sso--robinhood-com--aauthh[.]webflow[.]io

Analysis of sso--robinhood-com--aauthh.webflow.io indicates that the site was deliberately crafted to impersonate the Robinhood brand, as confirmed by the page title "Robinhood® Log In | Sign in to Your Account" and the explicit classification as a credential‑phishing operation. The domain resolves to 172.64.151.8, an address owned by Cloudflare (AS13335) and located in the United States. Both authoritative name servers—journey.ns.cloudflare.com and lamar.ns.cloudflare.com—are Cloudflare‑managed, confirming that the infrastructure is provisioned through the provider's edge network. The site used a Google Trust Services / WE1 SSL certificate, which is a legitimate certificate authority, but does not mitigate the malicious intent of the content. HTTP requests return a 403 status code, suggesting that the site is no longer serving content; the current status is listed as offline, and the domain has been taken down from public access.

Historical detection data show that the domain appears on one security blocklist and that PhishDestroy has already flagged it, providing an early indication of its malicious use. VirusTotal scans recorded 17 of 95 security vendors labeling the domain as malicious, reinforcing the consensus that the site poses a threat. Technical fingerprints reveal the use of Cloudflare’s HTTP/3 protocol, a common feature among fast‑response phishing pages hosted on CDN services. Registration details point to MarkMonitor, Inc. as the registrar, a well‑known entity used by many legitimate brands, which may complicate takedown efforts.

The domain was created on May 08, 2013, a relatively old registration date that does not align with typical short‑lived phishing campaigns, suggesting possible reuse of legacy infrastructure. Defenders should prioritize adding the hostname to DNS‑based blocklists and ensure that outbound connections to the associated IP (172.64.151.8) are denied at the network perimeter.