# PhishDestroy domain threat record: robinhoodilogin.tilda.ws

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/robinhoodilogin.tilda.ws/
Machine-readable companion: https://phishdestroy.io/domain/robinhoodilogin.tilda.ws/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-09-11 09:51:07 UTC
- Last availability or vendor check: 2026-10-23 10:07:29 UTC
- Stored record updated: 2026-10-23 18:22:29 UTC
- VirusTotal detections in the stored snapshot: 9/89
- Independent public blocklist matches in the stored snapshot: 2
- Matching public blocklists: MetaMask, SEAL
- Google Safe Browsing stored result: no stored flag

## Stored classification

- Targeted brand: Robinhood

## Stored infrastructure

- Observed IP address: 194.48.203.16
- Registrar in stored WHOIS data: Tilda
- Last stored HTTP status: 403
- Registration date (registry RDAP, tilda.ws): 2014-02-15 10:17:05 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a08cb1-75e4-7706-9ac8-ad2214e3c3ec/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/robinhoodilogin.tilda.ws
- Certificate Transparency search: https://crt.sh/?q=%25.robinhoodilogin.tilda.ws
- Web Archive lookup: https://web.archive.org/web/*/https://robinhoodilogin.tilda.ws/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
robinhoodilogin.tilda.ws is a credential phishing page that impersonates Robinhood. It targets Robinhood customers who might hold stocks or crypto on the platform. The address sits on a free subdomain of the Tilda website builder, and the name splices "robinhood" and "login" together to look like an official sign-in link. PhishDestroy first flagged it on 2026-09-11, and the site was still online on 2026-10-19.

How the scam works
Victims usually arrive from a text, email or ad warning about a locked account, a suspicious trade or a pending withdrawal. The link leads to a page styled as Robinhood's sign-in screen. Anything typed there goes to the operators: email, password and often the one-time 2FA code. They then use those details to log in to the real account and move out funds or crypto before the owner notices. The page currently displays the title "403", while our classification is based on it serving as a Robinhood credential phishing page.

Evidence
On 2026-09-20, 9 of 89 VirusTotal engines flagged the domain as malicious. Those vendors include ChainPatrol, alphaMountain.ai, Emsisoft, Forcepoint ThreatSeeker, Fortinet, Kaspersky, Lionic and Netcraft. That is a modest share of engines, but it combines crypto-focused, general security and anti-phishing vendors. Beyond PhishDestroy, the domain is listed by MetaMask and SEAL. As a result, it is blocked in wallet warnings and in feeds shared across the crypto security community.

Infrastructure
The operators did not register a domain of their own. They used a subdomain on Tilda, a website builder that issues these addresses instantly and at no cost. This makes the page cheap to set up and easy to replace with a new name once it is taken down. It is served from Tilda's own cloud network (AS205282) in Ireland, which is normal hosting for any site built on that platform.

What to do
If you entered your Robinhood login on this page, change your password right away through the official app and turn on app-based 2FA. Log out of all other active sessions and check your trades, transfers and linked bank accounts for anything you did not authorize. Contact Robinhood support if anything looks wrong. If you reuse that password on other sites, change it there too, and if you ever typed a wallet recovery phrase, move those funds to a new wallet. Defenders should block the subdomain, report it to Tilda for removal, and watch for similar Robinhood-themed names on website-builder platforms.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a08cb1-75e4-7706-9ac8-ad2214e3c3ec/
VirusTotal report: https://www.virustotal.com/gui/domain/robinhoodilogin.tilda.ws
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=robinhoodilogin.tilda.ws
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-19 09:44:23 UTC

## Stored page captures

- Primary capture: https://urlscan.io/screenshots/01a08cb1-75e4-7706-9ac8-ad2214e3c3ec.png
  Captured: 2026-09-11 09:51:07 UTC
- URLScan capture: https://screenshots.phishdestroy.io/01a08cb1-75e4-7706-9ac8-ad2214e3c3ec.png
  Captured: 2026-09-12 03:30:09 UTC
  Source report: https://urlscan.io/result/01a08cb1-75e4-7706-9ac8-ad2214e3c3ec/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/8c6137bd-a141-43eb-bd7f-b87a4472411b.png
  Captured: 2026-09-11 09:53:19 UTC
  Source report: https://radar.cloudflare.com/scan/8c6137bd-a141-43eb-bd7f-b87a4472411b
  SHA-256: 234a242c44323ab7720d8b02987b17f5b5534222c9273e5a582c06f4f3449ba8
- URLScan · 2026-09-10: https://screenshots.phishdestroy.io/us/01a08caf-f5f6-720e-a021-383c1a7a9ad8.png
  Captured: 2026-09-10 18:59:03 UTC
  Source report: https://urlscan.io/result/01a08caf-f5f6-720e-a021-383c1a7a9ad8/
  SHA-256: efd059ffe5e4bbbd31655af07d79407d1161265ece3a8917c7445305871d6465
- URLScan · 2026-09-11: https://screenshots.phishdestroy.io/us/01a08fe6-2ce4-726e-b1e5-d236d75fdf05.png
  Captured: 2026-09-11 09:57:07 UTC
  Source report: https://urlscan.io/result/01a08fe6-2ce4-726e-b1e5-d236d75fdf05/
  SHA-256: 586b95aecceba96e50ef4e90d87a8fd3b3048f3c38eb8ec7226613cc21fddf43

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-21T00:19:23Z",
        "uuid": "01a08cb1-75e4-7706-9ac8-ad2214e3c3ec",
        "scanned_at": "2026-09-10T19:00:41Z",
        "final_url": "https://robinhoodilogin.tilda.ws/",
        "status": 200,
        "ip": "194.48.203.17",
        "domains": [
            "static.tildacdn.info",
            "stat.tildaapi.com",
            "static.tildacdn.com",
            "thumb.tildacdn.com",
            "fonts.gstatic.com",
            "fonts.googleapis.com",
            "stat.tildacdn.com"
        ],
        "ips": [
            "5.101.71.73",
            "192.178.183.94",
            "142.251.110.95",
            "92.223.124.62",
            "185.129.100.115",
            "194.48.203.17"
        ],
        "asns": [
            "201589",
            "15169",
            "199524",
            "57724",
            "205282"
        ],
        "countries": [
            "AM",
            "US",
            "DE",
            "RU",
            "AE"
        ],
        "link_domains": [
            "tilda.cc",
            "help.tilda.cc"
        ],
        "doc_hash": "f1aceadeb856aba043f144f5174f491fcab0f8a610a128e87285073b54755a47",
        "script_hashes": [
            "ba5e83077e988ea458b32054eb388000173427b5eca6e80e7ac56a03b5ce4d23"
        ],
        "globals": [
            "t_onReady",
            "t_onFuncLoad",
            "$",
            "jQuery",
            "t_addClass",
            "t_removeClass",
            "t_removeEl",
            "t_outerWidth",
            "t_throttle",
            "t_debounce",
            "t_checkIsEditMode",
            "t_checkEditorIsReady",
            "t_scrollBarWidthCompensator__setObject",
            "t_scrollBarWidthCompensator__init",
            "t_scrollBarWidthCompensator__checkSize",
            "t_scrollBarWidthCompensator__cancel",
            "t_triggerEvent",
            "t_getRootZone",
            "t_modifyRootZone",
            "t_loadJsFile",
            "t_loadCSSFile",
            "t_scrollTo",
            "t_smoothScrollTo",
            "isSearchBot",
            "isMobile",
            "$isMobile",
            "isTablet",
            "isiOS",
            "isiOSChrome",
            "isFirefox",
            "isOpera",
            "isiOSVersion",
            "isSafari",
            "isIE",
            "isSafariVersion",
            "browserLang",
            "tildaBrowserLang",
            "nojscode",
            "dataLayer",
            "mainTracker"
        ],
        "storage_keys": [
            "visited"
        ],
        "tls": {
            "san": [
                "*.tilda.ws",
                "tilda.ws"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "GlobeSSL RSA DV SSL CA 2",
            "subject": "*.tilda.ws",
            "protocol": "TLS 1.3",
            "valid_to": "2027-01-30T23:59:59Z",
            "valid_from": "2026-07-16T00:00:00Z"
        },
        "domain_age_days": 110,
        "apex_age_days": 3842,
        "tls_age_days": 56,
        "tls_valid_days": 198,
        "requests": 20,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 23,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "content-type": "text/html; charset=UTF-8",
            "x-frame-options": "SAMEORIGIN"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-21T02:32:03Z",
        "uuid": "8c6137bd-a141-43eb-bd7f-b87a4472411b",
        "scanned_at": "2026-09-11T09:53:19Z",
        "final_url": "https://robinhoodilogin.tilda.ws/",
        "status": 404,
        "history": [
            {
                "url": "https://robinhoodilogin.tilda.ws/",
                "status": 404
            }
        ],
        "dom_hash": "6d2dfc121ce1fe8439c110b3f4ffc779a6a525d4e562c128901823496f4b69f3",
        "doc_hash": "0d0f8dab1199f7754dc34194d9e22a3cd0fd42bb5254966050e2bcd00dea5031",
        "url_risks": [
            "Phishing"
        ],
        "domain_risks": [
            "Phishing",
            "Security threats",
            "CIPA Filter",
            "CIPA"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "robinhoodilogin.tilda.ws",
                "type": "A",
                "value": "194.48.203.17"
            },
            {
                "name": "robinhoodilogin.tilda.ws",
                "type": "A",
                "value": "194.48.203.16"
            },
            {
                "name": "robinhoodilogin.tilda.ws",
                "type": "A",
                "value": "194.48.203.15"
            },
            {
                "name": "tilda.ws",
                "type": "A",
                "value": "194.48.203.16"
            },
            {
                "name": "tilda.ws",
                "type": "A",
                "value": "194.48.203.17"
            },
            {
                "name": "tilda.ws",
                "type": "A",
                "value": "194.48.203.15"
            }
        ],
        "dnssec_valid": false,
        "ip": "194.48.203.17",
        "verdict": {
            "tags": [
                "phishing"
            ],
            "malicious": true,
            "categories": [
                "phishing"
            ]
        },
        "whois": {
            "registrar": "GoDaddy.com",
            "created": "2014-02-15T10:17:05Z",
            "updated": "2022-03-17T11:13:27Z",
            "expires": "2027-02-15T10:17:05Z",
            "nameservers": [
                "ns-118.awsdns-14.com",
                "ns-1258.awsdns-29.org",
                "ns-1912.awsdns-47.co.uk",
                "ns-985.awsdns-59.net"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-22T16:22:09Z",
        "analysis_at": "2026-10-11T15:06:15Z",
        "stats": {
            "timeout": 0,
            "harmless": 49,
            "malicious": 9,
            "suspicious": 0,
            "undetected": 34
        },
        "detections": {
            "Lionic": "phishing",
            "Sophos": "phishing",
            "Emsisoft": "phishing",
            "Fortinet": "phishing",
            "Netcraft": "malicious",
            "Kaspersky": "phishing",
            "ChainPatrol": "malicious",
            "alphaMountain.ai": "phishing",
            "Forcepoint ThreatSeeker": "phishing"
        },
        "reputation": 0,
        "categories": {
            "alphaMountain.ai": "Phishing (alphaMountain.ai)"
        },
        "registrar": "GoDaddy.com",
        "created": "2014-02-15T10:17:05Z",
        "updated": "2022-03-17T11:13:27Z",
        "first_seen": "2026-09-09T13:25:55Z",
        "dns": [
            {
                "ttl": 900,
                "type": "A",
                "value": "194.48.203.17"
            },
            {
                "ttl": 900,
                "type": "A",
                "value": "194.48.203.15"
            },
            {
                "ttl": 900,
                "type": "A",
                "value": "194.48.203.16"
            }
        ],
        "dns_at": "2026-10-11T15:15:19Z",
        "jarm": "15d15d15d29d15d00041d41d000000ab8dbe12fa0c1eeebf055e3115374289",
        "cert": {
            "san": [
                "*.tilda.ws",
                "tilda.ws"
            ],
            "issuer": "Key-Systems GmbH / GlobeSSL RSA DV SSL CA 2",
            "serial": "9f3f55b6502aff026831d13b40fa6781",
            "sha256": "390470a69a8b956f6d27281e00d3e955ceafcca79d998cc97458262c8697cda5",
            "subject": "*.tilda.ws",
            "valid_to": "2027-01-30T23:59:59Z",
            "valid_from": "2026-07-16T00:00:00Z"
        },
        "whois": {
            "registrar": "GoDaddy.com",
            "registrar_iana_id": "146",
            "registrar_url": "www.godaddy.com",
            "created": "2014-02-15T10:17:05Z",
            "updated": "2022-03-17T11:13:27Z",
            "expires": "2027-02-15T10:17:05Z",
            "status": [
                "clientDeleteProhibited",
                "clientRenewProhibited",
                "clientTransferProhibited",
                "clientUpdateProhibited"
            ],
            "nameservers": [
                "ns-118.awsdns-14.com",
                "ns-1258.awsdns-29.org",
                "ns-1912.awsdns-47.co.uk",
                "ns-985.awsdns-59.net"
            ],
            "dnssec": "unsigned"
        }
    }
}
```