roobet-canada[.]ca

Analysis of roobet-canada.ca indicates a high‑risk credential phishing operation. The domain was registered on February 21, 2026 through CENTRALNIC CANADA INC and resolves to 172.67.157.203, an address owned by AS13335 Cloudflare, Inc. The hosting infrastructure places the service in the United States, consistent with observed Cloudflare edge nodes. HTTP requests return a 403 status, suggesting that access is being denied or filtered, which may be a defensive response or an intentional block page. The page title returned by the server is "Roobet — Login, Welcome package up to 100%", a phrasing commonly used to lure victims into submitting credentials.

VirusTotal scans show three of ninety‑three security vendors flagging the domain, providing independent confirmation of malicious intent. The domain appears on three public blocklists and is actively blocked by PhishDestroy, MetaMask, and SEAL, further reinforcing its classification as a phishing site. Gridinsoft assigns a trust score of 0 out of 100, indicating no perceived legitimacy. The SSL certificate is issued for roobet-canada.ca, but no additional validation details are available.

Nameservers pns21.cloudns.net through pns24.cloudns.net are in use, a configuration often observed in fast‑flux or disposable hosting setups. Uncertainties remain regarding the exact content served, the presence of credential‑harvesting forms, and any post‑compromise payloads, as no direct page capture has been supplied. Defenders should immediately block the domain at DNS and proxy layers, add it to URL filtering and email security policies, and monitor for any related C2 traffic originating from the Cloudflare IP range. Continuous re‑scanning with multi‑engine services is advised to capture any changes in the domain’s behavior.