robienhood-login[.]pages[.]dev

The domain robienhood-login.pages.dev was identified as a brand impersonation site specifically targeting Robinhood users. Classified as an elevated risk phishing threat, the domain is currently offline, having been taken down after its malicious intent was confirmed. The site attempted to deceive visitors by mimicking the Robinhood login interface, likely to steal account credentials and financial information.

According to threat intelligence, this domain was flagged by 2 of 95 VirusTotal security vendors, and it appeared on one security blocklist. The domain was registered through Cloudflare, Inc. on September 18, 2025, and resolved to IP address 172.66.47.52. Its SSL certificate was issued by Google Trust Services (WE1), and the page title was observed as "UpholdPortal.com — Professional & Centralized Account Hub," a deceptive name unrelated to the actual Robinhood brand. Despite the low detection rate, the combination of brand impersonation and recent registration heightened the risk.

Users who may have encountered this site should immediately change their Robinhood passwords and enable two-factor authentication if not already active. It is also advisable to monitor financial accounts for any unauthorized activity. PhishDestroy recommends always verifying URLs before entering login credentials and reporting suspicious domains to security teams. The domain's takedown is a positive outcome, but similar threats may emerge, so continued vigilance is essential.