sso--robinhood-secure-com--auth[.]webflow[.]io

PhishDestroy identifies sso--robinhood-secure-com--auth.webflow.io as a brand impersonation phishing domain targeting Robinhood. This domain presents a fraudulent login page designed to steal credentials from unsuspecting users. The threat type is a fake login page, which mimics the legitimate Robinhood authentication interface to harvest sensitive account information.

Technical indicators reveal that this domain has a VirusTotal score of 14/95, meaning 14 security vendors flagged it as malicious. It is registered through MarkMonitor, Inc. and resolves to IP address 104.18.36.248. The domain was created on May 08, 2013, and its SSL certificate is issued by Google Trust Services (WE1). The domain appears on 2 security blocklists, indicating it has been identified as a threat by multiple sources.

Currently, this domain has been taken offline, reducing immediate risk to users. However, similar domains may still be active. PhishDestroy recommends that users always verify URLs before entering credentials, especially for financial platforms like Robinhood. If you have already interacted with this domain, change your passwords immediately and enable two-factor authentication. Stay vigilant and report any suspicious domains to PhishDestroy for analysis.