www-robinhood-com-login-page[.]typedream[.]app

This domain, www-robinhood-com-login-page.typedream.app, is confirmed to operate as a credential phishing site targeting users of the Robinhood financial platform. Analysis indicates the site employs brand impersonation tactics, presenting a fraudulent login interface titled 'Robinhood Login Account | Secure Access to Your Investments' to deceive victims into submitting account credentials. No drainer kit signatures were observed, but the site’s design closely mimics the legitimate Robinhood authentication portal, increasing the likelihood of successful social engineering attacks. Infrastructure analysis reveals the domain was registered on January 22, 2021, through Squarespace Domains II LLC and currently resolves to the IP address 188.114.97.3, hosted on AS13335 (Cloudflare, Inc.). The SSL certificate is issued by Google Trust Services (WE1), providing a superficial layer of legitimacy. Detection metrics show 18 out of 95 security vendors flag this domain as malicious on VirusTotal, while it appears on two independent blocklists: PhishDestroy and PhishingDB. Google Safe Browsing status was not explicitly provided, but the domain’s inclusion on multiple blocklists suggests high confidence in its malicious classification. The site remains active as of this report, posing an elevated risk to users who may inadvertently disclose sensitive financial credentials. Recommended response actions include immediate blacklisting by network security controls, submission to additional threat intelligence feeds, and takedown requests to the hosting provider and registrar. Despite potential mitigation efforts, the domain’s age and persistent hosting on a content delivery network may prolong its operational lifespan, necessitating continued monitoring for evasion attempts or infrastructure changes. Users are advised to verify domain authenticity before entering credentials and to report suspicious login pages to the targeted brand’s security team.