# PhishDestroy domain threat record: nickelmanagement.fr Content language: English Canonical HTML report: https://phishdestroy.io/domain/nickelmanagement.fr/ Machine-readable companion: https://phishdestroy.io/domain/nickelmanagement.fr/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: not observed active - First observed by PhishDestroy: 2026-08-26 09:50:25 UTC - Last availability or vendor check: 2026-10-21 01:13:28 UTC - Stored record updated: 2026-10-22 14:23:33 UTC - VirusTotal detections in the stored snapshot: 13/91 - Independent public blocklist matches in the stored snapshot: 0 - Google Safe Browsing stored result: no stored flag ## Stored infrastructure - Observed IP address: 109.234.167.132 - Registrar in stored WHOIS data: SCALEWAY - Registrar country in stored WHOIS data: Unknown - Registration date (registry RDAP, nickelmanagement.fr): 2026-08-12 07:18:35 UTC ## Evidence links - URLScan report: https://urlscan.io/result/01a03d79-57e8-764f-bbb2-6de909b0399c/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/nickelmanagement.fr - Certificate Transparency search: https://crt.sh/?q=%25.nickelmanagement.fr - Web Archive lookup: https://web.archive.org/web/*/https://nickelmanagement.fr/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview nickelmanagement.fr is a phishing site that PhishDestroy classifies as impersonation. Its name is styled like an official account or management portal, and the .fr domain and French hosting point to French-speaking victims. PhishDestroy first flagged it on 2026-08-26. The site has been offline since 2026-09-11, and its DNS was still inactive at the last check on 2026-10-19. How the scam works Impersonation pages copy the look and wording of a service the victim already trusts. Visitors usually arrive through an email, SMS or ad, then are asked to log in, confirm their identity or fix an urgent account problem. Anything typed into the form, such as usernames, passwords, one-time codes, card numbers or ID details, goes straight to the operators. They can use it to take over the real account or commit fraud. When last fetched, the page returned the title "403 Forbidden" rather than a branded login screen, which differs from the impersonation classification. Evidence Thirteen of 91 VirusTotal engines flagged the domain as of 2026-08-31. Detections came from alphaMountain.ai, BitDefender, Cluster25, CRDF, Forcepoint ThreatSeeker, Fortinet, G-Data and Gridinsoft, a spread of independent vendors that supports a confident verdict. Spamhaus lists it in its DBL under the phishing category, which lets mail filters reject messages containing the link. It also appears in five AlienVault OTX threat pulses and on the PhishDestroy blocklist. Infrastructure The domain was registered on 2026-08-12 through Scaleway, just fourteen days before PhishDestroy detected it. That short gap fits a disposable domain bought for one campaign. It was hosted in France on the O2SWITCH SAS network, which matches the French-language targeting. The site went dark about a month after registration, a typical lifespan for throwaway phishing domains. What to do If you entered a password on this site, change it immediately on the genuine service and on any other account that uses the same password. Then turn on two-factor authentication. If you gave card or bank details, call your bank to block the card and ask about disputing unfamiliar charges. If you submitted ID documents, watch for fraudulent account openings. Defenders should block the domain at mail and DNS layers and search mail logs for messages linking to it, so they can find users who may have been exposed. Useful links urlscan.io scan and screenshot: https://urlscan.io/result/01a03d79-57e8-764f-bbb2-6de909b0399c/ VirusTotal report: https://www.virustotal.com/gui/domain/nickelmanagement.fr Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=nickelmanagement.fr Archived copy: https://web.archive.org/web/20260826095213/https://nickelmanagement.fr/ Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-19 10:26:42 UTC ## Stored page captures - Primary capture: https://i.ibb.co/DHT0KS7T/83b1d00dd47b.png Captured: 2026-08-26 09:50:25 UTC - URLScan capture: https://screenshots.phishdestroy.io/01a03d79-57e8-764f-bbb2-6de909b0399c.png Captured: 2026-08-26 09:50:25 UTC Source report: https://urlscan.io/result/01a03d79-57e8-764f-bbb2-6de909b0399c/ ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-21T04:31:22Z", "uuid": "01a03d79-57e8-764f-bbb2-6de909b0399c", "scanned_at": "2026-08-26T09:49:26Z", "final_url": "https://nickelmanagement.fr/CHCHDD", "status": 200, "redirected": "https-only", "redirects": [ { "to": "https://nickelmanagement.fr/CHCHDD", "from": "http://nickelmanagement.fr/CHCHDD", "status": 307 } ], "ip": "109.234.167.132", "ptr": "109-234-167-132.reverse.odns.fr", "domains": [ "touthalal.com" ], "ips": [ "109.234.167.132" ], "asns": [ "50474" ], "countries": [ "FR" ], "doc_hash": "e2fc9ce532cd3ba3722eb7cd045f4792e3a13a507c07fe481e4f82ba24b2633b", "globals": [ "ontouchcancel", "ontouchend", "ontouchmove", "ontouchstart" ], "tls": { "san": [ "nickelmanagement.fr", "www.nickelmanagement.fr" ], "cipher": "AES_256_GCM", "issuer": "YR2", "subject": "nickelmanagement.fr", "protocol": "TLS 1.3", "valid_to": "2026-11-16T13:41:41Z", "valid_from": "2026-08-18T13:41:42Z" }, "domain_age_days": 7, "apex_age_days": 7, "tls_age_days": 7, "tls_valid_days": 89, "requests": 6, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 90, "malicious": true }, "overall": { "score": 0, "malicious": false } }, "headers": { "server": "o2switch-PowerBoost-v3", "content-type": "text/html; charset=UTF-8" } }, "cf": { "v": 1, "fetched_at": "2026-10-21T05:59:10Z", "uuid": "0f7af9ea-75b5-46df-9564-ad18927070d6", "scanned_at": "2026-08-26T10:00:22Z", "final_url": "https://nickelmanagement.fr/", "status": 200, "redirected": "https-only", "history": [ { "url": "http://nickelmanagement.fr/", "status": 307 }, { "url": "https://nickelmanagement.fr/", "status": 200 } ], "dom_hash": "d02b4a55b16b7f3f6cc3c5127ce49f7d6c432847a9473c636bc0916ea6926398", "doc_hash": "e2fc9ce532cd3ba3722eb7cd045f4792e3a13a507c07fe481e4f82ba24b2633b", "domain_risks": [ "Newly Seen Domains", "Security Risks" ], "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "nickelmanagement.fr", "type": "A", "value": "109.234.167.132" } ], "dnssec_valid": false, "ip": "109.234.167.132", "whois": { "registrar": "SCALEWAY", "created": "2026-08-12T07:18:35Z", "updated": "2026-08-17T07:24:43Z", "expires": "2027-08-12T07:18:35Z", "nameservers": [ "ns1.o2switch.net", "ns2.o2switch.net" ] } } } ```