customwhitelistwallet[.]online

This domain is flagged for elevated-risk brand impersonation, specifically targeting Robinhood users through a fraudulent wallet whitelist scheme. Analysis indicates the infrastructure was designed to deceive victims into believing they were accessing an official Robinhood service, likely for credential harvesting or unauthorized fund transfers. Infrastructure analysis reveals the domain customwhitelistwallet.online was registered on February 21, 2026, and resolved to IP address 188.114.97.3 (AS13335 Cloudflare, Inc., US). Security vendor detections on VirusTotal reached 18/95, with the domain appearing on at least one security blocklist. The page title, 'Wallet Whitelist Robinhood Wallet,' directly references the targeted brand, and the SSL certificate was issued under the WE1 trust provider. The domain has since been taken offline, but residual risks may persist for users who interacted with it. Mitigation steps for this type of threat include immediate credential rotation for any accounts accessed via the domain, particularly financial accounts. Organizations should implement domain monitoring to detect similar impersonation attempts, focusing on newly registered domains containing brand names or financial service keywords. Users should verify domain authenticity through official channels before entering sensitive information, and security teams should update blocklists to include this domain and its associated indicators of compromise.