poker-courses[.]com

The domain poker-courses.com was registered through NiceNIC International Group Co., Limited on 21 February 2026. It is hosted on Cloudflare infrastructure, as indicated by the authoritative nameservers damian.ns.cloudflare.com and fay.ns.cloudflare.com and by the A‑record resolving to 104.21.86.220, which belongs to AS13335 Cloudflare, Inc. in the United States. The web server presents a valid TLS certificate issued by Google Trust Services (WE1) and enforces HTTP Strict Transport Security; traffic is delivered over HTTP/3. An HTTP GET returns status code 200 and the page title reads “Poker-Courses.com | Premium Poker Training & Strategy Courses”, suggesting a facade of legitimate poker instruction services.

VirusTotal reports that three of ninety‑three scanning engines have flagged the domain, and the site is currently listed on a single security blocklist and is blocked by the PhishDestroy feed. The intelligence categorises the activity as a crypto scam, although the specific mechanisms (e.g., wallet addresses, payment demands) have not been publicly disclosed. The domain remains active as of the report date (24 July 2026).

Defenders should treat the domain as malicious, add the host and its IP address to network deny lists, and enable URL filtering to prevent user access. Continuous monitoring of DNS queries for the domain and its associated IP range is advised, as well as periodic re‑scanning with sandbox or AV tools to capture any evolving payloads. Attribution or affiliate infrastructure cannot be determined at this time, so threat‑hunting efforts should focus on outbound connections from compromised browsers that reference the domain.