steroids-canada[.]cc

Analysis indicates that steroids-canada.cc is an active high-risk domain associated with fraudulent online pharmacy activity. The domain was registered on March 26, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, and currently resolves to IP address 172.67.132.166, hosted on Cloudflare infrastructure in Canada. The page title, 'Steroids Canada - Buy Authentic Steroids Online in Canada. Stress Free,' suggests the site is targeting users seeking controlled substances, a common vector for financial fraud and counterfeit product distribution. Infrastructure review reveals the domain uses Cloudflare nameservers (dale.ns.cloudflare.com and jill.ns.cloudflare.com) and presents a 301 HTTP redirect, which may indicate traffic redirection to another endpoint or evasion of detection. MX records point to ProtonMail servers (mail.protonmail.ch and others), a pattern observed in phishing operations leveraging encrypted email services to obscure communication. The SSL certificate is issued by Google Trust Services (WE1), providing HTTPS encryption but not validating legitimacy. Security telemetry shows the domain is flagged by two of 94 security vendors on VirusTotal and appears on at least one security blocklist, including PhishDestroy. AlienVault OTX records it in one threat intelligence pulse, confirming its presence in active threat tracking. The Gridinsoft trust score of 0/100 further supports classification as malicious. Defenders should treat this domain as confirmed phishing infrastructure targeting users under the guise of an online steroid retailer. Blocking at the DNS or network level is recommended. While the exact content and backend operations remain unanalyzed, the combination of registration details, hosting patterns, and security flags provides sufficient evidence for immediate containment. Further investigation may reveal additional redirection targets or associated fraudulent domains.