nicetenz[.]biz

Analysis of nicetenz.biz, created on 21 February 2026 and currently listed as offline, shows a set of indicators consistent with a generic phishing infrastructure. The domain is delegated to Cloudflare name servers bailey.ns.cloudflare.com and earl.ns.cloudflare.com and resolves to the Cloudflare edge address 188.114.97.3, located in the United States under ASN 13335. No TLS certificate was observed, indicating that the site was served over plain HTTP despite the presence of HTTP/3 support, a configuration sometimes used to evade simple content‑inspection tools. The only visible content fingerprint is the page title “Reaver – Roulette”, which does not correspond to a known legitimate brand and provides no further context about the intended victim set.

VirusTotal scans have recorded 12 detections out of 93 submitted security scanners, suggesting that a minority of AV engines identified malicious behavior or payloads associated with the domain. The domain appears on a single external blocklist and has been actively blocked by the PhishDestroy service, reinforcing the notion that it has been used for phishing campaigns. Registration information shows the registrar as Global Domain Group LLC, a provider frequently used for rapid bulk registrations.

The combination of recent registration, Cloudflare‑based hosting, lack of TLS, a non‑descriptive page title, and multiple vendor detections points to a deliberately short‑lived phishing site that has already been taken down. Uncertainties remain regarding the specific lure or credential‑stealing mechanism employed, as no additional page content or URL patterns have been disclosed. Defenders should continue to monitor for any residual DNS resolution or resurrected infrastructure tied to the same IP range, update web‑filter and email‑gateway blocklists with nicetenz.