tickxwelt[.]info

This domain, tickxwelt.info, is identified as a phishing site specifically targeting users of Ticketmaster, a major ticket sales and distribution platform. The threat type is classified as generic phishing, with the intent to deceive victims into entering sensitive credentials or payment information under the guise of purchasing event tickets. As of the latest verification, the domain is offline, though prior activity suggests it was actively used in malicious campaigns. Analysis indicates the domain was registered on February 21, 2026, through NiceNIC International Group Co., Limited, a registrar frequently associated with high-risk domains. It resolves to the IP address 188.114.96.3, which is part of an infrastructure known for hosting multiple phishing and fraudulent sites. Despite its malicious nature, the domain has not been flagged by any of the 95 vendors on VirusTotal, highlighting a potential gap in detection coverage. Additional technical indicators include a Gridinsoft trust score of 0 out of 100 and its presence on one security blocklist. The domain employs Cloudflare services, including HTTP/3 and Cloudflare Browser Insights, alongside Facebook Pixel for tracking, which may be used to monitor victim interactions or enhance the credibility of the phishing page. The SSL certificate is issued by Google Trust Services, providing a false sense of security to unsuspecting users. Given the current offline status of tickxwelt.info, the immediate risk of direct user compromise is mitigated. However, the domain remains a potential threat due to its recent registration date and association with known malicious infrastructure. Organizations and security teams are advised to proactively block the domain and its associated IP address (188.114.96.3) at the network level to prevent future access. End users who may have interacted with the site should be instructed to reset credentials for Ticketmaster and any other accounts where the same login details were used. Monitoring for similar domains registered through NiceNIC or resolving to the same IP range is recommended to identify and mitigate related threats. Security vendors are encouraged to update detection rules to include this domain and its indicators of compromise.