GitHub RadarBlue team tool

phishdestroy/nicenic-evidence

Complete zone scan of NICENIC INTERNATIONAL GROUP CO., LIMITED (IANA #3765, China) — 376,687 domains tracked. 82,576 classified IOC (35,902 HIGH): phishing, carding, crypto drainers, malware, unlicensed gambling. IOC feeds, SIEM CSV, operator clusters. Evidence package for ICANN RAA complaint Primary language: HTML. 123 stars.

Classification confidence: medium

Inferred from repository metadata; not a reviewed classification.

HTML123 stars7 forkspushed Oct 25, 2026MIT

Project links:Open GitHub project Back to radar

README Preview

Fetched from GitHub

![Registrar](https://www.iana.org/assignments/registrar-ids/registrar-ids.xhtml) ![TLP](https://www.cisa.gov/tlp)

![License](LICENSE) ![Pages](https://phishdestroy.github.io/nicenic-evidence/)

NICENIC Zone Scan — Complete Registrar Investigation

Phase I · NICENIC INTERNATIONAL GROUP CO., LIMITED · IANA #3765

Complete-zone scan of a Chinese registrar enabling industrial-scale domain abuse

</div>

--- ---

⚖️ ICANN Compliance Complaints

Formal abuse complaints submitted to ICANN Contractual Compliance (RAA §3.18 · DNS Abuse Advisory 2024).

| Date | Target | IANA ID | Reported Domains | Active Today | Days Ignored | |---|---|---|---|---|---| | 2026-08-05 | NiceNIC International Group Co., Limited | 3765 | 13,104 | 4,430 | 158 median / 215 max |

📁 Full evidence: `complaints/`

🔴 LIVE INVESTIGATION FEED · Auto-updated · Last fetch 2026-10-26

<table><tr> <td align="center">📦 Domains tracked <code>434,830</code></td> <td align="center">💰 Est. annual value <code>$3,177,595</code></td> <td align="center">📡 Deployed <code>32.9%</code></td> <td align="center">✅ IOC classified <code>71,028</code> (65,600 HIGH)</td> <td align="center">⚡ Registered ≤7d <code>1.0%</code></td> <td align="center">🕵️ Serial regs <code>27</code></td> </tr></table>

🏷️ Top TLD Zones

| TLD | Count | Avg reg→expiry | Est. annual value | |:--|--:|--:|--:| | .com | 215,142 | 625d | $1,934,127 | | .icu | 41,425 | 379d | $41,011 | | .vip | 30,843 | 375d | $153,907 | | .xyz | 18,667 | 448d | $27,814 | | .net | 17,280 | 736d | $172,627 | | .info | 14,379 | 497d | $57,372 | | .live | 13,920 | 420d | $139,061 | | .sbs | 11,600 | 403d | $57,884 | | .cfd | 10,669 | 444d | $53,238 | | .pro | 8,719 | 401d | $69,665 |

🌍 Top Hosting Countries

US  ██████████████████      6,237 (28.4%)
NL  ████████░░░░░░░░░░      2,937 (13.4%)
DE  ██████░░░░░░░░░░░░      2,154 (9.8%)
TR  ███░░░░░░░░░░░░░░░      1,364 (6.2%)
CN  ███░░░░░░░░░░░░░░░      1,121 (5.1%)
SE  ██░░░░░░░░░░░░░░░░      1,003 (4.6%)
RU  ██░░░░░░░░░░░░░░░░        974 (4.4%)
HK  ██░░░░░░░░░░░░░░░░        792 (3.6%)

📈 Registration Burst Days

| Date | Domains | × Average | |:--|--:|--:| | 2026-10-07 | 1,839 | 23.0× 🚨 | | 2026-09-16 | 1,808 | 22.6× 🚨 | | 2026-10-12 | 1,735 | 21.7× 🚨 | | 2026-10-08 | 1,585 | 19.8× 🚨 | | 2026-09-17 | 1,565 | 19.6× 🚨 |

🎯 Top Targeted Brands & Keywords

coinbase (3,026) · claim (2,820) · login (2,207) · official (1,830) · wallet (1,723) · secure (1,628) · swap (1,459) · token (1,425) · ledger (1,385) · support (1,332) · crypto (1,276) · connect (1,187) · update (1,178) · kraken (1,178) · trust (1,159)

🕵️ Top Serial Registrants — 50 emails with ≥5 domains

| # | Registrant Email (redacted) | Domains | |--:|:--|--:| | 1 | don***@opencart.com | 42 | | 2 | sup***@anonymixer.com | 40 | | 3 | des***@slotvadi.com | 28 | | 4 | aff***@slotvadi.com | 28 | | 5 | inf***@slotvadi.com | 28 | | 6 | inf***@wbahis.com | 24 | | 7 | com***@wbahis.com | 24 | | 8 | dei***@email.de | 22 | | 9 | sup***@winshark.com | 22 | | 10 | orn***@mail.com | 17 |

📥 Download Threat Intelligence

📊 Live web dashboard: see Pages link at top · Updated daily 02:00 UTC

---

📑 Table of Contents

Investigation

</td> <td valign="top">

Evidence

</td> <td valign="top">

Legal / Reuse

</td> </tr> </table>

Background

NICENIC INTERNATIONAL GROUP CO., LIMITED (IANA registrar #3765) is a Chinese domain registrar with a long-documented track record of slow abuse response, permissive registration policies, and infrastructure that is systematically exploited by phishing operators, carding shops, crypto drainers, illegal gambling networks, and malware distributors.

While NICENIC holds significantly more domains than the average registrar under investigation, the scale is itself the signal: fast, cheap, anonymous registration at volume is the product. The registrar's zone composition reflects a portfolio optimised for abuse enablement rather than legitimate hosting.

This investigation enumerates every domain in NICENIC's zone, classifies content using AI-assisted analysis and threat-intelligence cross-referencing, and publishes structured evidence for enforcement, blocklist, and SIEM use.

Pipeline:

[NICENIC Zone File — 403,909 domains]
         │
         ▼
┌─────────────────┐   aiohttp, 600 concurrent, Googlebot UA
│ Phase 1 — HTTP  │   Output: lambda_results.jsonl
│ Fingerprint     │
└─────────────────┘
         │
         ▼
┌─────────────────┐   Playwright + stealth v2, isolated context/domain
│ Phase 2 — Render│   SOCKS5 pool + 2captcha (hCaptcha/Turnstile/reCAPTCHA)
│ + Screenshots   │   Output: deep_results.jsonl, screenshots/*.jpg
└─────────────────┘
         │
         ▼
┌─────────────────┐   Llama 3.1 (Groq) for content classification
│ Phase 3 — AI    │   Rule-based pre-filter + Groq for ambiguous cases
│ Classification  │   Output: enriched.csv categories + descriptions
└─────────────────┘
         │
         ▼
┌─────────────────┐   ipinfo.io (country + ASN per IP)
│ Phase 4 — GeoIP │   Output: ip_country, ip_asn fields
└─────────────────┘
         │
         ▼
┌─────────────────┐   Redaction: scan-server IP, API keys, local paths
│ Phase 5 — PII   │   Output: clean enriched.csv, data.json, IOC feeds
│ Redaction       │
└─────────────────┘

Subject

| Field | Value | |---|---| | Registrar name | NICENIC INTERNATIONAL GROUP CO., LIMITED | | IANA ID | #3765 | | Jurisdiction | China | | WHOIS server | whois.nicenic.net | | Abuse contact | abuse@nicenic.net | | Zone size | 403,909 domains (scan date: June 2026) | | Supported TLDs | Generic TLDs (gTLD) — .com, .net, .org, .xyz, .top, .shop, .app, .academy, and 100+ more | | ICANN accreditation | Active |

Scope

This investigation covers the complete zone of all domains registered under NICENIC (IANA #3765) as enumerated from public zone data in June 2026. Every domain — alive or dead — is included.

Note: Screenshots and deep-render data were collected only for HIGH and MEDIUM severity domains (estimated 10–25% of zone) to constrain storage and runtime. Dead domains are enumerated and classified but not rendered.

Methodology

<details> <summary>Phase 1 — HTTP Fingerprinting</summary>

Tool: Python 3.14 + aiohttp, 600 concurrent connections
User-Agent: Googlebot 2.1 (bypass naive bot-blocks)
Timeout: 5s connect, 8s read
Extracted: HTTP status, final URL, server headers, title, H1, meta description, form fields, body snippet (first 64 KB)
Cloudflare detection: cf-ray / __cf_bm presence in headers + body
Captcha detection: hCaptcha / reCAPTCHA / Turnstile keyword matching
Output: data/lambda_results.jsonl — one JSON object per domain

</details>

<details> <summary>Phase 2 — Browser Render & Screenshots</summary>

Engine: Playwright 1.40 + headless Chromium
Stealth: playwright-stealth v2
Viewport: 1280 × 800
Settle delay: 2.5 s post-domcontentloaded; +5 s on Cloudflare JS challenge
Captcha solving: 2captcha — hCaptcha, reCAPTCHA v2/v3, Cloudflare Turnstile
Proxy pool: 2,600+ SOCKS5 exits, round-robin per domain
Output: docs/screenshots/<domain>.jpg (JPEG 80%, max 1280 px wide)

</details>

<details> <summary>Phase 3 — AI Classification</summary>

Model: Llama 3.1 8B Instant (Groq API)
Batch size: 20 domains per Groq call
Categories: PHISHING_FINANCE, PHISHING_BRAND, CARDING, CRYPTO_DRAINER, CRYPTO_EXCHANGE, GAMBLING, ADULT, MALWARE, SPAM_PHARMA, SPAM_SEO, PARKING, DEAD, LEGITIMATE, UNKNOWN
Severity map: CRITICAL (4) — phishing/carding/malware; HIGH (3) — crypto/gambling; MEDIUM (2) — adult/spam-seo; LOW (1) — unknown; INFO (0) — parking/dead/legitimate
Pre-filter: Rule-based keyword matching assigns naive category before Groq; Groq refines uncertain cases

</details>

<details> <summary>Phase 4 — GeoIP Enrichment</summary>

Provider: ipinfo.io API
Fields added: ip_country, ip_asn
Coverage: All live domains with resolved IPs

</details>

Headline Findings

June 2026 scan. The HTTP pass covered the 343,107 domains in the zone at scan time; severity scoring covers live HTTP content (37,844 alive); the 82,575 malicious total adds threat-feed-confirmed domains and is measured against the 187,697 domains counted alive in the zone-level liveness pass (196,494 dead / timeout).

| Metric | Value | |---|---| | Total domains in zone | 403,909 | | HTTP-scanned (zone at scan time) | 343,107 | | Alive (HTTP 200/3xx) | 37,844 (11% of HTTP-scanned) | | Dead / Parked / Error | 305,263 (8