# PhishDestroy domain threat record: 513275-robinhood.com

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/513275-robinhood.com/
Machine-readable companion: https://phishdestroy.io/domain/513275-robinhood.com/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: unknown
- First observed by PhishDestroy: 2026-10-21 15:25:06 UTC
- Stored record updated: 2026-10-21 16:01:55 UTC
- VirusTotal detections in the stored snapshot: 1/92
- Independent public blocklist matches in the stored snapshot: 2
- Matching public blocklists: MetaMask, SEAL
- Google Safe Browsing stored result: no stored flag

## Stored classification

- Targeted brand: Robinhood

## Stored infrastructure

- Observed IP address: 104.21.34.62
- Registrar in stored WHOIS data: Dominet (HK) Limited
- Last stored HTTP status: 204

## Evidence links

- URLScan report: https://urlscan.io/result/01a15cad-9309-723d-8ee5-0e4d5126818a/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/513275-robinhood.com
- Certificate Transparency search: https://crt.sh/?q=%25.513275-robinhood.com
- Web Archive lookup: https://web.archive.org/web/*/https://513275-robinhood.com/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
PhishDestroy added 513275-robinhood.com to its blocklist on 2026-10-21 following an automated intake that flagged the domain as malicious based on VirusTotal data. The initial AI assessment could not determine the page’s purpose because the HTTP request returned a 204 status with no content. The domain was first seen by PhishDestroy on the same day it was registered.

How the scam works
The current evidence does not reveal a specific malicious mechanism for this domain. In general, newly‑registered domains that mimic trusted brands can be used to lure users into entering credentials, approving wallet connections, or downloading malicious content, but no such activity was observed on this site.

Evidence
VirusTotal recorded one malicious detection out of 92 engines on 2026-10-21 (Forcepoint ThreatSeeker labeled it phishing), while Google Safe Browsing reported no flag that day. urlscan.io’s engine analysis marked the URL as malicious with a score of 26, though its overall verdict was clean. The domain appears on external blocklists MetaMask and SEAL, and OTX listed two pulses referencing it. PhishDestroy added the domain to its internal blocklist on 2026-10-21.

Infrastructure
The domain was registered with Dominet (HK) Limited on 2026-10-21 and is set to expire on 2027-10-21. The recorded DNS entries listed Cloudflare IP addresses 104.21.34.62 (CA) and 172.67.199.16, and the observed TLS certificate from Let’s Encrypt was valid until 2027-01-19. Nameservers are anuj.ns.cloudflare.com and maisie.ns.cloudflare.com, with DNSSEC not enabled.

What to do
Users should avoid entering any credentials or approving wallet actions on this domain and consider changing passwords if any data was submitted. Security teams can block the exact domain name in web filters and monitor network logs for connections to the listed Cloudflare IPs.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a15cad-9309-723d-8ee5-0e4d5126818a/
Cloudflare Radar report: https://radar.cloudflare.com/scan/5818e5a6-5ece-4ceb-9956-f9b790098b31
Stored capture screenshot: https://urlscan.io/screenshots/01a15cad-9309-723d-8ee5-0e4d5126818a.png
Cloudflare Radar screenshot (2026-10-21T15:25:51Z): https://screenshots.phishdestroy.io/cf/5818e5a6-5ece-4ceb-9956-f9b790098b31.png
VirusTotal report: https://www.virustotal.com/gui/domain/513275-robinhood.com
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=513275-robinhood.com
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-21 16:01:11 UTC

## Stored page captures

- Primary capture: https://urlscan.io/screenshots/01a15cad-9309-723d-8ee5-0e4d5126818a.png
  Captured: 2026-10-21 15:25:06 UTC
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/5818e5a6-5ece-4ceb-9956-f9b790098b31.png
  Captured: 2026-10-21 15:25:51 UTC
  Source report: https://radar.cloudflare.com/scan/5818e5a6-5ece-4ceb-9956-f9b790098b31
  SHA-256: 5b685b6fd0c356b8389e33596a40c60d2f63ca6aac5f9ec6250f109105361924

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-21T15:26:13Z",
        "uuid": "01a15cad-9309-723d-8ee5-0e4d5126818a",
        "scanned_at": "2026-10-21T04:17:54Z",
        "final_url": "https://513275-robinhood.com/",
        "status": 204,
        "redirected": "https-only",
        "ip": "172.67.199.16",
        "ips": [
            "172.67.199.16"
        ],
        "asns": [
            "13335"
        ],
        "tls": {
            "san": [
                "*.513275-robinhood.com",
                "513275-robinhood.com"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "YE1",
            "subject": "513275-robinhood.com",
            "protocol": "QUIC",
            "valid_to": "2027-01-19T03:16:41Z",
            "valid_from": "2026-10-21T03:16:42Z"
        },
        "domain_age_days": 0,
        "apex_age_days": 0,
        "tls_age_days": 0,
        "tls_valid_days": 89,
        "requests": 1,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 26,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "server": "cloudflare",
            "x-frame-options": "SAMEORIGIN",
            "x-content-type-options": "nosniff",
            "referrer-policy": "strict-origin"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-21T15:26:15Z",
        "uuid": "5818e5a6-5ece-4ceb-9956-f9b790098b31",
        "scanned_at": "2026-10-21T15:25:51Z",
        "final_url": "https://513275-robinhood.com/",
        "status": 204,
        "history": [
            {
                "url": "https://513275-robinhood.com/",
                "status": 204
            }
        ],
        "dom_hash": "a7fe83ec64bb23eb28090598db3d166ed98e52e39d1afbbfd74c579553f93e4e",
        "domain_risks": [
            "Newly Seen Domains",
            "Security Risks"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "513275-robinhood.com",
                "type": "A",
                "value": "172.67.199.16"
            },
            {
                "name": "513275-robinhood.com",
                "type": "A",
                "value": "104.21.34.62"
            },
            {
                "name": "513275-robinhood.com",
                "type": "AAAA",
                "value": "2606:4700:3032::ac43:c710"
            },
            {
                "name": "513275-robinhood.com",
                "type": "AAAA",
                "value": "2606:4700:3032::6815:223e"
            }
        ],
        "dnssec_valid": false,
        "ip": "172.67.199.16",
        "whois": {
            "registrar": "Dominet (HK) Limited",
            "created": "2026-10-21T04:01:36Z",
            "updated": "2026-10-21T04:12:40Z",
            "expires": "2027-10-21T04:01:36Z",
            "nameservers": [
                "anuj.ns.cloudflare.com",
                "maisie.ns.cloudflare.com"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-21T15:59:01Z",
        "analysis_at": "2026-10-21T15:09:08Z",
        "stats": {
            "timeout": 0,
            "harmless": 53,
            "malicious": 1,
            "suspicious": 0,
            "undetected": 38
        },
        "detections": {
            "Forcepoint ThreatSeeker": "phishing"
        },
        "reputation": 0,
        "tags": [
            "dga"
        ],
        "registrar": "Dominet (HK) Limited",
        "created": "2026-10-21T04:01:36Z",
        "expires": "2027-10-21T04:01:36Z",
        "updated": "2026-10-21T04:12:40Z",
        "first_seen": "2026-10-21T05:11:50Z",
        "dns": [
            {
                "ttl": 300,
                "type": "A",
                "value": "104.21.34.62"
            },
            {
                "ttl": 1800,
                "type": "SOA",
                "rname": "dns.cloudflare.com",
                "value": "anuj.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "172.67.199.16"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "maisie.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3032::6815:223e"
            },
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3032::ac43:c710"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "anuj.ns.cloudflare.com"
            }
        ],
        "dns_at": "2026-10-21T15:17:28Z",
        "jarm": "27d40d40d00040d1dc42d43d00041d6183ff1bfae51ebd88d70384363d525c",
        "cert": {
            "san": [
                "*.513275-robinhood.com",
                "513275-robinhood.com"
            ],
            "issuer": "Let's Encrypt / YE1",
            "serial": "660336a79327b31b350cb77be60dfbe28b",
            "sha256": "037f27b3d5b64f7224533a76ec96583e5e08888e17647b3ce1e2f984ce2e4997",
            "subject": "513275-robinhood.com",
            "valid_to": "2027-01-19T03:16:41Z",
            "valid_from": "2026-10-21T03:16:42Z"
        },
        "whois": {
            "registrar": "Dominet (HK) Limited",
            "registrar_iana_id": "3775",
            "registrar_url": "http://www.alibabacloud.com",
            "created": "2026-10-21T04:01:36Z",
            "updated": "2026-10-21T04:01:36Z",
            "expires": "2027-10-21T04:01:36Z",
            "status": [
                "ok"
            ],
            "nameservers": [
                "anuj.ns.cloudflare.com",
                "maisie.ns.cloudflare.com",
                "paul.ns.cloudflare.com",
                "rihana.ns.cloudflare.com"
            ],
            "dnssec": "unsigned"
        },
        "rdap": {
            "status": [
                "active"
            ],
            "events": {
                "expiration": "2027-10-21T04:01:36Z",
                "registration": "2026-10-21T04:01:36Z",
                "registrar expiration": "2027-10-21T04:01:36Z",
                "last update of RDAP database": "2026-10-21T04:01:37Z"
            }
        }
    },
    "webcheck": {
        "v": 1,
        "fetched_at": "2026-10-21T15:26:35Z",
        "mail_config": {
            "spf_lookups": 0
        },
        "caa_records": {
            "domain": "513275-robinhood.com"
        },
        "block_lists": {
            "resolvers": 12,
            "blocked_count": 0
        },
        "mixed_content": {
            "third_party_scripts": 0
        },
        "status": {
            "up": true,
            "code": 204,
            "timings": {
                "dns": 3,
                "tls": 59,
                "wait": 544,
                "connect": 6,
                "download": 0
            },
            "response_ms": 612
        },
        "tls_connection": {
            "alpn": "h2",
            "cipher": "TLS_AES_256_GCM_SHA384",
            "protocol": "TLSv1.3",
            "versions": [
                "TLSv1",
                "TLSv1.1",
                "TLSv1.2",
                "TLSv1.3"
            ],
            "authorized": true,
            "forward_secrecy": true
        },
        "ports": {
            "open": [
                80,
                443,
                8080
            ]
        },
        "dns_server": {
            "ns": [
                {
                    "ip": "108.162.194.89",
                    "host": "maisie.ns.cloudflare.com"
                },
                {
                    "ip": "173.245.59.65",
                    "host": "anuj.ns.cloudflare.com"
                }
            ],
            "zone": "513275-robinhood.com"
        },
        "location": {
            "ip": "2606:4700:3032::ac43:c710",
            "asn": "13335",
            "org": "Cloudflare, Inc.",
            "city": "Toronto",
            "country": "CA"
        },
        "ssl": {
            "issuer": "Let's Encrypt / YE1",
            "subject": "513275-robinhood.com"
        },
        "dns": {
            "A": [
                "172.67.199.16",
                "104.21.34.62"
            ],
            "NS": [
                "anuj.ns.cloudflare.com",
                "maisie.ns.cloudflare.com"
            ],
            "SOA": "{\"nsname\": \"anuj.ns.cloudflare.com\", \"hostmaster\": \"dns.cloudflare.com\", \"serial\": 2418041816, \"refresh\": 10000, \"retry\": 2400, \"expire\": 604800, \"minttl\": 1800}",
            "AAAA": [
                "2606:4700:3032::6815:223e",
                "2606:4700:3032::ac43:c710"
            ]
        },
        "dnssec": {
            "ds": false,
            "rrsig": false,
            "dnskey": false
        },
        "hsts": {
            "message": "Site does not serve any HSTS headers."
        },
        "http_security": {
            "xFrameOptions": "SAMEORIGIN",
            "referrerPolicy": "strict-origin",
            "xXSSProtection": false,
            "permissionsPolicy": false,
            "xContentTypeOptions": "nosniff",
            "contentSecurityPolicy": false,
            "strictTransportPolicy": false,
            "crossOriginOpenerPolicy": false,
            "crossOriginEmbedderPolicy": false,
            "crossOriginResourcePolicy": false
        },
        "firewall": {
            "waf": "Cloudflare",
            "has_waf": true
        },
        "get_ip": {
            "ip": "2606:4700:3032::ac43:c710",
            "family": 6
        },
        "redirects": {
            "chain": [
                "https://513275-robinhood.com"
            ]
        },
        "tech_stack": {
            "technologies": [
                "Cloudflare",
                "HTTP/3"
            ]
        },
        "whois": {
            "registrar": "Dominet (HK) Limited",
            "created": "2026-10-21T04:01:36Z",
            "updated": "2026-10-21T04:12:40Z",
            "expires": "2027-10-21T04:01:36Z",
            "status": [
                "ok https://icann.org/epp"
            ],
            "nameservers": [
                "anuj.ns.cloudflare.com",
                "maisie.ns.cloudflare.com"
            ]
        },
        "headers": {
            "headers": {
                "server": "cloudflare",
                "x-frame-options": "SAMEORIGIN",
                "x-content-type-options": "nosniff",
                "referrer-policy": "strict-origin"
            }
        }
    }
}
```