phishdestroy/nicenic-evidence

<div align="center"> <img src="https://raw.githubusercontent.com/phishdestroy/nicenic-evidence/main/docs/assets/banner.gif" width="100%"/> </div>

<div align="center">

<br>

 

 

<br/>

NICENIC Zone Scan — Complete Registrar Investigation

Phase I · NICENIC INTERNATIONAL GROUP CO., LIMITED · IANA #3765

Complete-zone scan of a Chinese registrar enabling industrial-scale domain abuse

</div>

--- ---

⚖️ ICANN Compliance Complaints

Formal abuse complaints submitted to ICANN Contractual Compliance (RAA §3.18 · DNS Abuse Advisory 2024).

| Date | Target | IANA ID | Reported Domains | Active Today | Days Ignored | |---|---|---|---|---|---| | 2026-08-05 | NiceNIC International Group Co., Limited | 3765 | 13,104 | 4,430 | 158 median / 215 max |

📁 Full evidence: `complaints/`

<!-- LIVE_STATS:START -->

🔴 LIVE INVESTIGATION FEED &middot; Auto-updated &middot; Last fetch 2026-10-26

<table><tr> <td align="center"><b>📦 Domains tracked</b><br/>_{<code>434,830</code>}</td> <td align="center"><b>💰 Est. annual value</b><br/>_{<code>$3,177,595</code>}</td> <td align="center"><b>📡 Deployed</b><br/>_{<code>32.9%</code>}</td> <td align="center"><b>✅ IOC classified</b><br/>_{<code>71,028</code> (65,600 HIGH)}</td> <td align="center"><b>⚡ Registered ≤7d</b><br/>_{<code>1.0%</code>}</td> <td align="center"><b>🕵️ Serial regs</b><br/>_{<code>27</code>}</td> </tr></table>

🏷️ Top TLD Zones

| TLD | Count | Avg reg→expiry | Est. annual value | |:--|--:|--:|--:| | .com | 215,142 | 625d | $1,934,127 | | .icu | 41,425 | 379d | $41,011 | | .vip | 30,843 | 375d | $153,907 | | .xyz | 18,667 | 448d | $27,814 | | .net | 17,280 | 736d | $172,627 | | .info | 14,379 | 497d | $57,372 | | .live | 13,920 | 420d | $139,061 | | .sbs | 11,600 | 403d | $57,884 | | .cfd | 10,669 | 444d | $53,238 | | .pro | 8,719 | 401d | $69,665 |

🌍 Top Hosting Countries

US  ██████████████████      6,237 (28.4%)
NL  ████████░░░░░░░░░░      2,937 (13.4%)
DE  ██████░░░░░░░░░░░░      2,154 (9.8%)
TR  ███░░░░░░░░░░░░░░░      1,364 (6.2%)
CN  ███░░░░░░░░░░░░░░░      1,121 (5.1%)
SE  ██░░░░░░░░░░░░░░░░      1,003 (4.6%)
RU  ██░░░░░░░░░░░░░░░░        974 (4.4%)
HK  ██░░░░░░░░░░░░░░░░        792 (3.6%)

📈 Registration Burst Days

| Date | Domains | × Average | |:--|--:|--:| | 2026-10-07 | 1,839 | 23.0× 🚨 | | 2026-09-16 | 1,808 | 22.6× 🚨 | | 2026-10-12 | 1,735 | 21.7× 🚨 | | 2026-10-08 | 1,585 | 19.8× 🚨 | | 2026-09-17 | 1,565 | 19.6× 🚨 |

🎯 Top Targeted Brands & Keywords

coinbase (3,026) &middot; claim (2,820) &middot; login (2,207) &middot; official (1,830) &middot; wallet (1,723) &middot; secure (1,628) &middot; swap (1,459) &middot; token (1,425) &middot; ledger (1,385) &middot; support (1,332) &middot; crypto (1,276) &middot; connect (1,187) &middot; update (1,178) &middot; kraken (1,178) &middot; trust (1,159)

🕵️ Top Serial Registrants — 50 emails with ≥5 domains

| # | Registrant Email (redacted) | Domains | |--:|:--|--:| | 1 | don***@opencart.com | 42 | | 2 | sup***@anonymixer.com | 40 | | 3 | des***@slotvadi.com | 28 | | 4 | aff***@slotvadi.com | 28 | | 5 | inf***@slotvadi.com | 28 | | 6 | inf***@wbahis.com | 24 | | 7 | com***@wbahis.com | 24 | | 8 | dei***@email.de | 22 | | 9 | sup***@winshark.com | 22 | | 10 | orn***@mail.com | 17 |

📥 Download Threat Intelligence

| File | Format | Description | |:--|:--:|:--| | `data/all.txt` | TXT | All tracked domains | | `data/index.json` | JSON | Full analytics snapshot | | `data/ioc/serial_registrants.json` | JSON | Repeat registrants + their domains | | `data/ioc/shared_ips.json` | JSON | Shared hosting clusters | | `data/ioc/brand_domains.json` | JSON | Domains by targeted brand | | `data/ioc/stix-bundle.json` | STIX 2.1 | MISP/OpenCTI bundle (HIGH IOC domains, up to 10k) | | `data/ioc/serial_emails.txt` | TXT | grep-friendly: email⇥count | | `data/ioc/shared_ips.txt` | TXT | grep-friendly: ip⇥count⇥country |

📊 Live web dashboard: see Pages link at top · Updated daily 02:00 UTC

<!-- LIVE_STATS:END -->

---

<img src="https://user-images.githubusercontent.com/74038190/212284100-561aa473-3905-4a80-b561-0d28506553ee.gif" width="100%">

📑 Table of Contents

<table> <tr> <td valign="top">

Investigation

• Background
• Subject
• Scope
• Methodology

</td> <td valign="top">

Evidence

• Headline Findings
• Operator Clusters
• Evidence Archive
• IOC Feed

</td> <td valign="top">

Legal / Reuse

• Legal Notice
• Enforcement Posture
• Repository Structure
• Related Investigations

</td> </tr> </table>

<img src="https://user-images.githubusercontent.com/74038190/212284100-561aa473-3905-4a80-b561-0d28506553ee.gif" width="100%">

Background

NICENIC INTERNATIONAL GROUP CO., LIMITED (IANA registrar #3765) is a Chinese domain registrar with a long-documented track record of slow abuse response, permissive registration policies, and infrastructure that is systematically exploited by phishing operators, carding shops, crypto drainers, illegal gambling networks, and malware distributors.

While NICENIC holds significantly more domains than the average registrar under investigation, the scale is itself the signal: fast, cheap, anonymous registration at volume is the product. The registrar's zone composition reflects a portfolio optimised for abuse enablement rather than legitimate hosting.

This investigation enumerates every domain in NICENIC's zone, classifies content using AI-assisted analysis and threat-intelligence cross-referencing, and publishes structured evidence for enforcement, blocklist, and SIEM use.

Pipeline:

[NICENIC Zone File — 403,909 domains]
         │
         ▼
┌─────────────────┐   aiohttp, 600 concurrent, Googlebot UA
│ Phase 1 — HTTP  │   Output: lambda_results.jsonl
│ Fingerprint     │
└─────────────────┘
         │
         ▼
┌─────────────────┐   Playwright + stealth v2, isolated context/domain
│ Phase 2 — Render│   SOCKS5 pool + 2captcha (hCaptcha/Turnstile/reCAPTCHA)
│ + Screenshots   │   Output: deep_results.jsonl, screenshots/*.jpg
└─────────────────┘
         │
         ▼
┌─────────────────┐   Llama 3.1 (Groq) for content classification
│ Phase 3 — AI    │   Rule-based pre-filter + Groq for ambiguous cases
│ Classification  │   Output: enriched.csv categories + descriptions
└─────────────────┘
         │
         ▼
┌─────────────────┐   ipinfo.io (country + ASN per IP)
│ Phase 4 — GeoIP │   Output: ip_country, ip_asn fields
└─────────────────┘
         │
         ▼
┌─────────────────┐   Redaction: scan-server IP, API keys, local paths
│ Phase 5 — PII   │   Output: clean enriched.csv, data.json, IOC feeds
│ Redaction       │
└─────────────────┘

<img src="https://user-images.githubusercontent.com/74038190/212284100-561aa473-3905-4a80-b561-0d28506553ee.gif" width="100%">

Subject

| Field | Value | |---|---| | Registrar name | NICENIC INTERNATIONAL GROUP CO., LIMITED | | IANA ID | #3765 | | Jurisdiction | China | | WHOIS server | whois.nicenic.net | | Abuse contact | abuse@nicenic.net | | Zone size | 403,909 domains (scan date: June 2026) | | Supported TLDs | Generic TLDs (gTLD) — .com, .net, .org, .xyz, .top, .shop, .app, .academy, and 100+ more | | ICANN accreditation | Active |

<img src="https://user-images.githubusercontent.com/74038190/212284100-561aa473-3905-4a80-b561-0d28506553ee.gif" width="100%">

Scope

This investigation covers the complete zone of all domains registered under NICENIC (IANA #3765) as enumerated from public zone data in June 2026. Every domain — alive or dead — is included.

Note: Screenshots and deep-render data were collected only for HIGH and MEDIUM severity domains (estimated 10–25% of zone) to constrain storage and runtime. Dead domains are enumerated and classified but not rendered.

<img src="https://user-images.githubusercontent.com/74038190/212284100-561aa473-3905-4a80-b561-0d28506553ee.gif" width="100%">

Methodology

<details> <summary><strong>Phase 1 — HTTP Fingerprinting</strong></summary>

• Tool: Python 3.14 + aiohttp, 600 concurrent connections
• User-Agent: Googlebot 2.1 (bypass naive bot-blocks)
• Timeout: 5s connect, 8s read
• Extracted: HTTP status, final URL, server headers, title, H1, meta description, form fields, body snippet (first 64 KB)
• Cloudflare detection: cf-ray / __cf_bm presence in headers + body
• Captcha detection: hCaptcha / reCAPTCHA / Turnstile keyword matching
• Output: data/lambda_results.jsonl — one JSON object per domain

</details>

<details> <summary><strong>Phase 2 — Browser Render & Screenshots</strong></summary>

• Engine: Playwright 1.40 + headless Chromium
• Stealth: playwright-stealth v2
• Viewport: 1280 × 800
• Settle delay: 2.5 s post-domcontentloaded; +5 s on Cloudflare JS challenge
• Captcha solving: 2captcha — hCaptcha, reCAPTCHA v2/v3, Cloudflare Turnstile
• Proxy pool: 2,600+ SOCKS5 exits, round-robin per domain
• Output: docs/screenshots/<domain>.jpg (JPEG 80%, max 1280 px wide)

</details>

<details> <summary><strong>Phase 3 — AI Classification</strong></summary>

• Model: Llama 3.1 8B Instant (Groq API)
• Batch size: 20 domains per Groq call
• Categories: PHISHING_FINANCE, PHISHING_BRAND, CARDING, CRYPTO_DRAINER, CRYPTO_EXCHANGE, GAMBLING, ADULT, MALWARE, SPAM_PHARMA, SPAM_SEO, PARKING, DEAD, LEGITIMATE, UNKNOWN
• Severity map: CRITICAL (4) — phishing/carding/malware; HIGH (3) — crypto/gambling; MEDIUM (2) — adult/spam-seo; LOW (1) — unknown; INFO (0) — parking/dead/legitimate
• Pre-filter: Rule-based keyword matching assigns naive category before Groq; Groq refines uncertain cases

</details>

<details> <summary><strong>Phase 4 — GeoIP Enrichment</strong></summary>

• Provider: ipinfo.io API
• Fields added: ip_country, ip_asn
• Coverage: All live domains with resolved IPs

</details>

<img src="https://user-images.githubusercontent.com/74038190/212284100-561aa473-3905-4a80-b561-0d28506553ee.gif" width="100%">

Headline Findings

June 2026 scan. The HTTP pass covered the 343,107 domains in the zone at scan time; severity scoring covers live HTTP content (37,844 alive); the 82,575 malicious total adds threat-feed-confirmed domains and is measured against the 187,697 domains counted alive in the zone-level liveness pass (196,494 dead / timeout).

| Metric | Value | |---|---| | Total domains in zone | 403,909 | | HTTP-scanned (zone at scan time) | 343,107 | | Alive (HTTP 200/3xx) | 37,844 (11% of HTTP-scanned) | | Dead / Parked / Error | 305,263 (8