faq-robinhood-login-help[.]pages[.]dev

Analysis indicates that the domain faq-robinhood-login-help.pages.dev was registered on 21 February 2026 through Cloudflare, Inc. The site served a HTTP 403 response and the page title returned by the server was "Suspected phishing site | Cloudflare", consistent with a takeover or block page rather than original content. The domain is flagged as a brand‑impersonation campaign targeting Robinhood, as reflected in the supplied threat classification and the explicit brand target. DNS resolution points to IP address 104.21.96.1, which belongs to AS13335 (Cloudflare, Inc.) and is geolocated in the United States. The TLS certificate presented is issued by Google Trust Services under the "WE1" label, indicating a valid certificate chain that does not by itself provide assurance about the underlying content. Security‑vendor scans on VirusTotal recorded 10 detections out of 93 vendors, confirming that multiple commercial products have identified malicious behavior.

The domain appears on one public blocklist and has been actively blocked by the PhishDestroy service. Additional infrastructure details include the use of Cloudflare‑managed nameservers novalee.ns.cloudflare.com and donald.ns.cloudflare.com, and the presence of modern web technologies such as HTTP/3 and HSTS, which are typical for Cloudflare‑hosted services. Gridinsoft assigned a trust score of 0 out of 100, reinforcing the perception of high risk. The current status is reported as offline, and the site is no longer reachable. However, the registration timestamp, SSL configuration, and detection history suggest that the domain was purpose‑built for a short‑lived impersonation attempt.

Uncertainty remains regarding the exact payload or credential‑ harvesting mechanism, as no page content beyond the Cloudflare block page has been captured. Defenders should continue to block the domain at network perimeter, update URL filtering rules, and monitor for any future use of similar sub‑domain patterns within the pages.