secure-sso-robinhood-com--org[.]webflow[.]io

secure-sso-robinhood-com--org.webflow.io was observed resolving to the Cloudflare edge address 172.64.151.8, announced by AS13335 and located in the United States. The domain is hosted on Cloudflare infrastructure and serves HTTP/3, with the SSL certificate issued by Google Trust Services under the WE1 intermediate. The page title returned by the server is "Log In | Robinhood® - Sign In to Your Account", directly referencing the Robinhood brand. Registration data shows the domain was created on May 08, 2013 and was registered through MarkMonitor, Inc., a registrar commonly used by legitimate enterprises. Nameserver records point to journey.ns.cloudflare.com and lamar.ns.cloudflare.com. When queried, the HTTP response code is 404, indicating that the landing page is not currently serving content; the current status is marked as offline.

VirusTotal analysis reports that 14 of 95 scanning engines flagged the domain as malicious, and the domain appears on one public security blocklist. PhishDestroy has also listed the domain as blocked. The observed indicators align with a credential‑phishing campaign that impersonates Robinhood, as classified in the provided intelligence. The risk rating assigned is elevated, reflecting the combination of brand impersonation, presence on a blocklist, and multiple vendor detections. Although the site is presently offline, historical snapshots indicate that the URL pattern mimics legitimate Robinhood login endpoints, a technique commonly used to harvest credentials.

The use of Cloudflare’s free tier and HTTP/3 suggests an attempt to leverage modern protocols to evade simplistic detection. No additional infrastructure such as command‑and‑control servers or malware payloads has been observed in association with this domain. Defenders should add the domain and its associated IP address to blocklists, monitor for any future re‑hosting of active content, and enforce outbound filtering for URLs containing "webflow.