NiceNIC International Group

Key Findings

• One-in-sixteen domains is a phishing site. Our full zone scan of 351,701 NiceNIC-registered domains identified 22,535 confirmed phishing pages, a contamination rate of 6.4%. For a registrar of this size, that figure is extraordinary; the industry baseline sits well below 0.5%.
• Crypto platforms are the primary target. Coinbase alone accounted for 3,798 spoofed domains, with Ledger (1,317) and Kraken (1,214) also heavily targeted. The pattern is consistent with organized seed-phrase harvesting operations that register domains in bulk, run them briefly, then cycle to fresh infrastructure.
• Registration bursts reveal coordinated actor activity. On 2026-06-16, 1,382 phishing domains were registered in a single day, 14.9 times the daily average. Bursts of this magnitude do not occur organically; they indicate a small number of actors with direct registrar relationships, pre-approved payment methods, and automated provisioning pipelines.
• .com dominates but bulk TLDs take the overflow. Of the 351,701 domains scanned, 194,812 (55.4%) use .com. However, NiceNIC's management of .vip (27,121 domains) and .icu (16,517 domains) provides low-cost bulk registration channels that threat actors exploit heavily when .com slots are harder to acquire quickly.
• Abuse response is structurally absent. PhishDestroy has submitted hundreds of abuse reports to NiceNIC across multiple reporting channels. Takedown rates remain near zero for active phishing infrastructure. Domains that receive takedown notices frequently re-resolve within 24–48 hours under the same registrar account, which indicates that no account-level enforcement is occurring.
• The full dataset is publicly archived. Every phishing domain, registration date, targeted brand, and abuse submission is documented in the public evidence repository. The data is structured for law enforcement intake and ICANN compliance review.

Live Detection Feed

Most recent NiceNIC phishing domains detected by PhishDestroy. Updated continuously.

Evidence & Related Investigation