secure-robinhood-com-autth[.]webflow[.]io

PhishDestroy has identified secure-robinhood-com-autth.webflow.io as a confirmed brand impersonation domain specifically targeting Robinhood. This site mimics the legitimate Robinhood login page, as evidenced by its page title "Log In | Robinhood® - Sign In to Your Account," and is designed to steal user credentials through credential theft. The threat type is brand impersonation, with no drainer kit detected.

Technically, this domain exhibits multiple red flags. VirusTotal reports that 12 out of 95 security vendors flag the domain as malicious. The domain was registered through MarkMonitor, Inc. and created on May 08, 2013, which may lend a false sense of legitimacy. It resolves to IP address 104.18.36.248 and uses an SSL certificate from Google Trust Services / WE1. Additionally, the domain appears on two security blocklists, and Google Safe Browsing (GSB) likely lists it given the elevated risk level.

The current status of the domain is offline, indicating that it has been taken down, likely due to reporting or security actions. However, the remaining risk is that similar domains may still be active. Users who have interacted with this site should change their Robinhood passwords immediately and enable two-factor authentication. PhishDestroy recommends verifying any login page URL before entering credentials and never clicking on links from unsolicited messages.