robinhood-invests-log-in[.]webflow[.]io

This domain, robinhood-invests-log-in.webflow.io, poses a high-risk brand impersonation threat targeting Robinhood users. The site mimics the legitimate Robinhood login interface, tricking visitors into entering their credentials. Once submitted, these credentials are harvested by threat actors, enabling unauthorized access to financial accounts, potential fund transfers, or identity theft. The page title, 'robinhood invests log in,' reinforces the deception by closely resembling official Robinhood branding, increasing the likelihood of successful credential theft. Analysis indicates this domain is part of a coordinated phishing infrastructure. The domain was created on March 06, 2026, and is registered through MarkMonitor, Inc., a registrar commonly used for both legitimate and malicious domains. It resolves to the IP address 172.64.151.8, hosted on Cloudflare's network (AS13335), which is frequently leveraged to obscure the true origin of phishing sites. VirusTotal detections show that 20 out of 95 security vendors flag this domain as malicious, while Google Safe Browsing classifies it as phishing. Additionally, the domain appears on one security blocklist, and its SSL certificate is issued by Google Trust Services, further masking its malicious intent under a veneer of legitimacy. Individuals who visited this domain or entered credentials should take immediate action to mitigate risk. First, change the password for the affected Robinhood account and enable multi-factor authentication if not already active. Monitor the account for unauthorized transactions or suspicious activity, and report any anomalies to the financial service provider. If personal or financial information was submitted, consider placing a fraud alert or credit freeze with major credit bureaus to prevent identity theft. Finally, scan the device used to access the site for malware, as phishing pages may deploy additional payloads to compromise the system further.