secure-d-sso--robinhoods--com-cdn[.]webflow[.]io

This domain, secure-d-sso--robinhoods--com-cdn.webflow.io, poses a direct threat as a brand impersonation scheme targeting Robinhood users. The page replicates the official Robinhood login interface, using the title 'Log In | Robinhood® - Sign In to Your Account' to deceive victims into entering credentials. Such impersonation attacks are commonly used to harvest login details for financial fraud, account takeovers, or unauthorized transactions, particularly in brokerage and cryptocurrency platforms where immediate financial loss is possible. Analysis indicates the domain is registered through MarkMonitor, Inc., a registrar frequently associated with legitimate domains but also abused for phishing. The domain was created on May 08, 2013, though its malicious use appears recent. It is flagged by 14 out of 95 security vendors on VirusTotal and appears on two independent security blocklists. Infrastructure analysis reveals the domain resolves to the IP address 104.18.36.248, hosted on Cloudflare’s network (AS13335), a common obfuscation tactic to mask the true origin of phishing infrastructure. The SSL certificate is issued by Google Trust Services, further mimicking legitimacy. Users who visited this domain should immediately revoke any entered credentials by resetting their Robinhood account password through the official platform. Enable multi-factor authentication if not already active. Monitor account activity for unauthorized transactions or changes, and report any suspicious logins to the targeted service’s support team. If financial data or payment details were submitted, contact the relevant financial institution to secure accounts and review recent transactions for fraud. No further interaction with the domain should occur, and any local copies of the page or downloaded content should be deleted to mitigate residual risk.