www-robinhood-com-login-link[.]typedream[.]app

The domain www-robinhood-com-login-link.typedream.app was registered on September 07, 2025 through Cloudflare, Inc. and resolves to the IP address 188.114.97.3, which belongs to AS13335 operated by Cloudflare in the United States. The site presented the page title “Robinhood Login Account | Secure Access to Your Investments,” directly referencing the Robinhood brand and indicating a credential‑phishing campaign. SSL termination is provided by Google Trust Services under the WE1 certificate, confirming that TLS is in place despite the site being taken offline. An HTTP request to the host returns a 404 status code, suggesting that the phishing page has been removed or is intentionally hidden.

Infrastructure analysis shows the use of Node.js, React, Next.js, and Google Cloud services including Cloud Trace and Cloud CDN, all fronted by Cloudflare’s CDN and Browser Insights. These components are typical of rapidly deployed phishing kits that leverage cloud platforms for scalability and obfuscation. The domain appears on a single security blocklist and is specifically flagged by PhishDestroy, indicating that at least one anti‑phishing service has taken action against it. VirusTotal records show that 19 out of 95 scanning engines flagged the domain, reinforcing the malicious assessment.

The available evidence confirms a brand‑impersonation credential‑phishing attempt targeting Robinhood users. However, the lack of additional blocklist entries, limited public reconnaissance, and the current offline status leave the full operational timeline and victim impact uncertain. Defensive teams should add the domain to their blocklists, monitor DNS queries for the IP 188.114.97.3, and enforce strict URL filtering for any “typedream.app” subdomains that contain “robinhood” in the host string. Continuous re‑evaluation of Cloudflare‑hosted assets is recommended, as the underlying infrastructure can be reused for future campaigns.