pokiesurf2[.]com

The domain pokiesurf2.com was registered on April 28, 2026 and is currently resolving to the Cloudflare edge address 172.67.139.23, which maps to a server located in Canada owned by Cloudflare, Inc. The site is served over HTTPS using a Let’s Encrypt certificate (E7) and returns HTTP 200 for the landing page. Its authoritative name servers are miki.ns.cloudflare.com and wesley.ns.cloudflare.com, reflecting typical Cloudflare hosting.

Content analysis shows the landing page title “Pokiesurf Casino in Australia: Play 700+ Online Pokies with a $5000 Bonus”, matching a classic gambling lure. The page is built with the publicly known Gambler Scam phishing kit. Threat intelligence sources have recorded the domain in a single AlienVault OTX pulse and one security blocklist. VirusTotal reports a single positive out of 95 scanners, and Gridinsoft assigns a trust score of 0 out of 100, indicating a high confidence of malicious intent. PhishDestroy has already blocked the site.

While the current evidence confirms malicious intent, the limited number of detections (one OTX pulse, one blocklist entry) suggests the campaign may be in early stages or targeted at a narrow audience. No additional infrastructure such as command‑and‑control servers or payload hosting has been observed, and no definitive attribution to a threat actor group is available.

Defenders should immediately block DNS resolution for pokiesurf2.com and any subdomains, and add the IP 172.67.139.23 to network‑level deny lists. Email gateways should be updated to flag messages containing the page title or references to “Pokiesurf Casino” to prevent credential harvest. Continuous monitoring of Cloudflare‑hosted domains that use similar gambling‑related titles is advised, as the operators may spin up new domains using the same kit.