REGISTRAR NEGLIGENCE · EGREGIOUS NiceNIC International Group Co., Limited was notified 5 months ago — the threat is still operational.

Why this matters — ICANN RAA §3.18 obligation & victim-assistance

On 2026-02-09 01:56:18 UTC PhishDestroy delivered an evidence-backed abuse report (repeated 5 times, most recently 2026-02-09 01:56:18 UTC) to support@nicenic.net with VirusTotal detections, urlscan capture, legal violations, and full screenshot evidence. More than 5 months later, the phishing infrastructure remains reachable .

Under ICANN RAA §3.18 accredited registrars are contractually obliged to “take reasonable and prompt steps to investigate and respond appropriately to any reports of abuse.” Silence beyond 24 hours after a documented notification with verifiable evidence is not a timing issue — it is a policy decision to let the operation continue. PhishDestroy\'s position: where a registrar fails to act on clear evidence, the registrar has aligned itself with the operator of the scheme and bears co-responsibility for downstream harm caused to victims from the moment of notification onward.

Victim-assistance obligation. If NiceNIC International Group Co., Limited doesn't consider the listed detections enough proof — that is interesting in itself, given the volume of independent vendor confirmations. But after 5 separate notifications over 5 months, with the operation still active, the registrar took no measurable action to mitigate the harm caused by their client. The reasonable next step is direct help to any identified victims — contact & payment-trail disclosure, abuse-thread transcripts, registrant data preservation — since the registrar chose, by inaction, to extend the window of damage.

Elapsed since first report

5 months

Reports sent

Latest case ID

PD-1770602173-web3amlchecking

Current status

Serving traffic (alive)

Domain security & threat intelligence

web3amlchecking[.]com

Проверка домена web3amlchecking.com на фишинг и безопасность

“AML Check - The full-fledged crypto compliance solution”

Threat verdict Critical 100/100 stored risk score

Availability Last known active Latest stored reachability observation

Risk signals

VirusTotal: 12/91 detections Spamhaus DBL: DBL_PHISH 4 stored blocklist matches Brand impersonation: LinkedIn Last known active

12/91 VT Nov 28, 2025 Unavailable since Feb 21, 2026 4 Blocklists LinkedIn Crypto Scam 3 Reports Sent CDN Crypto Scam + more

Risk Score: 100 out of 100. Critical risk.

Краткий обзор отчёта

web3amlchecking.com: VirusTotal — 12 срабатываний из 91. Проверьте DNS, SSL, регистратора, блок-листы и данные об угрозах.

Подробный анализ PhishDestroy AI ниже оставлен на английском, чтобы сохранить исходную криминалистическую запись.

Evidence Summary

CRITICAL

PhishDestroy first recorded web3amlchecking.com on Nov 28, 2025. This English evidence brief is rebuilt from the current structured observations stored for the report. The current stored risk score is 100/100.

The latest stored availability state is “Last known active” (HTTP 308) on Aug 2, 2026 at 00:52 UTC. This is a reachability snapshot, not proof of the cause of any outage, restriction, or status change.

VirusTotal returned 12 detections from 91 scanners in the stored check on Jul 26, 2026 at 05:00 UTC. The independent blocklist snapshot recorded 4 matches (ScamSniffer, Polkadot, Enkrypt, Codeesura) across 10 configured external sources on Aug 2, 2026 at 00:20 UTC. PhishDestroy's own listing is excluded from that count.

Other stored evidence. Google Safe Browsing stored no positive flag on Mar 2, 2026 at 21:22 UTC. This time-bound result is not evidence of safety. AlienVault OTX stored 0 pulse references on Mar 1, 2026 at 17:20 UTC. OTX pulses are community-intelligence references, not vendor verdicts. Spamhaus DBL stored the result DBL_PHISH on Jul 14, 2026 at 16:37 UTC. A URLScan capture is stored from Feb 27, 2026 at 02:36 UTC.

Stored context lists registrar NiceNIC International Group Co., Limited, IP address 91.92.242.155, registration date Nov 26, 2025, apparent target LinkedIn. Except for the registration date, these fields do not share a source timestamp in this report and may change.

Treat these as stored, time-bound observations rather than a live safety guarantee. Source verdicts and reachability can change, and zero or missing vendor matches never prove that a domain is safe. Avoid interacting with the domain while uncertainty remains, and use the appeal process if this report is inaccurate.

VirusTotal

12 det.

URLScan

Report ↗

Gridinsoft

0/100

TLS certificate

Expired or unverified -159d

Возраст

8 mo

Observed status

Last known active 308

DestroyList

Listed

Reports Sent

3 ignored

Охват данных VirusTotal 12 / 91 URLQuery checked — no match OTX no pulses CF Radar clean URLScan capture stored report URLScan verdict checked — no malicious verdict DNS-блокировки not checked TLS expired or unverified WHOIS 8 mo old Screenshot external capture Цепочка перенаправлений not probed Gridinsoft 0/100

Данные сетевой безопасности Registrar Integrity Alert

High-Risk Registrar NiceNIC

PhishDestroy audit found that over 90% of domains registered through NiceNIC are associated with illegal content. This registrar systematically ignores abuse reports and its primary clientele consists of CIS-region scam operators. We have not identified a single legitimate project hosted on this registrar.

NiceNIC Verdict Full Investigation

Pipeline реагирования на угрозы

Discovery

Checks

Reports

Availability

19/20

Упреждающее обнаружение и сбор данных

Угроза устранена

1/1 ✓

Угроза устранена

web3amlchecking.com обнаружены и помещены в очередь для полного анализа

Nov 28, 2025

Threat Intelligence Checks

URLScan.io Capture · URLScan Verdict · Cloudflare Radar · Web Archive · VirusTotal · Google Safe Browsing · Blocklist Detection · High-Risk Registrar: NiceNIC · Brand Impersonation · Forensic Evidence Collected · Technical Analysis Recorded · Cloudflare Radar Scan · Cloudflare Radar Scan

13/13 ✓

URLScan.io Capture

Stored URLScan report with capture artifacts

Feb 27, 2026

URLScan Verdict

URLScan returned no malicious verdict; this provider result is not a safe-domain determination · score 0

Jul 29, 2026

Cloudflare Radar

Scanned via Cloudflare Radar — DNS, certificates & network data

Web Archive

Preserved in Wayback Machine — historical evidence archived

VirusTotal

12 / 91 vendors flagged on VirusTotal

Jul 26, 2026

Google Safe Browsing

Checked via Отчет Google о прозрачности

Mar 02, 2026

Обнаружение списков заблокированных адресов

Найдено в 4 blocklists: ScamSniffer, Polkadot, Enkrypt +1 more

Aug 02, 2026

High-Risk Registrar: NiceNIC

90%+ illegal content — registrar ignores abuse reports. Read our verdict

Brand Impersonation

Impersonation of LinkedIn

Forensic Evidence Collected

Stored evidence from URLScan.io, stored screenshot

Feb 27, 2026

Technical Analysis Recorded

The report contains stored technology or forensic-analysis results

Aug 02, 2026

Cloudflare Radar Scan

Scanned via Cloudflare Radar — network analysis completed

Mar 07, 2026

Cloudflare Radar Scan

Scanned via Cloudflare Radar — network analysis completed

Feb 27, 2026

Notification Records

Initial Abuse Report (#1) · Follow-up Report #2 · Follow-up Report #3 · 3 Reports Filed

4/4 ✓

Initial Abuse Report (#1)

Sent to 1 abuse contact at NiceNIC International Group Co., Limited with forensic evidence

support@nicenic.net

Feb 09, 2026

Follow-up Report #2

Escalation #2 sent to 1 recipient — follow-up record after a previous report

support@nicenic.net

Feb 09, 2026

Follow-up Report #3

Escalation #3 sent to 1 recipient — follow-up record after multiple previous reports

support@nicenic.net

Feb 10, 2026

3 Reports Filed

3 report records were stored over 173 days; current observed status: Last known active

Публикация и доступность

DestroyList Published · Monitoring Continues

1/2

Опубликовано «DestroyList»

Listed in the public PhishDestroy/DestroyList repository

Nov 28, 2025

Monitoring Continues

The domain remains reachable or access-restricted; future checks may update this observation

Статус в публичных блок-листах

Confirmed in 5 datasets: PhishDestroy + 4 independent public blocklists — ScamSniffer, Polkadot, Enkrypt, Codeesura

Scope: these 10 repositories only; vendor and DNS signals are reported separately above. Last synchronized Aug 02, 2026. PhishDestroy database match: confirmed.

Сбор доказательств

Stored Capture

2025-11-28 18:46 UTC

Malicious · 12/91 engines

Forensic screenshot of web3amlchecking.com showing the phishing page layout

IP: 91.92.242.155

NiceNIC International Group Co., Limited

248d old

View Full Size URLScan Report Wayback Download

Page Title

AML Check - The full-fledged crypto compliance solution

Impersonates

Linkedin Telegram Tiktok Twitter Youtube

TLS Certificate

Expired or unverified · Issued by Let's Encrypt / R13

Аналитика доменов

Domainweb3amlchecking.com

URLScan Verdict No malicious verdict recorded score 0 report ↗

Server / ASN nginx/1.18.0 (Ubuntu) · AS214943 RAILNET Railnet LLC, US

IP Reputation abuse score 0/100 0 reports checked Jul 17, 2026

Registrar NiceNIC

(RU) PhishDestroy Investigation

Abuse contactabuse@nicenic.net, abuse@lanedo.net

Реестр ICANNОфициальные регистраторы, аккредитованные ICANN →

Поиск по WHOISICANN RDAP for web3amlchecking.com →

IP Address 91.92.242.155 CDN

Geo

Amsterdam, NL

NetworkASAS214943 · AS202412 Omegatech LTD

Reverse IPviewdns.info → rapiddns.io →

Origin IP is hidden behind a CDN proxy. Reverse-IP on the edge IP returns unrelated tenants — origin discovery requires passive-DNS or CT cross-reference.

RegistrationСоздано Nov 26, 2025 (248d)

Статус HTTP308 Permanent Redirect

Elapsed Since First Report 130 days

What we count Raw elapsed time since the first stored abuse report. It is not a registrar response-time measurement. Latest observed status: Last known active.

Minimum notice count 3 is the number of stored outgoing report records for this domain. It does not by itself prove acknowledgement or action by a recipient.

What each report contains Stored outgoing report records may reference evidence available at the time, such as vendor verdicts, registration data, hosting details, classifications, or screenshots. This page does not infer the exact payload delivered, receipt, acknowledgement, or action by a recipient.

ICANN RAA §3.18 The history below lists stored escalation records and timestamps. It does not by itself establish receipt, acknowledgement, compliance, or enforcement by any recipient.

Технические сведенияDNS, SAN в протоколе SSL, временные метки

Впервые обнаруженоNov 28, 2025

Nameserversannalise.ns.cloudflare.comchris.ns.cloudflare.com

TLS Fingerprint447356ec9c29bb14e34046bc1affa6a37517883b…

Case IDPD-1770602173-web3amlchecking

НАДЗОР ICANN · СБОР ПОЛУЧЕН

ICANN получила деньги. Подотчётность так и не появилась.

Для этой gTLD указанный выше регистратор работает по договору с ICANN. ICANN взимает ежегодные, переменные и транзакционные сборы, связанные с регистрациями, продлениями и трансферами.

Аккредитация: монетизирована. Подотчётность: пожалуйста, проверьте позже.

Затем начинается магия: ICANN пишет RAA §3.18, регистратор расследует злоупотребления внутри собственной клиентской базы, а жертвы бесплатно предоставляют доказательства, пока каждый уровень ждёт, что действовать начнёт кто-то другой. Если благодаря этому жертвы чувствуют себя в большей безопасности — отлично: счёт сделал своё дело.

Аккредитация — это договор, а не знак безопасности. Проверить сборы ICANN Прочитать RAA §3.18 PHISHDESTROY INVESTIGATIONКартель ICANN: $155 млн за неисполняемые контракты

Сатирическая записка о подотчётности Ничего не отправляется автоматически.

История жалоб на злоупотребления · 3 stored reports over 2 days · click to expand

This timeline is built from stored outgoing report records. It documents timestamps and listed recipients, but does not by itself prove delivery, acknowledgement, or recipient action.

3 abuse reports filed over 173 days — latest observed status: Last known active

The records name NiceNIC International Group Co., Limited as a recipient or subject.

reports

173

days

Report #1 Escalation 368h still active Feb 9, 2026 · 01:56 UTC

ESCALATION #3 (368h active): Phishing - web3amlchecking[.]com

support@nicenic.net
Report #2 Escalation 368h still active Feb 9, 2026 · 02:01 UTC

ESCALATION #4 (368h active): Phishing - web3amlchecking[.]com

support@nicenic.net
Report #3 Escalation 406h still active Feb 10, 2026 · 16:53 UTC

ESCALATION #5 (406h active): Phishing - web3amlchecking[.]com

support@nicenic.net

Record scope: the timeline documents outgoing records stored by PhishDestroy. Delivery, acknowledgement, and subsequent action require separate recipient or infrastructure evidence.

Технологии · 3 identified

Ubuntu

Vue.js

JavaScript frameworks

Progressive JavaScript framework for building user interfaces.

Nginx

Web servers Reverse proxies

High-performance HTTP server and reverse proxy, known for stability and low resource usage.

Detected via Cloudflare Radar · Wappalyzer engine

Пожаловаться на этот домен Предоставьте доказательства и помогите защитить других

Анализ VirusTotal

12 / 91 security vendors flagged this domain

View on VT

ADMINUSLabs

alphaMountain.ai

BitDefender

Chong Lua Dao

ESET

Forcepoint ThreatSeeker

Fortinet

G-Data

Gridinsoft

Lionic

Sophos

VIPRE

Архивные доказательства

Wayback Machine Snapshot

A historical snapshot is available for evidence review

View Archive

Анализ производительности сайта

Google PageSpeed Insights — mobile performance audit of web3amlchecking.com · checked Mar 2, 2026

Poor

Performance

FCP

26.39s

First Contentful Paint

LCP

26.41s

Largest Contentful Paint

CLS

0.033

Cumulative Layout Shift

TBT

1599ms

Total Blocking Time

26.39s

Speed Index

Доказательства и внешние отчеты Open external tools

Анализ безопасности

URLScan No match VirusTotal 12 det. ChainPatrol URLQuery No match Gridinsoft 0 trust SSL Labs Expired/unverified CF Radar Open report WOT ScamAdviser Проверка черного списка URLVoid Sucuri SiteCheck Обсерватория MDN

OSINT и разведка

Web-Check Full scan Shodan Censys ThreatFox Хадсон-Рок IntelX crt.sh Certs WHOIS Wayback Archived

DNS и сеть

nslookup.io DNS bgp.tools ASN/Route

SEO и домены

SpyFu Moz DA/PA Ahrefs Backlinks Глубокий анализ

Повлиял ли на вас этот сайт?

Ты не один, и тебе нечего стыдиться. Мошенники — это искушенные преступники, которые злоупотребляют доверием. Сообщение о вашем случае — самое действенное оружие в борьбе с мошенничеством: ваше заявление может уберечь других от того, чтобы стать жертвами, и помочь правоохранительным органам принять меры. Молчание — главное преимущество мошенника. Разбей это.

If you entered account credentials, personal or payment information, or downloaded a file from this domain, take immediate action. Below are resources to help you report the incident and protect yourself.

ФБР IC3

Сообщить о преступлении в Интернете (США)

Europol

Сообщить о киберпреступлении (ЕС)

Action Fraud

Сообщить о мошенничестве и киберпреступлениях (Великобритания)

Обжалование решения по домену

Если это ложное срабатывание, оспорьте эту запись

Остерегайтесь мошенников, предлагающих услуги по восстановлению данных! Criminals may contact victims again while pretending to be investigators, lawyers, or recovery agents. Do not pay upfront fees or share credentials. Узнайте больше о мошенничестве при получении компенсаций →

Сообщите об этом в местные органы власти

Выберите свою страну, чтобы получить официальные контакты по вопросам киберпреступности, or create a complaint draft →

Выберите свою страну...

Более 180 стран

Zero-PII — ваши данные никогда не покидают браузер Review and submit it yourself

About This Report: web3amlchecking.com

This report presents the latest stored evidence available to PhishDestroy. Source timestamps are shown where available; availability and vendor verdicts can change after collection.

The site displays a page titled “AML Check - The full-fledged crypto compliance solution”, which may be designed to impersonate LinkedIn.

web3amlchecking.com has been flagged by 12 security vendors as of August 1, 2026.

Если вы считаете, что эта информация неверна, вы можете подать апелляцию. Для получения более подробной информации о нашей методологии посетите наш Страница «Часто задаваемые вопросы».

Будьте в курсе событий, берегите себя

Отслеживайте актуальные угрозы или оспорьте эту запись, если считаете, что это ложное срабатывание

Поток оперативных данных об угрозах Подать жалобу на это объявление

HTML · IFRAME

Вставить этот отчет

Разместите эту информацию об угрозах на своём сайте или в блоге

embed.html

<iframe
  src="https://phishdestroy.io/ru/embed/domain/web3amlchecking.com"
  title="PhishDestroy threat report for web3amlchecking.com"
  width="100%" height="320"
  loading="lazy"
  referrerpolicy="no-referrer"
  sandbox="allow-same-origin allow-popups allow-popups-to-escape-sandbox"
  style="border:0;border-radius:12px;max-width:100%"
></iframe>

web3amlchecking[.]com

Pipeline реагирования на угрозы

Статус в публичных блок-листах

Сбор доказательств

Аналитика доменов

ICANN получила деньги. Подотчётность так и не появилась.

Анализ VirusTotal