secure--sso-robinhood-com-m----autth[.]webflow[.]io

The domain secure--sso-robinhood-com-m----autth.webflow.io was registered on May 08, 2013 and is currently listed as offline with an HTTP 404 response. DNS resolution points to IP address 172.64.151.8, which belongs to AS13335 Cloudflare, Inc., confirming that the site is hosted behind Cloudflare’s edge network and is served over HTTP/3. The SSL certificate is issued by Google Trust Services under the WE1 identifier, indicating a valid TLS handshake despite the site’s offline state. Nameservers journey.ns.cloudflare.com and lamar.ns.cloudflare.com further corroborate the Cloudflare hosting.

The page title observed during the brief crawl was "Log In | Robinhood® - Sign In to Your Account," directly referencing the Robinhood brand. Registration data shows the domain was purchased through MarkMonitor, Inc., a registrar commonly used by legitimate brands, suggesting that the domain may have been sub‑leased or compromised to host malicious content. VirusTotal analysis recorded 15 detections out of 95 security vendors, reinforcing the malicious classification. The domain appears on a single security blocklist and is actively blocked by PhishDestroy, indicating that at least one industry feed has flagged it as a phishing vector.

The threat type is identified as brand impersonation with a credential‑phishing objective, targeting Robinhood users. While the current offline status limits direct observation of payloads, the combination of brand‑specific page title, high detection count, and blocklist presence provides strong evidence of phishing intent. Defenders should immediately add the domain to network deny lists, monitor DNS queries for the associated IP, and enforce URL filtering policies that block any access attempts. Continuous re‑evaluation is advised in case the site is re‑activated, and threat‑intel sharing with partners can help broaden detection coverage.