reward-robinhood[.]com

The domain reward-robinhood.com was observed targeting the Robinhood brand with a fake‑airdrop narrative. Technical analysis shows the domain resolves to IP address 172.67.147.19, which belongs to Cloudflare, Inc. (AS13335) and is geolocated in the United States. No SSL certificate was presented during the brief connection attempt, and the HTTP response returned a generic page title of "Just a moment...," indicating that the site may have been serving a Cloudflare challenge or was otherwise inaccessible when captured. Registration data lists NiceNIC International Group Co., Limited as the registrar, and the domain was created on February 22, 2026.

Nameservers are the standard Cloudflare pair, donald.ns.cloudflare.com and etta.ns.cloudflare.com. VirusTotal scans have flagged the domain in 10 of 95 security vendor engines, and the domain appears on two external blocklists, PhishDestroy and CryptoFirewall, both of which have taken it offline. The current status is reported as offline, suggesting takedown or automatic removal by the hosting provider.

Evidence confirms the domain’s intent to impersonate Robinhood and to lure victims with a fabricated airdrop offer, but the exact payload or credential‑harvesting mechanisms remain unverified due to the limited page content captured. Defenders should add reward-robinhood.com to domain‑blocking policies, monitor for any related subdomains or look‑alike registrations, and enforce strict outbound filtering for connections to Cloudflare‑hosted IPs that lack proper TLS. Continuous threat‑intel feeds should be consulted for emerging variants that reuse the same registrar or naming pattern, and any internal alerts triggered by connections to the IP 172.67.147.19 should be investigated for potential reconnaissance or compromised assets.