104365-ticket[.]com

Analysis of the domain 104365-ticket.com, registered on July 21, 2026, indicates that it is currently active and hosted on the IP address 104.21.2.148. The registration was performed through NICENIC INTERNATIONAL GROUP CO., LIMITED, and the domain uses Cloudflare nameservers (robin.ns.cloudflare.com and woz.ns.cloudflare.com). VirusTotal records show that the domain was examined by 91 scanning engines, none of which reported a detection at the time of analysis.

While the absence of detections does not confirm benign intent, it demonstrates that automated scanners have not yet flagged the content as malicious. The domain is listed on a single security blocklist and has been explicitly blocked by the PhishDestroy service, suggesting that threat intelligence providers have identified it as a potential phishing vector. No public information is available regarding the site’s page title, SSL certificate details, HTTP response codes, or any observed branding in the content; consequently, the precise lure or targeted brand cannot be confirmed.

Defenders should treat the domain as suspicious based on its recent creation, association with a known phishing blocklist, and its hosting on a shared CDN infrastructure. Recommended mitigation steps include adding the domain to network and endpoint blocklists, monitoring DNS queries for the associated IP address, and employing URL filtering to prevent user access. Continuous observation is advised to capture any future changes in detection status, blocklist appearances, or content modifications that could clarify the phishing campaign’s objectives.