ticketfinder.xyz
172.67.176.197 Malicious Activity! Public Scan Open in urlscan Pro

Go To Rescan
Add Verdict Report

Submitted URL:
http://ticketfinder.xyz/pay 6yr old
Effective URL:
https://ticketfinder.xyz/pay/ 6yr old
Submission: On March 30 via manual (March 30th 2026, 6:27:36 pm UTC) from CA — Scanned from CA

Summary HTTP 27 Redirects Behaviour Indicators

Summary

This website contacted 3 IPs in 1 countries across 3 domains to perform 27 HTTP transactions. The main IP is 172.67.176.197, located in Ascension Island and belongs to CLOUDFLARENET - Cloudflare, Inc., US. The main domain is ticketfinder.xyz. 6yr old
TLS certificate: Issued by E8 on March 26th 2026. Valid for: 3mo.

This is the only time ticketfinder.xyz was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Government of Manitoba (Government)

Domain & IP information

	IP Address	AS Autonomous System
1 22	172.67.176.197 172.67.176.197	13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
4	104.16.80.73 104.16.80.73	13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
27	3

22 172.67.176.197 (Ascension Island) 1 redirects

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

ticketfinder.xyz 6yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

4 104.16.80.73 (Ascension Island)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

static.cloudflareinsights.com 7yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

	Apex Domain Subdomains	Transfer
22	ticketfinder.xyz 1 redirects ticketfinder.xyz 6yr old	274 KB
4	cloudflareinsights.com static.cloudflareinsights.com — Cisco Umbrella Rank: 295 7yr old	11 KB
0	google.com Failed www.google.com Failed 13yr old
27	3

	Domain	Requested by
22	ticketfinder.xyz	1 redirects ticketfinder.xyz static.cloudflareinsights.com
4	static.cloudflareinsights.com	ticketfinder.xyz
0	www.google.com Failed
27	3

This site contains no links.

Subject Issuer	Validity	Valid
ticketfinder.xyz E8	`2026-03-26` - `2026-06-24`	3mo	crt.sh
cloudflareinsights.com WE1	`2026-02-17` - `2026-05-18`	3mo	crt.sh

This page contains 3 frames:

Primary Page: https://ticketfinder.xyz/pay/
Frame ID: 021E0E301E16FBBE1245F1CC47C15BD0
Requests: 17 HTTP requests in this frame

Frame: https://ticketfinder.xyz/pay/loading.html
Frame ID: 286DACB6C76FEDADC1F2E73166922609
Requests: 5 HTTP requests in this frame

Frame: https://ticketfinder.xyz/websites/71f3356a-1bda-4668-b3da-fb2deb1ff84f/fae7aedc-8c0e-40d0-abae-ede4a257ce32/index.html
Frame ID: 26AF62AD822B09229ACFE415C4B8419E
Requests: 10 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://ticketfinder.xyz/pay HTTP 307
https://ticketfinder.xyz/pay HTTP 301
http://ticketfinder.xyz/pay/ HTTP 307
https://ticketfinder.xyz/pay/ Page URL

Detected technologies

Vue.js (JavaScript frameworks) Expand

Overall confidence: 100%
Detected patterns

<(?!svg)[^>]+\sdata-v(?:ue)?-

Cloudflare Browser Insights (Analytics) Expand

Overall confidence: 100%
Detected patterns

static\.cloudflareinsights\.com/beacon(?:\.min)?\.js

Page Statistics

27
Requests

93 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

3
IPs

1
Countries

315 kB
Transfer

1115 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://ticketfinder.xyz/pay HTTP 307
https://ticketfinder.xyz/pay HTTP 301
http://ticketfinder.xyz/pay/ HTTP 307
https://ticketfinder.xyz/pay/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 8

https://ticketfinder.xyz/favicon.ico HTTP 302
https://www.google.com/

27 HTTP transactions
5 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response ticketfinder.xyz/pay/ Redirect Chain http://ticketfinder.xyz/pay https://ticketfinder.xyz/pay http://ticketfinder.xyz/pay/ https://ticketfinder.xyz/pay/	872 B 923 B	52ms 51ms	Document text/html	172.67.176.197 Cloudflare
General Check archive.org Download Go to Full URL https://ticketfinder.xyz/pay/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.67.176.197 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash `2271908d440e863d8b18da9457bedf0b965b042e1edcd9c08a6fba9d30e99726` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36 Response headers alt-svc h3=":443"; ma=86400 cf-cache-status DYNAMIC cf-ray 9e492b5e09f48bf1-YYZ content-encoding zstd content-type text/html date Mon, 30 Mar 2026 18:27:37 GMT last-modified Sat, 16 Aug 2025 04:03:32 GMT nel {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800} report-to {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=9J%2FmNdLtM%2BOxzWVd%2B6%2FO%2FVxpbJN7JKJ1w9T4ge2IBSMFIeJduCBui8QspeDLHHlFQIU1R8fyB%2BXT8tFCQHkkJ63aygOGQaJ7qNn8iSxiw%2Bmjh6nVDvXGYmfuRNHXUfknQRos"}]} server cloudflare server-timing cfCacheStatus;desc="DYNAMIC" cfEdge;dur=4,cfOrigin;dur=22 Redirect headers Location https://ticketfinder.xyz/pay/ Non-Authoritative-Reason HttpsUpgrades
GET H3	200	index-B1veIbDR.js Show response ticketfinder.xyz/pay/assets/	164 KB 67 KB	44ms 43ms	Script application/javascript	172.67.176.197 Cloudflare
General Check archive.org Download Go to Full URL https://ticketfinder.xyz/pay/assets/index-B1veIbDR.js Requested by Host: ticketfinder.xyz URL: https://ticketfinder.xyz/pay/ Protocol H3 Security QUIC, , AES_128_GCM Server 172.67.176.197 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash `f1ad62f5aac98d238fb5eb3e38f264480f750b6684437701f9b0c070ed01f96c` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36 Origin https://ticketfinder.xyz Referer https://ticketfinder.xyz/pay/ Response headers nel {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800} cache-control max-age=14400 content-encoding zstd cf-cache-status HIT etag W/"68a00314-28e37" age 4204 report-to {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=s5GQmt333eCoe0a6cfSWySZWwemCzwRcoBlo991YvuIHASB4tFGCZokgOYk6q%2Bd7pfwrznLiDbnw3emOGVc8wh6sz%2F4fH25fVjHD17a5v0RVouPQCHyTX39EX8mCgEG3Orlb"}]} cf-ray 9e492b5efe818eb6-YYZ alt-svc h3=":443"; ma=86400 server-timing cfExtPri date Mon, 30 Mar 2026 18:27:37 GMT content-type application/javascript last-modified Sat, 16 Aug 2025 04:03:32 GMT server cloudflare priority u=1,i=?0
GET H3	200	index-C6qrI_xe.css ticketfinder.xyz/pay/assets/	79 KB 9 KB	36ms 36ms	Stylesheet text/css	172.67.176.197 Cloudflare
General Check archive.org Download Go to Full URL https://ticketfinder.xyz/pay/assets/index-C6qrI_xe.css Requested by Host: ticketfinder.xyz URL: https://ticketfinder.xyz/pay/ Protocol H3 Security QUIC, , AES_128_GCM Server 172.67.176.197 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash `16fbbc747d658ce4bde2eae27cb9793d424fe0ecf2554f1cf60dc481f49efb34` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36 Origin https://ticketfinder.xyz Referer https://ticketfinder.xyz/pay/ Response headers nel {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800} cache-control max-age=14400 content-encoding zstd cf-cache-status HIT etag W/"68a00314-13cd2" age 1743 report-to {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=2f3XakiCrWvk9FzJyYwvtFy39cS05QOaaY7tsRKTaNSXudIfgRMiCH14Smx19wn3WrUE51%2Bqg%2BFGV%2BW3e2AO7HzCDxIjzZUNU%2B0%2BZ1zpWSb1Cm2aAWH6OMo67%2FKYZXM%2BCpRu"}]} cf-ray 9e492b5efe808eb6-YYZ alt-svc h3=":443"; ma=86400 server-timing cfExtPri date Mon, 30 Mar 2026 18:27:37 GMT content-type text/css last-modified Sat, 16 Aug 2025 04:03:32 GMT server cloudflare priority u=0,i=?0
GET H2	200	v8c78df7c7c0f484497ecbca7046644da1771523124516 Show response static.cloudflareinsights.com/beacon.min.js/	30 KB 11 KB	86ms 30ms	Script text/javascript	104.16.80.73 Cloudflare
General Check archive.org Download Go to Full URL https://static.cloudflareinsights.com/beacon.min.js/v8c78df7c7c0f484497ecbca7046644da1771523124516 Requested by Host: ticketfinder.xyz URL: https://ticketfinder.xyz/pay/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.16.80.73 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash `4b77eae349a8cbcea7133cf3640a64ebf1f69d54d8f6469d7be6fdc188ca4ca4` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36 Origin https://ticketfinder.xyz Referer https://ticketfinder.xyz/ Response headers cache-control public, max-age=86400 content-encoding gzip etag W/"2026.2.0" cross-origin-resource-policy cross-origin cf-ray 9e492b5fbd0bac33-YYZ access-control-allow-origin * date Mon, 30 Mar 2026 18:27:37 GMT content-type text/javascript;charset=UTF-8 last-modified Thu, 19 Feb 2026 17:45:24 GMT server cloudflare
GET H3	200	config.json Show response ticketfinder.xyz/pay/	72 B 523 B	55ms 54ms	Fetch application/json	172.67.176.197 Cloudflare
General Check archive.org Download Go to Full URL https://ticketfinder.xyz/pay/config.json Requested by Host: ticketfinder.xyz URL: https://ticketfinder.xyz/pay/assets/index-B1veIbDR.js Protocol H3 Security QUIC, , AES_128_GCM Server 172.67.176.197 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash `55cb233cc16ff541256714d7b7c36ed9051a8a28806b472d267fc25e4c72afd6` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36 Referer https://ticketfinder.xyz/pay/ Response headers nel {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800} content-encoding zstd cf-cache-status DYNAMIC etag W/"69c82b41-48" report-to {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=bCqPxeRrBv4EpYpwpNfhllKyZikpFwxfgim2FaqiI1g4hkxUWGlJOyFSmk4NkBoUbMk8j%2BDOEyf3IVuqxYhKxec32iIY0dm2zuNz6IMOuYhUV2pvDw4jYku7dZLN06iWi13c"}]} cf-ray 9e492b5fae948eb6-YYZ alt-svc h3=":443"; ma=86400 server-timing cfExtPri date Mon, 30 Mar 2026 18:27:37 GMT content-type application/json last-modified Sat, 28 Mar 2026 19:25:53 GMT server cloudflare priority u=1,i
GET H3	200	config.json Show response ticketfinder.xyz/pay/	72 B 0	55ms 55ms	Fetch application/json	172.67.176.197 Cloudflare
General Check archive.org Download Go to Full URL https://ticketfinder.xyz/pay/config.json Requested by Host: ticketfinder.xyz URL: https://ticketfinder.xyz/pay/assets/index-B1veIbDR.js Protocol H3 Security QUIC, , AES_128_GCM Server 172.67.176.197 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash `55cb233cc16ff541256714d7b7c36ed9051a8a28806b472d267fc25e4c72afd6` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36 Referer https://ticketfinder.xyz/pay/ Response headers nel {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800} content-encoding zstd cf-cache-status DYNAMIC etag W/"69c82b41-48" report-to {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=bCqPxeRrBv4EpYpwpNfhllKyZikpFwxfgim2FaqiI1g4hkxUWGlJOyFSmk4NkBoUbMk8j%2BDOEyf3IVuqxYhKxec32iIY0dm2zuNz6IMOuYhUV2pvDw4jYku7dZLN06iWi13c"}]} cf-ray 9e492b5fae948eb6-YYZ alt-svc h3=":443"; ma=86400 server-timing cfExtPri date Mon, 30 Mar 2026 18:27:37 GMT content-type application/json last-modified Sat, 28 Mar 2026 19:25:53 GMT server cloudflare priority u=1,i
GET H3	200	render-CsTksqVH.js Show response ticketfinder.xyz/pay/assets/	1 KB 1 KB	28ms 28ms	Script application/javascript	172.67.176.197 Cloudflare
General Check archive.org Download Go to Full URL https://ticketfinder.xyz/pay/assets/render-CsTksqVH.js Requested by Host: ticketfinder.xyz URL: https://ticketfinder.xyz/pay/assets/index-B1veIbDR.js Protocol H3 Security QUIC, , AES_128_GCM Server 172.67.176.197 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash `bf5d4d473d063bf82e8ae250ea8831b61883a457e064e7f0e007c6dc7835d5fa` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36 Origin https://ticketfinder.xyz Referer https://ticketfinder.xyz/pay/assets/index-B1veIbDR.js Response headers nel {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800} cache-control max-age=14400 content-encoding zstd cf-cache-status HIT etag W/"68a00314-49d" age 4204 report-to {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=kfnArWoiDLqIRzuF4OU6H32H2u2BKvaPRiWbka1Eo2LTY75Y9P4nhkoc5WJIdguxXSMlvA1M20yqSBbcaKzHBVA1yVtR2V1KsEoXUvDUOrqIWTheq18y3cYnvyVXPtPdcDeo"}]} cf-ray 9e492b5fae958eb6-YYZ alt-svc h3=":443"; ma=86400 server-timing cfExtPri date Mon, 30 Mar 2026 18:27:37 GMT content-type application/javascript last-modified Sat, 16 Aug 2025 04:03:32 GMT server cloudflare priority u=1,i=?0
GET H3	200	page.json Show response ticketfinder.xyz/pay/	2 KB 1 KB	50ms 50ms	Fetch application/json	172.67.176.197 Cloudflare
General Check archive.org Download Go to Full URL https://ticketfinder.xyz/pay/page.json Requested by Host: ticketfinder.xyz URL: https://ticketfinder.xyz/pay/assets/render-CsTksqVH.js Protocol H3 Security QUIC, , AES_128_GCM Server 172.67.176.197 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash `e1147e3c06de2539517a53ea97978d902fcb625c34b7260aa82dd54fcebdcf1e` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36 Referer https://ticketfinder.xyz/pay/ Response headers nel {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800} content-encoding zstd cf-cache-status DYNAMIC etag W/"69c82b41-794" report-to {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=BNdh%2BspeCsYabQzFVkDjVRVvZJZIfOSX72U%2F2ouv%2BxWYH5x664gKO3hX40JGtUd0EpTgf5S5vpd0nUfRT1sN002rNPge5vknJndrz1uh%2FGPLQLmyntZaGon2tjE1BieeWbxK"}]} cf-ray 9e492b5fee998eb6-YYZ alt-svc h3=":443"; ma=86400 server-timing cfExtPri date Mon, 30 Mar 2026 18:27:37 GMT content-type application/json last-modified Sat, 28 Mar 2026 19:25:53 GMT server cloudflare priority u=1,i
POST H3	204	rum Show response ticketfinder.xyz/cdn-cgi/	0 454 B	24ms 24ms	XHR text/plain	172.67.176.197 Cloudflare
General Check archive.org Download Go to Full URL https://ticketfinder.xyz/cdn-cgi/rum? Requested by Host: static.cloudflareinsights.com URL: https://static.cloudflareinsights.com/beacon.min.js/v8c78df7c7c0f484497ecbca7046644da1771523124516 Protocol H3 Security QUIC, , AES_128_GCM Server 172.67.176.197 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36 content-type application/json Referer https://ticketfinder.xyz/pay/ Response headers access-control-max-age 86400 nel {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800} report-to {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=5FubXyuJKF20%2FUWmYDfo8bXB6S5d9R5bfXJ6iPHWOtkLUfhYSiMwKymuV%2FasHeLOOHwNVh%2FDRnEyGs0MpsKoJqcxj4%2BVijbwYeFUAslt8qtObuHHn%2Bq4UW4XLVK6NGOKCVgs"}]} access-control-allow-credentials true access-control-allow-methods POST,OPTIONS cf-ray 9e492b600e9c8eb6-YYZ access-control-allow-origin https://ticketfinder.xyz alt-svc h3=":443"; ma=86400 server-timing cfExtPri date Mon, 30 Mar 2026 18:27:37 GMT content-type text/plain vary Origin server cloudflare priority u=1,i
GET		/ www.google.com/ Redirect Chain https://ticketfinder.xyz/favicon.ico https://www.google.com/	0 0

GET H3	200	loading.html Show response ticketfinder.xyz/pay/ Frame 286D	4 KB 3 KB	51ms 51ms	Document text/html	172.67.176.197 Cloudflare
General Check archive.org Download Go to Full URL https://ticketfinder.xyz/pay/loading.html Requested by Host: ticketfinder.xyz URL: https://ticketfinder.xyz/pay/assets/index-B1veIbDR.js Protocol H3 Security QUIC, , AES_128_GCM Server 172.67.176.197 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash `ce0b5ba99a7ee48f215fbca41f1ba8d227626c4d3ce2bb6280e4af4a2e63cf83` Request headers Referer https://ticketfinder.xyz/pay/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36 Response headers alt-svc h3=":443"; ma=86400 cf-cache-status DYNAMIC cf-ray 9e492b601ea18eb6-YYZ content-encoding zstd content-type text/html date Mon, 30 Mar 2026 18:27:37 GMT last-modified Mon, 05 May 2025 04:46:40 GMT nel {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800} priority u=0,i report-to {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=IbxsCbprTqiwepsR4ct%2FSBZ5lPm3ta6U9QkqWEh0dYDpXcz49NBugMrLNiWUW8ek9WIYt9abPPE1ISZBBeoqH5FjnO3dQRebJ8Wpkm%2FQgXubdsQfbZ0JnXlgQmsRKFKp%2FoZs"}]} server cloudflare server-timing cfCacheStatus;desc="DYNAMIC" cfEdge;dur=4,cfOrigin;dur=26 cfExtPri
GET H3	200	/ Show response ticketfinder.xyz/socket.io/	113 B 603 B	78ms 78ms	XHR text/plain	172.67.176.197 Cloudflare
General Check archive.org Download Go to Full URL https://ticketfinder.xyz/socket.io/?EIO=4&transport=polling&t=it5olopa Requested by Host: ticketfinder.xyz URL: https://ticketfinder.xyz/pay/assets/index-B1veIbDR.js Protocol H3 Security QUIC, , AES_128_GCM Server 172.67.176.197 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash `66ca38b43dab9031a765ee5674f8fc2b61adc11fa2a237806662e15dde2b0be0` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36 Accept / Referer https://ticketfinder.xyz/pay/ Response headers access-control-expose-headers * nel {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800} content-encoding zstd cf-cache-status DYNAMIC report-to {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=GPT0SM%2FUoe%2F4bhodpUib%2BVuEI2g2PuNNjRgAqRB%2FPpe%2BWe315QQLxXr8fKN8zgJvBo%2FVpFxqunbjrHFVyqtGX03cLYlRRNhIyM8cixs8ZkDwb5BejCpZe%2BoK5k9HwCC%2Fl7u1"}]} cf-ray 9e492b601ea28eb6-YYZ access-control-allow-origin * alt-svc h3=":443"; ma=86400 server-timing cfExtPri date Mon, 30 Mar 2026 18:27:37 GMT content-type text/plain; charset=UTF-8 vary origin, access-control-request-method, access-control-request-headers server cloudflare priority u=1,i
GET H3	200	index.html Show response ticketfinder.xyz/websites/71f3356a-1bda-4668-b3da-fb2deb1ff84f/fae7aedc-8c0e-40d0-abae-ede4a257ce32/ Frame 26AF	326 KB 97 KB	79ms 79ms	Document text/html	172.67.176.197 Cloudflare
General Check archive.org Download Go to Full URL https://ticketfinder.xyz/websites/71f3356a-1bda-4668-b3da-fb2deb1ff84f/fae7aedc-8c0e-40d0-abae-ede4a257ce32/index.html Requested by Host: ticketfinder.xyz URL: https://ticketfinder.xyz/pay/assets/index-B1veIbDR.js Protocol H3 Security QUIC, , AES_128_GCM Server 172.67.176.197 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash `c2c185dbd03945c7da8ce8720fe4d48f559586504f7c2d845ca673cc2cda780b` Request headers Referer https://ticketfinder.xyz/pay/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36 Response headers alt-svc h3=":443"; ma=86400 cf-cache-status DYNAMIC cf-ray 9e492b603ea68eb6-YYZ content-encoding zstd content-type text/html date Mon, 30 Mar 2026 18:27:37 GMT last-modified Sat, 28 Mar 2026 19:25:52 GMT nel {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800} priority u=0,i report-to {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=%2FJgMn5aQMqD06OK%2FzqAnizdGsRhQHEeN61W%2BYCla5Uc2LpwEzB62XRY72mbhOrwYARJpsSDeMLH9We5%2BXAyYFWlIkyIiJXs484tjbs0h4oAfWG032N9IMOiUKuZu0zvwqLeG"}]} server cloudflare server-timing cfCacheStatus;desc="DYNAMIC" cfEdge;dur=5,cfOrigin;dur=51 cfExtPri
GET H2	200	v8c78df7c7c0f484497ecbca7046644da1771523124516 Show response static.cloudflareinsights.com/beacon.min.js/ Frame 286D	30 KB 0	0ms 0ms	Script text/javascript	104.16.80.73 Cloudflare
General Check archive.org Download Go to Full URL https://static.cloudflareinsights.com/beacon.min.js/v8c78df7c7c0f484497ecbca7046644da1771523124516 Requested by Host: ticketfinder.xyz URL: https://ticketfinder.xyz/pay/loading.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.16.80.73 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash `4b77eae349a8cbcea7133cf3640a64ebf1f69d54d8f6469d7be6fdc188ca4ca4` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36 Origin https://ticketfinder.xyz Referer https://ticketfinder.xyz/ Response headers cache-control public, max-age=86400 content-encoding gzip etag W/"2026.2.0" cross-origin-resource-policy cross-origin cf-ray 9e492b5fbd0bac33-YYZ access-control-allow-origin * date Mon, 30 Mar 2026 18:27:37 GMT content-type text/javascript;charset=UTF-8 last-modified Thu, 19 Feb 2026 17:45:24 GMT server cloudflare
GET DATA	200 OK	truncated / Frame 286D	2 KB 0		Image image/png
General Check archive.org Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `98c429a2ad48fa2af8fccab5d5d686e41ace5ced147211b775d3559514a721c6` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36 Referer Response headers Content-Type image/png
POST H3	204	rum Show response ticketfinder.xyz/cdn-cgi/ Frame 286D	0 456 B	24ms 23ms	XHR text/plain	172.67.176.197 Cloudflare
General Check archive.org Download Go to Full URL https://ticketfinder.xyz/cdn-cgi/rum? Requested by Host: static.cloudflareinsights.com URL: https://static.cloudflareinsights.com/beacon.min.js/v8c78df7c7c0f484497ecbca7046644da1771523124516 Protocol H3 Security QUIC, , AES_128_GCM Server 172.67.176.197 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36 content-type application/json Referer https://ticketfinder.xyz/pay/loading.html Response headers access-control-max-age 86400 nel {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800} report-to {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=gH6woPoBKUz%2FviP8XzGuZPJW1jU8njIxRxFJ9zwVCohY%2F28BnU%2B5C8siHmYkceylWWj%2FM4jwMJ7%2BqER0neC%2BqdtLeVFU2pkT3WlMff7zAak7cnc5dQbZM2GoqwKFONe%2Baf9e"}]} access-control-allow-credentials true access-control-allow-methods POST,OPTIONS cf-ray 9e492b609eb08eb6-YYZ access-control-allow-origin https://ticketfinder.xyz alt-svc h3=":443"; ma=86400 server-timing cfExtPri date Mon, 30 Mar 2026 18:27:37 GMT content-type text/plain vary Origin server cloudflare priority u=1,i
POST H3	200	/ Show response ticketfinder.xyz/socket.io/	2 B 484 B	51ms 51ms	XHR text/plain	172.67.176.197 Cloudflare
General Check archive.org Download Go to Full URL https://ticketfinder.xyz/socket.io/?EIO=4&transport=polling&t=it5qxfq3&sid=0yVmlivbpvC9k2QI Requested by Host: ticketfinder.xyz URL: https://ticketfinder.xyz/pay/assets/index-B1veIbDR.js Protocol H3 Security QUIC, , AES_128_GCM Server 172.67.176.197 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash `2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df` Request headers Referer https://ticketfinder.xyz/pay/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36 Accept / Content-type text/plain;charset=UTF-8 Response headers access-control-expose-headers * nel {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800} cf-cache-status DYNAMIC report-to {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=6xdX9HB3RrT7Pbl56UxLhSEraqzlWjlvn709LSaLWz6qdTnFxT7iYzpmou%2Fg3F1o7HW%2F2WQ9BWWXWmqCgPey0e8oBqH3bRO6gfxQ%2F3xaJWDv7Rg1W96uZtWiVyxISXJxJZ%2F3"}]} cf-ray 9e492b60aeb28eb6-YYZ access-control-allow-origin * alt-svc h3=":443"; ma=86400 content-length 2 server-timing cfExtPri date Mon, 30 Mar 2026 18:27:37 GMT content-type text/plain; charset=UTF-8 vary origin, access-control-request-method, access-control-request-headers server cloudflare priority u=1,i
GET H3	200	/ Show response ticketfinder.xyz/socket.io/	38 B 521 B	51ms 51ms	XHR application/octet-stream	172.67.176.197 Cloudflare
General Check archive.org Download Go to Full URL https://ticketfinder.xyz/socket.io/?EIO=4&transport=polling&t=it5r0mg0&sid=0yVmlivbpvC9k2QI Requested by Host: ticketfinder.xyz URL: https://ticketfinder.xyz/pay/assets/index-B1veIbDR.js Protocol H3 Security QUIC, , AES_128_GCM Server 172.67.176.197 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash `fd5f42f43617095d9546bfe88254067470bd72dd823c3aa4bc3b18a3a9c5c2e2` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36 Accept / Referer https://ticketfinder.xyz/pay/ Response headers access-control-expose-headers * nel {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800} cf-cache-status DYNAMIC report-to {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=cG5AmLcD8Sp6adOYBM7HDaQlMybj3JDXNnzP%2FaIlk8ttpNHZzxBBsSsLKBiWgKfWHRuZmFsKRDY%2F72NIr3Nx5IN%2BIcGvphmvhlUoD0K7x%2BaHvzW63XCITx5LMGdASChqUzeL"}]} cf-ray 9e492b60aeb48eb6-YYZ access-control-allow-origin * alt-svc h3=":443"; ma=86400 content-length 38 server-timing cfExtPri date Mon, 30 Mar 2026 18:27:37 GMT content-type text/plain; charset=UTF-8 vary origin, access-control-request-method, access-control-request-headers server cloudflare priority u=1,i
GET H3	200	runtime.js Show response ticketfinder.xyz/websites/71f3356a-1bda-4668-b3da-fb2deb1ff84f/ Frame 26AF	363 KB 86 KB	30ms 29ms	Script application/javascript	172.67.176.197 Cloudflare
General Check archive.org Download Go to Full URL https://ticketfinder.xyz/websites/71f3356a-1bda-4668-b3da-fb2deb1ff84f/runtime.js Requested by Host: ticketfinder.xyz URL: https://ticketfinder.xyz/websites/71f3356a-1bda-4668-b3da-fb2deb1ff84f/fae7aedc-8c0e-40d0-abae-ede4a257ce32/index.html Protocol H3 Security QUIC, , AES_128_GCM Server 172.67.176.197 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash `77a4bda4bd2430465394e9fffff96c32a15bb878890c915b323ebd5a55a3c6a2` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36 Referer https://ticketfinder.xyz/websites/71f3356a-1bda-4668-b3da-fb2deb1ff84f/fae7aedc-8c0e-40d0-abae-ede4a257ce32/index.html Response headers nel {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800} cache-control max-age=14400 content-encoding zstd cf-cache-status HIT etag W/"68ac6c77-5ac12" age 728 report-to {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=t0QHwK2WODjAh4sYGejAN64OnVrvqjwCd9vRB5KMf1XJBZiFtDRaZOkco8slfcgnE8%2Fv84Er1WehsmWcuRet4rkEl37rttYhNKDWLXU9zrggSehduYPK9eCUuF%2B%2FpLWexZxa"}]} cf-ray 9e492b60ceb88eb6-YYZ alt-svc h3=":443"; ma=86400 server-timing cfExtPri date Mon, 30 Mar 2026 18:27:37 GMT content-type application/javascript last-modified Mon, 25 Aug 2025 14:00:23 GMT server cloudflare priority u=3,i=?0
POST H3	200	/ Show response ticketfinder.xyz/socket.io/	2 B 483 B	61ms 59ms	XHR text/plain	172.67.176.197 Cloudflare
General Check archive.org Download Go to Full URL https://ticketfinder.xyz/socket.io/?EIO=4&transport=polling&t=it5si1e5&sid=0yVmlivbpvC9k2QI Requested by Host: ticketfinder.xyz URL: https://ticketfinder.xyz/pay/assets/index-B1veIbDR.js Protocol H3 Security QUIC, , AES_128_GCM Server 172.67.176.197 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash `2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df` Request headers Referer https://ticketfinder.xyz/pay/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36 Accept / Content-type text/plain;charset=UTF-8 Response headers access-control-expose-headers * nel {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800} cf-cache-status DYNAMIC report-to {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=shX2%2FZtQ0VS9c2zLVNv3xi3aD4CR5tj%2Fp3a8wDxq0RSeL7mfH8ZR6XXuNnl6yniq4eOusggxorypZ%2FEUyZR3gQNU%2FcfjgO61VXhXELuGdwXERsdjOy8nuBwUsLxx2475zp7O"}]} cf-ray 9e492b60feea8eb6-YYZ access-control-allow-origin * alt-svc h3=":443"; ma=86400 content-length 2 server-timing cfExtPri date Mon, 30 Mar 2026 18:27:37 GMT content-type text/plain; charset=UTF-8 vary origin, access-control-request-method, access-control-request-headers server cloudflare priority u=1,i
GET H3	200	/ Show response ticketfinder.xyz/socket.io/	59 B 541 B	53ms 52ms	XHR application/octet-stream	172.67.176.197 Cloudflare
General Check archive.org Download Go to Full URL https://ticketfinder.xyz/socket.io/?EIO=4&transport=polling&t=it5si3cq&sid=0yVmlivbpvC9k2QI Requested by Host: ticketfinder.xyz URL: https://ticketfinder.xyz/pay/assets/index-B1veIbDR.js Protocol H3 Security QUIC, , AES_128_GCM Server 172.67.176.197 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash `903889530ea2b1d24b1f7e57486a583651aa3a59e628ed6dc999e0d082c2bffd` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36 Accept / Referer https://ticketfinder.xyz/pay/ Response headers access-control-expose-headers * nel {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800} content-encoding zstd cf-cache-status DYNAMIC report-to {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=ZTKTpyMa4pBCLBl8QkmUd1X3XvixTo7BOM%2BhA8k0pv7xoPByMIPelUeal1QCZPspqerxoIeMzk0icgq04M6Xc9epp5RlpV1fWv7jX1CLNxn45xj26CDgQOwzC0zOTtLQItTG"}]} cf-ray 9e492b60feeb8eb6-YYZ access-control-allow-origin * alt-svc h3=":443"; ma=86400 server-timing cfExtPri date Mon, 30 Mar 2026 18:27:37 GMT content-type text/plain; charset=UTF-8 vary origin, access-control-request-method, access-control-request-headers server cloudflare priority u=1,i
GET H3	200	/ Show response ticketfinder.xyz/socket.io/	1 B 482 B	60ms 59ms	XHR text/plain	172.67.176.197 Cloudflare
General Check archive.org Download Go to Full URL https://ticketfinder.xyz/socket.io/?EIO=4&transport=polling&t=it5uvunb&sid=0yVmlivbpvC9k2QI Requested by Host: ticketfinder.xyz URL: https://ticketfinder.xyz/pay/assets/index-B1veIbDR.js Protocol H3 Security QUIC, , AES_128_GCM Server 172.67.176.197 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash `e7f6c011776e8db7cd330b54174fd76f7d0216b612387a5ffcfb81e6f0919683` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36 Accept / Referer https://ticketfinder.xyz/pay/ Response headers access-control-expose-headers * nel {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800} cf-cache-status DYNAMIC report-to {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=qQlueCWgY1C7gCRI7WwVZjgZ8goxBiyYtbcsBJ98yORLsX%2Fg%2BoaoqR2cfVh%2BTS4OTM9TINK5zw%2BXmq1XIx311qPtwQ1zWQFEk3XLzilV2hKusZOjWEeoiGVOnSxEW1uQ8T4b"}]} cf-ray 9e492b618f298eb6-YYZ access-control-allow-origin * alt-svc h3=":443"; ma=86400 content-length 1 server-timing cfExtPri date Mon, 30 Mar 2026 18:27:37 GMT content-type text/plain; charset=UTF-8 vary origin, access-control-request-method, access-control-request-headers server cloudflare priority u=1,i
POST H3	200	/ Show response ticketfinder.xyz/socket.io/	2 B 482 B	56ms 56ms	XHR text/plain	172.67.176.197 Cloudflare
General Check archive.org Download Go to Full URL https://ticketfinder.xyz/socket.io/?EIO=4&transport=polling&t=it5uyb5v&sid=0yVmlivbpvC9k2QI Requested by Host: ticketfinder.xyz URL: https://ticketfinder.xyz/pay/assets/index-B1veIbDR.js Protocol H3 Security QUIC, , AES_128_GCM Server 172.67.176.197 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash `2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df` Request headers Referer https://ticketfinder.xyz/pay/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36 Accept / Content-type text/plain;charset=UTF-8 Response headers access-control-expose-headers * nel {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800} cf-cache-status DYNAMIC report-to {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=V%2F2Nml6gB%2FV4WHNUn0E9PfAg5npORAOSvWyykjf85EqtUImEwZJC1ha2QYHez5HUVnB4yJ8dm6Arc4K2Lu9qFOVZiFhwhz%2F95Zl8avV7JAPF0eJUtdK7vjyT9NKM4xW9ibfu"}]} cf-ray 9e492b618f2a8eb6-YYZ access-control-allow-origin * alt-svc h3=":443"; ma=86400 content-length 2 server-timing cfExtPri date Mon, 30 Mar 2026 18:27:37 GMT content-type text/plain; charset=UTF-8 vary origin, access-control-request-method, access-control-request-headers server cloudflare priority u=1,i
GET H3	200	2be4347a-9c91-42ff-b358-7fb500068b74.js Show response ticketfinder.xyz/websites/71f3356a-1bda-4668-b3da-fb2deb1ff84f/fae7aedc-8c0e-40d0-abae-ede4a257ce32/assets/hacker-inject/ Frame 26AF	7 KB 3 KB	30ms 29ms	Script application/javascript	172.67.176.197 Cloudflare
General Check archive.org Download Go to Full URL https://ticketfinder.xyz/websites/71f3356a-1bda-4668-b3da-fb2deb1ff84f/fae7aedc-8c0e-40d0-abae-ede4a257ce32/assets/hacker-inject/2be4347a-9c91-42ff-b358-7fb500068b74.js Requested by Host: ticketfinder.xyz URL: https://ticketfinder.xyz/websites/71f3356a-1bda-4668-b3da-fb2deb1ff84f/fae7aedc-8c0e-40d0-abae-ede4a257ce32/index.html Protocol H3 Security QUIC, , AES_128_GCM Server 172.67.176.197 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash `bb7612e55eff2d959704dd82cbbc735de0565914a548636d965f360159b1973b` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36 Referer Response headers nel {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800} cache-control max-age=14400 content-encoding zstd cf-cache-status HIT etag W/"69c18a97-1d6e" age 728 report-to {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=faKuVRlWDxkY8ltg9A5nzIvVSZWmfmpmbUzCreRuXtMErgOVcoER8pSY2zgGWZ8qtE4bEtgE3B7jDpcBVGAVK29oWYJnEqPbFFZH5rSdHp3AEcrpyKlzb0AAVH8mkZBm17ya"}]} cf-ray 9e492b619f2c8eb6-YYZ alt-svc h3=":443"; ma=86400 server-timing cfExtPri date Mon, 30 Mar 2026 18:27:37 GMT content-type application/javascript last-modified Mon, 23 Mar 2026 18:46:47 GMT server cloudflare priority u=1,i=?0
GET H2	200	v8c78df7c7c0f484497ecbca7046644da1771523124516 Show response static.cloudflareinsights.com/beacon.min.js/ Frame 26AF	30 KB 0	0ms 0ms	Script text/javascript	104.16.80.73 Cloudflare
General Check archive.org Download Go to Full URL https://static.cloudflareinsights.com/beacon.min.js/v8c78df7c7c0f484497ecbca7046644da1771523124516 Requested by Host: ticketfinder.xyz URL: https://ticketfinder.xyz/websites/71f3356a-1bda-4668-b3da-fb2deb1ff84f/fae7aedc-8c0e-40d0-abae-ede4a257ce32/index.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.16.80.73 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash `4b77eae349a8cbcea7133cf3640a64ebf1f69d54d8f6469d7be6fdc188ca4ca4` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36 Origin https://ticketfinder.xyz Referer Response headers cache-control public, max-age=86400 content-encoding gzip etag W/"2026.2.0" cross-origin-resource-policy cross-origin cf-ray 9e492b5fbd0bac33-YYZ access-control-allow-origin * date Mon, 30 Mar 2026 18:27:37 GMT content-type text/javascript;charset=UTF-8 last-modified Thu, 19 Feb 2026 17:45:24 GMT server cloudflare
GET DATA	200 OK	truncated / Frame 26AF	9 KB 0		Image image/png
General Check archive.org Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `d35751ec40ed7074330984f206ddd9603e1454632310492286f294ae3e5aac8e` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36 Referer Response headers Content-Type image/png
GET DATA	200 OK	truncated / Frame 26AF	5 KB 0		Image image/jpeg
General Check archive.org Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `0d2ce536b0c8920080d8967bec3258e2c512657d6ecb0b2ce24640f5531e5b75` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36 Referer Response headers Content-Type image/jpeg
GET H2	200	v8c78df7c7c0f484497ecbca7046644da1771523124516 Show response static.cloudflareinsights.com/beacon.min.js/ Frame 26AF	30 KB 0	0ms 0ms	Script text/javascript	104.16.80.73 Cloudflare
General Check archive.org Download Go to Full URL https://static.cloudflareinsights.com/beacon.min.js/v8c78df7c7c0f484497ecbca7046644da1771523124516 Requested by Host: ticketfinder.xyz URL: https://ticketfinder.xyz/websites/71f3356a-1bda-4668-b3da-fb2deb1ff84f/fae7aedc-8c0e-40d0-abae-ede4a257ce32/index.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.16.80.73 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash `4b77eae349a8cbcea7133cf3640a64ebf1f69d54d8f6469d7be6fdc188ca4ca4` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36 Origin https://ticketfinder.xyz Referer Response headers cache-control public, max-age=86400 content-encoding gzip etag W/"2026.2.0" cross-origin-resource-policy cross-origin cf-ray 9e492b5fbd0bac33-YYZ access-control-allow-origin * date Mon, 30 Mar 2026 18:27:37 GMT content-type text/javascript;charset=UTF-8 last-modified Thu, 19 Feb 2026 17:45:24 GMT server cloudflare
GET DATA	200 OK	truncated / Frame 26AF	15 KB 15 KB		Font font/woff2
General Check archive.org Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `60f9b5203842a4fe2d52f7c96f3c57b755bbf8f347535469739bcc6f95a9c4b5` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36 Origin https://ticketfinder.xyz Referer Response headers Content-Type font/woff2
GET DATA	200 OK	truncated / Frame 26AF	16 KB 16 KB		Font font/woff2
General Check archive.org Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `f164941997fbc7f7ed7d2a7c3e86b997d647f1910d93fdc2462dd86fd5affa48` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36 Origin https://ticketfinder.xyz Referer Response headers Content-Type font/woff2
POST		rum ticketfinder.xyz/cdn-cgi/ Frame 286D	0 0

POST H3	204	rum Show response ticketfinder.xyz/cdn-cgi/ Frame 26AF	0 448 B	22ms 21ms	XHR text/plain	172.67.176.197 Cloudflare
General Check archive.org Download Go to Full URL https://ticketfinder.xyz/cdn-cgi/rum? Requested by Host: static.cloudflareinsights.com URL: https://static.cloudflareinsights.com/beacon.min.js/v8c78df7c7c0f484497ecbca7046644da1771523124516 Protocol H3 Security QUIC, , AES_128_GCM Server 172.67.176.197 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36 content-type application/json Referer Response headers access-control-max-age 86400 nel {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800} report-to {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=XuDdBtfExepAL7yzPCmCZGTARq3RGYKk5gGj5BuAjUhrFbwrthmDIR6mkmlp401MVdUzejZh%2FUoPPp7xsFAhHZ0zAbrrbCdr8Vc6lDJCVR9f6YKd9T0xWqqyGGenBzieoSUS"}]} access-control-allow-credentials true access-control-allow-methods POST,OPTIONS cf-ray 9e492b62bf658eb6-YYZ access-control-allow-origin https://ticketfinder.xyz alt-svc h3=":443"; ma=86400 server-timing cfExtPri date Mon, 30 Mar 2026 18:27:38 GMT content-type text/plain vary Origin server cloudflare priority u=1,i

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: www.google.com
URL: https://www.google.com/

Domain: ticketfinder.xyz
URL: https://ticketfinder.xyz/cdn-cgi/rum?

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Government of Manitoba (Government)

5 JavaScript Window variables

These are the non-standard variables defined on the window object. These include var declarations and global functions and can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.google.com/	1970-01-21 17:25:06	Name: NID Value: 530=jDBgSYGTF-G0-EGzlazTISP1-kAZoQ8_Lqfsm_xrCkQMu4ng84c7LKVrDuYjtQm2uhilP39zPx1ar6LJb6J0VPMO6tlKm_QhtfkCFt6HoWCgzgFznpxAbXmocbJnj3DjqiwWshRHO7RjsHiDkc90glJf7WZKGi5JWcAqD1QWKdz5wm738xcBuQ0Y17fcsmRVBD-FnqrP5AwtM_bou5hks51jFAtAHmPYgCgtzA_c

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

static.cloudflareinsights.com
ticketfinder.xyz
www.google.com
ticketfinder.xyz
www.google.com
104.16.80.73
172.67.176.197
0d2ce536b0c8920080d8967bec3258e2c512657d6ecb0b2ce24640f5531e5b75
16fbbc747d658ce4bde2eae27cb9793d424fe0ecf2554f1cf60dc481f49efb34
2271908d440e863d8b18da9457bedf0b965b042e1edcd9c08a6fba9d30e99726
2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df
4b77eae349a8cbcea7133cf3640a64ebf1f69d54d8f6469d7be6fdc188ca4ca4
55cb233cc16ff541256714d7b7c36ed9051a8a28806b472d267fc25e4c72afd6
60f9b5203842a4fe2d52f7c96f3c57b755bbf8f347535469739bcc6f95a9c4b5
66ca38b43dab9031a765ee5674f8fc2b61adc11fa2a237806662e15dde2b0be0
77a4bda4bd2430465394e9fffff96c32a15bb878890c915b323ebd5a55a3c6a2
903889530ea2b1d24b1f7e57486a583651aa3a59e628ed6dc999e0d082c2bffd
98c429a2ad48fa2af8fccab5d5d686e41ace5ced147211b775d3559514a721c6
bb7612e55eff2d959704dd82cbbc735de0565914a548636d965f360159b1973b
bf5d4d473d063bf82e8ae250ea8831b61883a457e064e7f0e007c6dc7835d5fa
c2c185dbd03945c7da8ce8720fe4d48f559586504f7c2d845ca673cc2cda780b
ce0b5ba99a7ee48f215fbca41f1ba8d227626c4d3ce2bb6280e4af4a2e63cf83
d35751ec40ed7074330984f206ddd9603e1454632310492286f294ae3e5aac8e
e1147e3c06de2539517a53ea97978d902fcb625c34b7260aa82dd54fcebdcf1e
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e7f6c011776e8db7cd330b54174fd76f7d0216b612387a5ffcfb81e6f0919683
f164941997fbc7f7ed7d2a7c3e86b997d647f1910d93fdc2462dd86fd5affa48
f1ad62f5aac98d238fb5eb3e38f264480f750b6684437701f9b0c070ed01f96c
fd5f42f43617095d9546bfe88254067470bd72dd823c3aa4bc3b18a3a9c5c2e2

ticketfinder.xyz 172.67.176.197 Malicious Activity! Public Scan Open in urlscan Pro

Internal

Effective Hostname

Submitted URL

Effective URL Pivot

Effective IP

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

IP Lookup

ASN Lookup

IP Lookup

ASN Lookup

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

27 Requests

93 %HTTPS

0 %IPv6

3 Domains

3 Subdomains

3 IPs

1 Countries

315 kBTransfer

1115 kBSize

1 Cookies

0 Outgoing links

Page URL History

Redirected requests

27 HTTP transactions Everything HTML Script Fetch XHR CSS Image Font Expand all 5 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

ticketfinder.xyz
172.67.176.197 Malicious Activity! Public Scan Open in urlscan Pro

Screenshot
Live screenshot

Full Image

27
Requests

93 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

3
IPs

1
Countries

315 kB
Transfer

1115 kB
Size

1
Cookies

27 HTTP transactions
5 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!