# PhishDestroy domain threat record: sso-robinhoods-m-autth.webflow.io

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/sso-robinhoods-m-autth.webflow.io/
Machine-readable companion: https://phishdestroy.io/domain/sso-robinhoods-m-autth.webflow.io/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: not observed active
- First observed by PhishDestroy: 2026-09-11 09:50:14 UTC
- Last availability or vendor check: 2026-10-21 01:15:56 UTC
- Stored record updated: 2026-10-22 14:24:23 UTC
- VirusTotal detections in the stored snapshot: 14/89
- Independent public blocklist matches in the stored snapshot: 2
- Matching public blocklists: MetaMask, SEAL
- Google Safe Browsing stored result: no stored flag

## Stored classification

- Targeted brand: Robinhood

## Stored infrastructure

- Observed IP address: 172.64.151.8
- Registrar in stored WHOIS data: Webflow
- Registrar country in stored WHOIS data: US
- Last stored HTTP status: 404
- Registration date (registry RDAP, webflow.io): 2013-05-08 02:20:57 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a08fe7-42c1-7559-81df-2e7f91b85fd0/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/sso-robinhoods-m-autth.webflow.io
- Certificate Transparency search: https://crt.sh/?q=%25.sso-robinhoods-m-autth.webflow.io
- Web Archive lookup: https://web.archive.org/web/*/https://sso-robinhoods-m-autth.webflow.io/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
sso-robinhoods-m-autth.webflow.io is a phishing page that impersonated the Robinhood sign-in screen, aimed at people holding stocks or crypto on the platform. The hostname stacks "sso", a pluralized "robinhoods" and a misspelled "autth" to look like a single sign-on address at a glance. PhishDestroy first saw it on 2026-09-11. The site went offline on 2026-09-19 and still served no content when last checked on 2026-10-19.

How the scam works
The page carried the title "Log In | Robinhood® - Sign In to Your Account", so a victim arriving from a phishing email, text or search ad saw what looked like an ordinary Robinhood login prompt. Anything typed into it, such as email, password and often a one-time 2FA code, goes to the operators rather than Robinhood. With those credentials they can log into the real account, sell holdings, move crypto out or change recovery details before the owner notices.

Evidence
On 2026-09-20, 14 of 89 VirusTotal engines flagged the site. They include crypto-focused ChainPatrol alongside BitDefender, ESET, Fortinet, Forcepoint ThreatSeeker, Emsisoft, alphaMountain.ai and CyRadar. That mix of general security vendors and a Web3 specialist reaching the same verdict independently strengthens the classification. The domain is also listed on the PhishDestroy, MetaMask and SEAL blocklists, so wallets and browsers using those feeds warn users who try to open it.

Infrastructure
The page was a free subdomain on Webflow's hosted site builder, with Webflow as the registrar. That let the operators publish a polished clone without buying or registering a domain of their own. Traffic was served through a Cloudflare, Inc. address located in Canada, with a Google Trust Services certificate. The padlock in the browser therefore looked normal and did nothing to show that the page was fake. The page was live for about eight days between first detection and going dark.

What to do
If you entered your Robinhood login on this page, change your password from the official app right away and reset 2FA, preferably moving to an authenticator app or security key. Review recent trades, transfers, linked bank accounts and crypto withdrawals, and contact Robinhood support about any activity you do not recognize. Also secure the email account tied to Robinhood, since attackers often target it to block alerts. Defenders should block this hostname and watch for similar Robinhood-themed subdomains on site-builder platforms, reporting new ones to the hosting provider and to Robinhood.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a08fe7-42c1-7559-81df-2e7f91b85fd0/
VirusTotal report: https://www.virustotal.com/gui/domain/sso-robinhoods-m-autth.webflow.io
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=sso-robinhoods-m-autth.webflow.io
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-19 10:19:43 UTC

## Stored page captures

- Primary capture: https://urlscan.io/screenshots/01a08fe7-42c1-7559-81df-2e7f91b85fd0.png
  Captured: 2026-09-11 09:50:14 UTC
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/6ede6633-6cbd-4e68-a4f3-b02829bfd7ef.png
  Captured: 2026-09-18 18:10:02 UTC
  Source report: https://radar.cloudflare.com/scan/6ede6633-6cbd-4e68-a4f3-b02829bfd7ef
  SHA-256: a380e448eb3101674f4c67f891f37ba29b76e79d0bcca3163d4b1510d947431b

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-20T23:44:13Z",
        "uuid": "01a08fe7-42c1-7559-81df-2e7f91b85fd0",
        "scanned_at": "2026-09-11T09:58:18Z",
        "final_url": "https://sso-robinhoods-m-autth.webflow.io/",
        "status": 200,
        "ip": "104.18.36.248",
        "domains": [
            "cdn.prod.website-files.com",
            "d3e54v103j8qbb.cloudfront.net"
        ],
        "ips": [
            "13.226.247.18",
            "104.18.161.117",
            "104.18.36.248"
        ],
        "asns": [
            "16509",
            "13335"
        ],
        "countries": [
            "US"
        ],
        "doc_hash": "34ca0d1b9c631be2ef7670623a9847722f3170b71a29a327df0bd27e83983066",
        "globals": [
            "$",
            "jQuery",
            "tram",
            "Webflow"
        ],
        "tls": {
            "san": [
                "webflow.io",
                "*.webflow.io"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "WE1",
            "subject": "webflow.io",
            "protocol": "QUIC",
            "valid_to": "2026-10-23T03:21:05Z",
            "valid_from": "2026-07-25T02:21:21Z"
        },
        "domain_age_days": 82,
        "apex_age_days": 82,
        "tls_age_days": 48,
        "tls_valid_days": 90,
        "requests": 6,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 99,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "server": "cloudflare",
            "content-type": "text/html; charset=utf-8",
            "content-security-policy": "frame-ancestors 'self' https://*.webflow.com http://*.webflow.com http://*.webflow.io http://webflow.com https://webflow.com"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-20T22:34:29Z",
        "uuid": "6ede6633-6cbd-4e68-a4f3-b02829bfd7ef",
        "scanned_at": "2026-09-18T18:10:02Z",
        "final_url": "https://sso-robinhoods-m-autth.webflow.io/",
        "status": 404,
        "redirected": "https-only",
        "history": [
            {
                "url": "http://sso-robinhoods-m-autth.webflow.io/",
                "status": 307
            },
            {
                "url": "https://sso-robinhoods-m-autth.webflow.io/",
                "status": 404
            }
        ],
        "dom_hash": "4932075438459d054af6b75a0d6585b123ae775f36579c095159b2af33360488",
        "doc_hash": "90c032f35272ba1a7aa93027ab635e6610d4f24cf9e53c0624d00f065d7c7e7d",
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "sso-robinhoods-m-autth.webflow.io",
                "type": "A",
                "value": "172.64.151.8"
            },
            {
                "name": "sso-robinhoods-m-autth.webflow.io",
                "type": "A",
                "value": "104.18.36.248"
            },
            {
                "name": "sso-robinhoods-m-autth.webflow.io",
                "type": "AAAA",
                "value": "2a06:98c1:3105::6812:24f8"
            },
            {
                "name": "sso-robinhoods-m-autth.webflow.io",
                "type": "AAAA",
                "value": "2a06:98c1:3102::ac40:9708"
            }
        ],
        "dnssec_valid": false,
        "ip": "172.64.151.8",
        "whois": {
            "registrar": "MarkMonitor Inc.",
            "created": "2013-05-08T02:20:57Z",
            "updated": "2026-08-12T04:04:30Z",
            "expires": "2028-05-08T02:20:57Z",
            "nameservers": [
                "lamar.ns.cloudflare.com",
                "journey.ns.cloudflare.com"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-22T06:17:06Z",
        "analysis_at": "2026-10-13T10:01:19Z",
        "stats": {
            "timeout": 0,
            "harmless": 42,
            "malicious": 16,
            "suspicious": 0,
            "undetected": 34
        },
        "detections": {
            "ESET": "phishing",
            "VIPRE": "phishing",
            "G-Data": "phishing",
            "Lionic": "phishing",
            "Sophos": "phishing",
            "CyRadar": "phishing",
            "Webroot": "malicious",
            "Emsisoft": "phishing",
            "Fortinet": "phishing",
            "Netcraft": "malicious",
            "LevelBlue": "phishing",
            "Seclookup": "malicious",
            "BitDefender": "phishing",
            "ChainPatrol": "malicious",
            "alphaMountain.ai": "phishing",
            "Forcepoint ThreatSeeker": "phishing"
        },
        "reputation": 0,
        "tags": [
            "dga"
        ],
        "registrar": "MarkMonitor Inc.",
        "created": "2013-05-08T02:20:57Z",
        "expires": "2028-05-08T02:20:57Z",
        "updated": "2026-08-12T04:04:30Z",
        "first_seen": "2026-09-11T09:57:06Z",
        "dns": [
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2a06:98c1:3105::6812:24f8"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "172.64.151.8"
            },
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2a06:98c1:3102::ac40:9708"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "104.18.36.248"
            }
        ],
        "dns_at": "2026-10-13T10:06:32Z",
        "jarm": "27d27d27d00027d00042d43d00041df04c41293ba84f6efe3a613b22f983e6",
        "cert": {
            "san": [
                "webflow.io",
                "*.webflow.io"
            ],
            "issuer": "Google Trust Services / WE1",
            "serial": "ac972ef95a18ab8f0e5a2917e958d6da",
            "sha256": "5302eb12d2c1ddc8020e4565aef253a59e28b4a9aede60f73e4fe6cb516fd2a7",
            "subject": "webflow.io",
            "valid_to": "2026-12-21T03:46:57Z",
            "valid_from": "2026-09-22T02:47:08Z"
        },
        "whois": {
            "registrar": "MarkMonitor Inc.",
            "registrar_iana_id": "292",
            "registrar_url": "http://www.markmonitor.com",
            "created": "2013-05-08T02:20:57Z",
            "updated": "2025-02-25T20:53:31Z",
            "expires": "2028-05-08T02:20:57Z",
            "status": [
                "clientDeleteProhibited",
                "clientTransferProhibited",
                "clientUpdateProhibited"
            ],
            "nameservers": [
                "journey.ns.cloudflare.com",
                "lamar.ns.cloudflare.com"
            ],
            "dnssec": "unsigned"
        }
    }
}
```