home-sso-robinhood---com-auth[.]webflow[.]io

This domain, home-sso-robinhood---com-auth.webflow.io, is identified as a credential phishing site targeting users of the financial services platform Robinhood. Analysis indicates the site employs brand impersonation tactics, presenting a login interface titled 'Log In | Robinhood® - Sign In to Your Account' to harvest user credentials. No drainer kit signatures were observed in initial scans, though further forensic analysis may reveal additional malicious components. Infrastructure analysis reveals the domain resolves to IP address 104.18.36.248, hosted on Cloudflare infrastructure (AS13335). The domain was originally registered on May 08, 2013, through registrar MarkMonitor, Inc., though the phishing content appears to have been deployed recently. VirusTotal detection metrics show 13 out of 95 security vendors flagging the domain as malicious. The SSL certificate is issued by Google Trust Services (WE1), a common characteristic of both legitimate and malicious sites leveraging Cloudflare services. The domain appears on two security blocklists, including PhishDestroy and PhishingDB. Current status indicates the domain has been taken offline, likely following abuse reports or automated takedown procedures. While the immediate threat is mitigated, residual risk remains for users who may have interacted with the site prior to its removal. Organizations are advised to monitor for credential reuse attempts and update blocklists to include this domain. Users should be alerted to verify domain authenticity before entering credentials, particularly for financial services platforms.