robinhood--logi-index[.]webflow[.]io

PhishDestroy identifies robinhood--logi-index.webflow.io as an active brand-impersonation phishing domain targeting Robinhood customers. The domain poses as the legitimate Robinhood platform to harvest login credentials and financial data, exhibiting elevated risk due to active hosting and impersonation tactics.

This domain was flagged by 11 of 95 VirusTotal security vendors and resolves to IP address 172.64.151.8. Hosted on Webflow’s platform, it leverages a Google Trust Services SSL certificate to appear legitimate. The phishing page mimics the Robinhood brand interface, aiming to deceive users into entering sensitive account information. Early analysis suggests recent creation, with reports indicating ongoing abuse across multiple threat intelligence feeds.

The threat remains active and is currently being used in targeted credential harvesting campaigns. Security teams and users are advised to block robinhood--logi-index.webflow.io at the network and DNS levels. Additionally, enable multi-factor authentication (MFA) on Robinhood accounts and educate users to verify URLs before entering credentials. Monitor for unauthorized login attempts and report suspicious activity to Robinhood’s fraud team immediately.