Domain security and threat intelligence

predict.courses

Name: predict.courses — PhishDestroy evidence record
Published: 2026-02-22
License: https://creativecommons.org/licenses/by/4.0/

In short

PhishDestroy first recorded predict.courses on 2026-02-22. Stored VirusTotal result: 1/91 engines flagged.

“predict.courses — Crypto Prediction Markets”

Review the evidence

Registrar: Spaceship
Resolved IP: 104.21.45.3Cloudflare, Inc. · CDN
Registered: Feb 17, 2026
First observed: Feb 22, 2026

PhishDestroy assessment Critical

81/100

Evidence score

Availability Last known active Latest stored reachability observation Observed Nov 5, 2026 · 02:58 UTCHTTP probe

Risk signals

VirusTotal detections: 1/91

VirusTotal

1 / 91

engine detections

OTX

community references

URLScan

Malicious

engine verdict · score 97

Page captures

open gallery

Domain age

260 days

registered 2026-02-17 according to RDAP

Reports sent

view timeline

ABUSE NOTICE · 7D+ OPEN Outgoing abuse reports are recorded; the latest stored availability evidence still shows the domain reachable.

Notification and current-status evidence

The sent-report ledger records the first outgoing report at 2026-02-22 16:44:22 UTC. The recorded recipient is abuse@spaceship.com. The latest stored availability evidence still shows the domain reachable; 8 months has elapsed since the first outgoing report.

ICANN RAA §3.18 describes registrar abuse-contact and handling obligations. This section records outgoing timestamps, listed recipients, case identifiers, and later availability. It does not by itself prove receipt, acknowledgement, investigation, remediation, or contractual non-compliance.

Elapsed since first report

8 months

Reports sent

Latest case ID

PD-20260222-D58BE9

Current status

HTTP 200 at latest stored check

Analysis

Domain summary

PhishDestroy first recorded predict.courses on 2026-02-22. Stored VirusTotal result: 1/91 engines flagged. Risk: critical (81/100). Registrar: Spaceship. Status: Last known active. Hosting: Cloudflare, Inc. PhishDestroy sent 1 abuse report. Do not enter credentials or connect a wallet.

Critical

Status: Last known active
VirusTotal: 1 / 91
Scam type (automated label): Impersonation
Hosting: 104.21.45.3Cloudflare, Inc. · CDN
Registrar: Spaceship
Registered: Feb 17, 2026
OTX: 23 community refs
Page captures: 6

Page captures Source results Registration record

Recorded source summary

PhishDestroy stores a record for predict.courses. Source observations are dated separately; missing checks do not establish safety.

A reviewed analysis is not available for this text revision. Consult the dated source records below.

Source evidenceVirusTotal 1 / 91 · OTX 23 references 10 sources

VirusTotal

1 / 91 engine detections

Retrieved / checked: 2026-09-26 04:32:48 · as stored; legacy timezone not established

Open report

DNS blocks

3/14

URLScan

Malicious · engine verdict · score 97

2026-02-22 16:41 UTC

Open report

URLScanOriginal source recordObserved: 2026-02-22 16:41:04 UTC23 fields

Observed: 2026-02-22T16:41:04Z · Retrieved: 2026-10-23T14:43:47Z

Report ID

019c8639-c4a1-7088-9536-b047a48e4c45

Final URL

https://predict.courses/

HTTP response

200

Redirect type

https-only

Redirects

To
https://predict.courses/
From
http://predict.courses/
Status
307

IP address

172.67.207.9

Contacted domains

www.gstatic.com
api.coingecko.com
www.clarity.ms
www.googletagmanager.com
predict-network-ec767-default-rtdb.firebaseio.com
spunkart.com

Contacted IP addresses

172.66.172.219
2a00:1450:4001:80d::2003
20.250.198.32
2a00:1450:4001:818::2008
172.67.207.9

Autonomous systems (ASN)

13335
15169
8075

Server countries

Linked domains

predict.pics
spunk.bet
spunkart.com
www.amazon.com
predict.autos
predict.christmas
predict.garden
predict.makeup
predict.tattoo
predict.boats
predict.yachts
predict.codes
predict.gay
predict.mom
predict.skin
predict.surf
predict.hair
predict.beauty
predict.horse
predict.singles
sell.party
stimulant.wiki
stimulant.doctor
stimulant.shop
stimulant.beauty
stimulant.life
stimulant.guru
stimulant.mom
stimulant.online
stimulant.rest

Document hash

82e666bda7cf0b8345223e1f891e00e44fd800683bd92fbcd6ce05427bad8e85

JavaScript globals

crashReport
gtag
dataLayer
clarity
submitEmail
esc
loadFirebaseSDK
initAuth
loadMarkets
seedMarkets
loadUserData
updateBalanceUI
renderMarkets
filterMarkets
renderMyBets
openBetModal
closeBetModal
selectSide
setAmount
updatePayout
placeBet
connectWallet
closeWalletModal
renderWalletOptions
doConnect
connectDemo
disconnectWallet
onWalletConnected
openDeposit
closeDeposit
switchChain
updateDepositUI
copyAddr
confirmDeposit
openWithdraw
closeWithdraw
switchWithdrawChain
submitWithdraw
toggleUserPanel
openPropose

Cookies

_ga_GVNL11PEGP
_ga

Browser storage keys

myRefCode_courses
visited_courses
wallet_courses
demoBal_courses
session_start_courses
firebase:sentinel
__sak
metaGen_courses
firebase:previous_websocket_failure
liveGen_courses

TLS session and certificate

Subject alternative names: *.predict.courses
predict.courses
Cipher: AES_128_GCM
Issuer: E7
Subject: predict.courses
Protocol: QUIC
Valid until: 2026-05-19 18:10:34 UTC
Valid from: 2026-02-18 18:10:35 UTC

Domain age, days

Registered domain age, days

Certificate age, days

Certificate validity, days

Page requests

Provider verdicts

Engine verdict

Tags: urlscan-ml
urlscan-ml-60c5e22
Score: 97
Malicious: Yes

Overall verdict

Score: 0
Malicious: No

HTTP headers

Server: cloudflare
Content-type: text/html; charset=utf-8
Strict-transport-security: max-age=31536000; includeSubDomains
X-frame-options: DENY
X-content-type-options: nosniff
Referrer-policy: strict-origin-when-cross-origin
Permissions-policy: camera=(), microphone=(), geolocation=()
Priority: u=0,i
Via: 1.1 varnish
X-cache: MISS
X-cache-hits: 0
X-served-by: cache-rtm-ehrd2290038-RTM

Original source fields · JSON

Uuid	019c8639-c4a1-7088-9536-b047a48e4c45
Final url	https://predict.courses/
Status	200
Redirected	https-only
Redirects	[ { "to": "https://predict.courses/", "from": "http://predict.courses/", "status": 307 } ]
Ip	172.67.207.9
Contacted domains	[ "www.gstatic.com", "api.coingecko.com", "www.clarity.ms", "www.googletagmanager.com", "predict-network-ec767-default-rtdb.firebaseio.com", "spunkart.com" ]
Contacted IP addresses	[ "172.66.172.219", "2a00:1450:4001:80d::2003", "20.250.198.32", "2a00:1450:4001:818::2008", "172.67.207.9" ]
Asns	[ "13335", "15169", "8075" ]
Countries	[ "DE", "CH" ]
Linked domains	[ "predict.pics", "spunk.bet", "spunkart.com", "www.amazon.com", "predict.autos", "predict.christmas", "predict.garden", "predict.makeup", "predict.tattoo", "predict.boats", "predict.yachts", "predict.codes", "predict.gay", "predict.mom", "predict.skin", "predict.surf", "predict.hair", "predict.beauty", "predict.horse", "predict.singles", "sell.party", "stimulant.wiki", "stimulant.doctor", "stimulant.shop", "stimulant.beauty", "stimulant.life", "stimulant.guru", "stimulant.mom", "stimulant.online", "stimulant.rest" ]
Document hash	82e666bda7cf0b8345223e1f891e00e44fd800683bd92fbcd6ce05427bad8e85
Globals	[ "crashReport", "gtag", "dataLayer", "clarity", "submitEmail", "esc", "loadFirebaseSDK", "initAuth", "loadMarkets", "seedMarkets", "loadUserData", "updateBalanceUI", "renderMarkets", "filterMarkets", "renderMyBets", "openBetModal", "closeBetModal", "selectSide", "setAmount", "updatePayout", "placeBet", "connectWallet", "closeWalletModal", "renderWalletOptions", "doConnect", "connectDemo", "disconnectWallet", "onWalletConnected", "openDeposit", "closeDeposit", "switchChain", "updateDepositUI", "copyAddr", "confirmDeposit", "openWithdraw", "closeWithdraw", "switchWithdrawChain", "submitWithdraw", "toggleUserPanel", "openPropose" ]
Cookies	[ "_ga_GVNL11PEGP", "_ga" ]
Storage keys	[ "myRefCode_courses", "visited_courses", "wallet_courses", "demoBal_courses", "session_start_courses", "firebase:sentinel", "__sak", "metaGen_courses", "firebase:previous_websocket_failure", "liveGen_courses" ]
Tls	{ "san": [ "*.predict.courses", "predict.courses" ], "cipher": "AES_128_GCM", "issuer": "E7", "subject": "predict.courses", "protocol": "QUIC", "valid_to": "2026-05-19T18:10:34Z", "valid_from": "2026-02-18T18:10:35Z" }
Domain age days	5
Apex age days	5
Tls age days	3
Tls valid days	89
Requests	14
Provider verdicts	{ "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 97, "malicious": true }, "overall": { "score": 0, "malicious": false } }
HTTP headers	{ "server": "cloudflare", "content-type": "text/html; charset=utf-8", "strict-transport-security": "max-age=31536000; includeSubDomains", "x-frame-options": "DENY", "x-content-type-options": "nosniff", "referrer-policy": "strict-origin-when-cross-origin", "permissions-policy": "camera=(), microphone=(), geolocation=()", "priority": "u=0,i", "via": "1.1 varnish", "x-cache": "MISS", "x-cache-hits": "0", "x-served-by": "cache-rtm-ehrd2290038-RTM" }

Separate monitor record · date not recorded

Separate stored monitor snapshot; does not replace the primary report record or establish current availability.

record_source: domain_monitor.urlscan
uuid: 019c8639-c4a1-7088-9536-b047a48e4c45
report_url: https://urlscan.io/result/019c8639-c4a1-7088-9536-b047a48e4c45/
score: null
malicious: null
result_at: null
enriched_at: 2026-03-25T11:30:22Z
source_timestamps: {"urlscan_result_at":null,"urlscan_enriched_at":"2026-03-25 12:30:22"}
timestamp_basis: Europe/Berlin, as used by the existing report; source timestamps are retained verbatim

URLQuery

checked — no detections recorded

2026-02-22 16:44 UTC

Open report

OTX

23 community references

2026-10-27 17:48 UTC

Open report