acc0unt[.]login[.]robinhood[.]mwtechti[.]com

This domain, acc0unt.login.robinhood.mwtechti.com, is identified as a high-risk brand impersonation threat targeting Robinhood, a financial services platform. Analysis indicates the domain is designed to mimic legitimate Robinhood login portals, likely to harvest user credentials or facilitate unauthorized account access. No evidence of a crypto drainer kit or direct financial transaction redirection was observed in initial scans, though credential theft remains the primary objective. Infrastructure analysis reveals the following technical indicators: the domain resolves to IP address 178.128.80.227 and was registered on June 03, 2024, through PDR Ltd. d/b/a PublicDomainRegistry.com. It is currently flagged by 16 out of 95 security vendors on VirusTotal and appears on one security blocklist. Google Safe Browsing classifies the domain under the SOCIAL_ENGINEERING category, confirming its use in deceptive practices. The domain employs a Let’s Encrypt SSL certificate, which may lend a false sense of legitimacy to unsuspecting users. As of the latest verification, the domain remains active and unmitigated. OpenPhish has blocked the domain, but no takedown or sinkholing actions have been confirmed. The remaining risk is elevated due to the domain’s recent registration, active hosting, and persistent targeting of Robinhood’s user base. Organizations and users are advised to block the domain at the DNS or proxy level, monitor for related indicators of compromise, and educate users on recognizing brand impersonation tactics in financial phishing campaigns.