sso--robinhood--com--cddn----autth[.]webflow[.]io

The domain sso--robinhood--com--cddn----autth.webflow.io is currently listed on a single security blocklist and has been actively blocked by PhishDestroy, indicating that it has been identified as a malicious resource. The site is hosted behind Cloudflare, using the nameservers journey.ns.cloudflare.com and lamar.ns.cloudflare.com, and presents a Google Trust Services / WE1 SSL certificate, which may lend a false sense of legitimacy. DNS resolution points to the IP address 172.64.151.8, an address owned by AS13335 Cloudflare, Inc., located in the United States. HTTP probing returns a 404 status code, suggesting that the original landing page is no longer accessible, which aligns with the reported offline status.

The page title returned from earlier captures – “Log In | Robinhood® - Sign In to Your Account” – matches the credential‑phishing pattern targeting the Robinhood brand, and the scam type is explicitly recorded as Credential Phishing. The domain was registered through MarkMonitor, Inc., a registrar often used for legitimate brand protection, which can be leveraged to obscure malicious intent. VirusTotal scans have flagged the domain in 15 of 95 security vendor engines, providing independent corroboration of its malicious nature. Technologies observed include Cloudflare’s HTTP/3 support, which is typical for many legitimate services but does not mitigate the phishing risk.

While the current HTTP response is a 404, the historical evidence of a brand‑impersonating login page and the detection in multiple vendor feeds indicate that threat actors have previously used this infrastructure to harvest credentials. Defenders should continue to block the domain at network perimeters, update URL filtering rules to include the full hostname, and monitor for any resurgence of activity.