌍 Top Hosting Countries

US  ██████████████████     12,940 (35.2%)
RU  ████░░░░░░░░░░░░░░      3,096 (8.4%)
CA  ███░░░░░░░░░░░░░░░      2,811 (7.7%)
NL  ███░░░░░░░░░░░░░░░      2,663 (7.2%)
DE  ███░░░░░░░░░░░░░░░      2,240 (6.1%)
GB  ██░░░░░░░░░░░░░░░░      2,079 (5.7%)
BG  ██░░░░░░░░░░░░░░░░      1,789 (4.9%)
UA  █░░░░░░░░░░░░░░░░░        871 (2.4%)

📈 Registration Burst Days

🎯 Top Targeted Brands & Keywords

coinbase (3,806) · claim (3,481) · login (2,225) · secure (1,691) · token (1,568) · wallet (1,501) · swap (1,364) · ledger (1,324) · support (1,264) · official (1,249) · kraken (1,208) · update (1,156) · crypto (1,143) · connect (1,113) · trust (859)

🕵️ Top Serial Registrants — 50 emails with ≥5 domains

📥 Download Threat Intelligence

📊 Live web dashboard: see Pages link at top · Updated daily 02:00 UTC

📑 Table of Contents

Background

NICENIC INTERNATIONAL GROUP CO., LIMITED (IANA registrar #3765) is a Chinese domain registrar with a long-documented track record of slow abuse response, permissive registration policies, and infrastructure that is systematically exploited by phishing operators, carding shops, crypto drainers, illegal gambling networks, and malware distributors.

While NICENIC holds significantly more domains than the average registrar under investigation, the scale is itself the signal: fast, cheap, anonymous registration at volume is the product. The registrar's zone composition reflects a portfolio optimised for abuse enablement rather than legitimate hosting.

This investigation enumerates every domain in NICENIC's zone, classifies content using AI-assisted analysis and threat-intelligence cross-referencing, and publishes structured evidence for enforcement, blocklist, and SIEM use.

Pipeline:

[NICENIC Zone File — 343,107 domains]
         │
         ▼
┌─────────────────┐   aiohttp, 600 concurrent, Googlebot UA
│ Phase 1 — HTTP  │   Output: lambda_results.jsonl
│ Fingerprint     │
└─────────────────┘
         │
         ▼
┌─────────────────┐   Playwright + stealth v2, isolated context/domain
│ Phase 2 — Render│   SOCKS5 pool + 2captcha (hCaptcha/Turnstile/reCAPTCHA)
│ + Screenshots   │   Output: deep_results.jsonl, screenshots/*.jpg
└─────────────────┘
         │
         ▼
┌─────────────────┐   Llama 3.1 (Groq) for content classification
│ Phase 3 — AI    │   Rule-based pre-filter + Groq for ambiguous cases
│ Classification  │   Output: enriched.csv categories + descriptions
└─────────────────┘
         │
         ▼
┌─────────────────┐   ipinfo.io (country + ASN per IP)
│ Phase 4 — GeoIP │   Output: ip_country, ip_asn fields
└─────────────────┘
         │
         ▼
┌─────────────────┐   Redaction: scan-server IP, API keys, local paths
│ Phase 5 — PII   │   Output: clean enriched.csv, data.json, IOC feeds
│ Redaction       │
└─────────────────┘

Subject

Scope

This investigation covers the complete zone of all domains registered under NICENIC (IANA #3765) as enumerated from public zone data in June 2026. Every domain — alive or dead — is included.

Note: Screenshots and deep-render data were collected only for HIGH and MEDIUM severity domains (estimated 10–25% of zone) to constrain storage and runtime. Dead domains are enumerated and classified but not rendered.

Methodology

Headline Findings

Operator Clusters

2,939 operator clusters identified via favicon MurmurHash3 + server fingerprint combination. Clusters of 3+ domains sharing identical infrastructure are surfaced as likely operator groups.

Notable clusters:

Full cluster data: data/clusters.json — includes favicon hash, server fingerprint, domain list, and category distribution per cluster.

Evidence Archive

IOC Feed

# HIGH severity domains (blocklist)
https://raw.githubusercontent.com/phishdestroy/nicenic-evidence/main/ioc/domains_high.txt

# HIGH + MEDIUM domains
https://raw.githubusercontent.com/phishdestroy/nicenic-evidence/main/ioc/domains_all_malicious.txt

# SIEM indicators (CSV)
https://raw.githubusercontent.com/phishdestroy/nicenic-evidence/main/ioc/indicators.csv

Enforcement Posture

NICENIC operates under Chinese jurisdiction. Effective enforcement requires multi-channel pressure:

ICANN's Registrar Accreditation Agreement §3.18 requires registrars to maintain and respond to abuse contacts within 24 hours. Documented non-response is grounds for accreditation suspension.

⚖️ Legal Notice & Responsible Disclosure

All data in this repository was collected exclusively from publicly accessible sources:

No non-public systems were accessed. No credentials were tested. No authentication was bypassed. No victim data was processed.

This publication is conducted under:

• ICANN Registrar Accreditation Agreement §3.18 (abuse response obligations)
• CISA Coordinated Vulnerability Disclosure guidelines
• FIRST.org TLP:CLEAR definition — unlimited public sharing permitted

Regarding Reputational Impact

This research documents objectively verifiable facts: domain registration patterns, HTTP response content, and registrar abuse-response latency. These facts were publicly visible before this repository existed.

NICENIC INTERNATIONAL GROUP CO., LIMITED is an ICANN-accredited registrar operating under contractual obligations to the global internet community. Registrars that facilitate industrial-scale phishing infrastructure have no legitimate reputational interest in suppressing evidence of that facilitation. Publication of factual evidence of contractual non-compliance is not defamation — it is the function ICANN's transparency requirements were built to serve.

If NICENIC disputes any finding: submit documented evidence via phishdestroy.io. Findings supported by evidence will be corrected in a timestamped update.

Repository Structure

nicenic-evidence/
├── scan/
│   ├── phase1_http.py          # aiohttp mass scanner
│   ├── phase2_screenshots.py   # Playwright browser scan
│   ├── classify.py             # Groq AI classification
│   ├── fast_classify.py        # Rule-based pre-filter pass
│   ├── geoip_enrich.py         # ipinfo.io enrichment
│   ├── build_clusters.py       # Favicon+fingerprint cluster analysis
│   ├── build_ioc.py            # IOC feed generation
│   ├── build_domains_html.py   # Regenerate domains.html
│   ├── threat_intel.py         # TI cross-reference
│   ├── redact_creds.py         # PII/credential redaction
│   ├── finalize.py             # Final pipeline step
│   ├── compress_screenshots.py # PNG→JPEG compression
│   ├── merge_zone.py           # Zone data merge
│   ├── lambda_handler.py       # AWS Lambda variant
│   └── invoke_all.py           # Lambda orchestrator
├── docs/
│   ├── index.html              # Investigation landing page (GitHub Pages)
│   ├── domains.html            # Searchable domain table (76,117 domains)
│   ├── data.json               # Slim per-domain dataset
│   ├── build_datajson.py       # Regenerate data.json from enriched.csv
│   └── assets/                 # Hero image, OG card, favicons
├── data/
│   ├── enriched.csv            # Canonical enriched dataset (86,114 rows)
│   ├── high_severity.csv       # CRITICAL+HIGH subset (20,480 rows)
│   ├── dead_domains.csv        # Dead / parked enumeration
│   └── clusters.json           # Operator cluster map (2,939 clusters)
├── ioc/
│   ├── domains_high.txt        # CRITICAL+HIGH blocklist (18,305 domains)
│   ├── domains_all_malicious.txt # CRITICAL+HIGH+MEDIUM (18,927 domains)
│   └── indicators.csv          # SIEM-ready IOC feed (18,927 indicators)
├── pkg/
│   └── raw_data/               # Compressed raw scan output (.gz)
├── SHA256SUMS.txt              # Checksums of all published data files
├── PROVENANCE.md               # Chain-of-custody documentation
└── README.md                   # This file

🕸️ Network of Complicit Registrars

This investigation is part of a series documenting ICANN-accredited registrars that systematically obstruct anti-phishing enforcement or directly profit from fraud infrastructure. All three registrars share a documented pattern: direct requests backed by evidence are ignored, delayed, or met with active suppression.

🇷🇺 Russian Connection & Complicity Record

Russian Presence — CEO OSINT

Helen Ho, the CEO of NiceNIC, is directly associated with the email [email protected], which appears registered across multiple Russian-language platforms. She maintains an active VKontakte (VK) account under the handle:

nicenic_global — vk.com

VK is a Russian social network with no meaningful presence in China. For a CEO of a Chinese registrar to maintain an active VK account — and to be highly active on it — is strategically significant. Analysis of her follower network on VK reveals entities engaged in scam activity while using NiceNIC domain services.

Helen Ho's VK account is subscribed to the community «Типичный мошенник» ("Typical Scammer") — a Russian-language VK page dedicated to scam tutorials, fraud toolkits, and cybercriminal community content.

The CEO of an ICANN-accredited registrar, subscribed to a scammer community on a Russian social network, with followers who are active fraud operators using her registrar's services — is not an ambiguous data point. It is a documented conflict of interest at the executive level.

Additional key facts:

• Russia is the #2 hosting country in NICENIC's zone: 3,113 deployed domains (8.5%)
• NiceNIC is the preferred registrar of Russian-speaking fraud affiliate networks — documented in leaked Telegram screenshots where network instructors explicitly recommend NiceNIC to affiliates
• The "Soulless" scam network registered 1,200+ identical phishing sites via NiceNIC
• NICENIC accepts Bitcoin, Tether, Ethereum, Litecoin — specifically to sever financial audit trails and enable anonymous registration

“We Are Not Against Scamming”

On January 10, 2026, a post appeared from a NiceNIC-attributed account stating:

“We are not against scamming… we here to make cash.”

NiceNIC subsequently claimed the account was “hacked” by a user named “Juliani” to maintain ICANN deniability. The statement is consistent with the operational record regardless of its attribution.

Documented Obstruction

• RAA §3.18 requires 24-hour acknowledgement of abuse reports. NICENIC’s effective response is measured in weeks or is absent entirely.
• NICENIC’s abuse system forwards complaints directly to the registrants (the criminals) rather than investigating independently — and accepts registrant denials at face value to close tickets.
• Auto-responder templates claim “insufficient evidence” even when full forensic packages are submitted: screenshots, AI classification, WHOIS, live HTTP proof, financial transaction hashes.
• Trust Wallet heist (December 2025): $8.5M stolen — infrastructure hosted on NiceNIC. Domains remained live post-report.
• Scattered Spider lookalike domains for ransomware supply-chain attacks registered via NiceNIC.
• NICENIC’s phishing domain score: 1,141.74 — 326× higher than the industry average of ~3.5.
• No public abuse transparency report published by NICENIC for any reporting period.
• ICANN Contractual Compliance complaint filed. NiceNIC’s continued accreditation depends on a process measured in months during which thousands of fraud domains remain live.
• Direct requests with documented evidence: systematically ignored.

External Coverage

“NICENIC’s abuse response SLA is effectively infinite. This investigation makes it finite.”

Related Investigations