help-robinhood-logi-n[.]pages[.]dev

The domain help-robinhood-logi-n.pages.dev is currently offline but exhibits several indicators consistent with a brand impersonation campaign targeting Robinhood. Registration data shows the domain was created on February 21, 2026 and is hosted through Cloudflare, Inc., with DNS resolution to IP address 172.66.47.93, which belongs to AS13335 Cloudflare, Inc. in the United States. The domain uses Cloudflare nameservers novalee.ns.cloudflare.com and donald.ns.cloudflare.com, and the TLS certificate is issued by Google Trust Services under the WE1 profile, confirming that HTTPS is properly configured. An HTTP request to the site returns a 403 status code, and the page title presented by the server is "Suspected phishing site | Cloudflare," indicating that Cloudflare’s protective page is being served.

Security telemetry reports a Gridinsoft trust score of 0 out of 100 and records the domain on a single security blocklist. VirusTotal analysis shows that 11 of 93 security vendors have flagged the domain, providing modest but notable detection coverage. Additional defensive services, including PhishDestroy, have listed the domain as blocked. Detected technologies include HTTP/3, HSTS, and Cloudflare’s CDN services.

While the exact content of the site has not been captured, the combination of brand impersonation labeling, low trust score, vendor detections, and blocklist presence suggests malicious intent. Defenders should continue to block the domain at network and DNS layers, monitor for any re‑activation, and consider adding the domain to internal threat intelligence feeds. Ongoing observation of Cloudflare‑hosted infrastructure associated with the IP 172.66.47.93 may reveal further related campaigns.