# PhishDestroy domain threat record: gp-sso-robinhood-com-help.webflow.io Content language: English Canonical HTML report: https://phishdestroy.io/domain/gp-sso-robinhood-com-help.webflow.io/ Machine-readable companion: https://phishdestroy.io/domain/gp-sso-robinhood-com-help.webflow.io/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: not observed active - First observed by PhishDestroy: 2026-09-11 09:47:59 UTC - Last availability or vendor check: 2026-10-21 01:16:01 UTC - Stored record updated: 2026-10-22 14:22:30 UTC - VirusTotal detections in the stored snapshot: 16/89 - Independent public blocklist matches in the stored snapshot: 2 - Matching public blocklists: MetaMask, SEAL - Google Safe Browsing stored result: no stored flag ## Stored classification - Targeted brand: Robinhood ## Stored infrastructure - Observed IP address: 104.18.36.248 - Registrar in stored WHOIS data: Webflow - Registrar country in stored WHOIS data: US - Last stored HTTP status: 404 - Registration date (registry RDAP, webflow.io): 2013-05-08 02:20:57 UTC ## Evidence links - VirusTotal domain view: https://www.virustotal.com/gui/domain/gp-sso-robinhood-com-help.webflow.io - Certificate Transparency search: https://crt.sh/?q=%25.gp-sso-robinhood-com-help.webflow.io - Web Archive lookup: https://web.archive.org/web/*/https://gp-sso-robinhood-com-help.webflow.io/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview This Webflow-hosted site impersonated Robinhood. Its hostname strings together "sso", "robinhood-com" and "help" so it reads like an official single sign-on or support page. It targeted Robinhood customers, including those holding crypto on the platform. PhishDestroy first flagged it on 2026-09-11. The site has been offline since 2026-09-19 and was still dead when last checked on 2026-10-19. How the scam works Pages like this present a copy of a brand's login or support flow. Victims usually arrive from a link sent as an urgent account or security notice. Anything typed there, such as email, password, one-time 2FA codes or recovery details, goes to the operators. They can then log into the real Robinhood account and move funds or crypto out. The page now returns the title "404 - Page not found", which differs from the impersonation we classified. Evidence On 2026-09-20, 16 of 89 VirusTotal engines flagged the site, a meaningful share for a short-lived free subdomain. The vendors include ChainPatrol, alphaMountain.ai, BitDefender, CyRadar, ESET, Emsisoft, Forcepoint ThreatSeeker and Fortinet. ChainPatrol focuses on crypto threats, and its flag lines up with the crypto-oriented blocklists that list the site. Beyond PhishDestroy, it appears on the MetaMask and SEAL blocklists, which warn wallet users and security responders about known scam addresses. Infrastructure The operators built the page on a free webflow.io subdomain rather than registering their own domain. That choice is cheap and quick to discard, and it lets the page borrow Webflow's reputation. Traffic resolved to 104.18.36.248 on the Cloudflare, Inc. network, geolocated to CA. The page went dark eight days after PhishDestroy first saw it, a short lifespan typical of disposable phishing pages. What to do If you entered your Robinhood login on this page, change your password right away from the official app or by typing the address yourself. Reset 2FA, then review linked devices and active sessions. Check recent orders, transfers and crypto withdrawals, and contact Robinhood support immediately if anything is unfamiliar. Change the password anywhere else you reused it, and treat any follow-up "support" call or message as part of the same scam. Defenders should block the domain, watch for other webflow.io subdomains combining "robinhood" with "sso" or "help", and report new copies to the hosting platform. Useful links VirusTotal report: https://www.virustotal.com/gui/domain/gp-sso-robinhood-com-help.webflow.io Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=gp-sso-robinhood-com-help.webflow.io Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-19 10:19:43 UTC ## Stored page captures - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/496edfed-07a9-4b05-90d3-5471c6acdbaf.png Captured: 2026-09-20 16:58:54 UTC Source report: https://radar.cloudflare.com/scan/496edfed-07a9-4b05-90d3-5471c6acdbaf SHA-256: a380e448eb3101674f4c67f891f37ba29b76e79d0bcca3163d4b1510d947431b ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "cf": { "v": 1, "fetched_at": "2026-10-20T22:34:27Z", "uuid": "496edfed-07a9-4b05-90d3-5471c6acdbaf", "scanned_at": "2026-09-20T16:58:54Z", "final_url": "https://gp-sso-robinhood-com-help.webflow.io/", "status": 404, "history": [ { "url": "https://gp-sso-robinhood-com-help.webflow.io/", "status": 404 } ], "dom_hash": "4932075438459d054af6b75a0d6585b123ae775f36579c095159b2af33360488", "doc_hash": "90c032f35272ba1a7aa93027ab635e6610d4f24cf9e53c0624d00f065d7c7e7d", "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "gp-sso-robinhood-com-help.webflow.io", "type": "A", "value": "172.64.151.8" }, { "name": "gp-sso-robinhood-com-help.webflow.io", "type": "A", "value": "104.18.36.248" }, { "name": "gp-sso-robinhood-com-help.webflow.io", "type": "AAAA", "value": "2a06:98c1:3102::ac40:9708" }, { "name": "gp-sso-robinhood-com-help.webflow.io", "type": "AAAA", "value": "2a06:98c1:3105::6812:24f8" } ], "dnssec_valid": false, "ip": "172.64.151.8", "whois": { "registrar": "MarkMonitor Inc.", "created": "2013-05-08T02:20:57Z", "updated": "2026-08-12T04:04:30Z", "expires": "2028-05-08T02:20:57Z", "nameservers": [ "lamar.ns.cloudflare.com", "journey.ns.cloudflare.com" ] } }, "vt": { "v": 1, "fetched_at": "2026-10-22T06:17:03Z", "analysis_at": "2026-09-12T00:16:25Z", "stats": { "timeout": 0, "harmless": 50, "malicious": 7, "suspicious": 0, "undetected": 35 }, "detections": { "Webroot": "malicious", "Emsisoft": "phishing", "Fortinet": "phishing", "Netcraft": "malicious", "Kaspersky": "phishing", "LevelBlue": "phishing", "ChainPatrol": "malicious" }, "reputation": 0, "tags": [ "dga" ], "categories": { "alphaMountain.ai": "Phishing (alphaMountain.ai)" }, "registrar": "MarkMonitor Inc.", "created": "2013-05-08T02:20:57Z", "expires": "2028-05-08T02:20:57Z", "updated": "2026-08-12T04:04:30Z", "first_seen": "2026-09-11T09:47:50Z", "dns": [ { "ttl": 300, "type": "A", "value": "104.18.36.248" }, { "ttl": 300, "type": "AAAA", "value": "2a06:98c1:3105::6812:24f8" }, { "ttl": 300, "type": "AAAA", "value": "2a06:98c1:3102::ac40:9708" }, { "ttl": 300, "type": "A", "value": "172.64.151.8" } ], "dns_at": "2026-09-12T00:16:48Z", "jarm": "27d27d27d00027d00042d43d00041df04c41293ba84f6efe3a613b22f983e6", "cert": { "san": [ "webflow.io", "*.webflow.io" ], "issuer": "Google Trust Services / WE1", "serial": "7e5a9322f440be460e62bc877c41833c", "sha256": "a4ffdefa8d99689893e2aafdf9588b6f8f2f8ec47698ea534dbfa409dbbde19d", "subject": "webflow.io", "valid_to": "2026-10-23T03:21:05Z", "valid_from": "2026-07-25T02:21:21Z" }, "whois": { "registrar": "MarkMonitor Inc.", "registrar_iana_id": "292", "registrar_url": "http://www.markmonitor.com", "created": "2013-05-08T02:20:57Z", "updated": "2025-02-25T20:53:31Z", "expires": "2028-05-08T02:20:57Z", "status": [ "clientDeleteProhibited", "clientTransferProhibited", "clientUpdateProhibited" ], "nameservers": [ "journey.ns.cloudflare.com", "lamar.ns.cloudflare.com" ], "dnssec": "unsigned" } } } ```