www-robinhood-wallet[.]typedream[.]app

This domain, www-robinhood-wallet.typedream.app, poses a direct threat as a brand impersonation site targeting users of the financial services platform Robinhood. The site mimics the legitimate Robinhood interface, presenting a page titled 'Robinhood: Commission-Free Trading for Stocks, Crypto, and ETFs' to deceive visitors into entering credentials or financial details. The primary risk involves credential harvesting, with potential secondary threats including cryptocurrency wallet drainers or fraudulent transaction prompts. The domain is designed to exploit trust in the Robinhood brand, likely targeting users seeking wallet access, trading, or account management features. Analysis indicates the domain is hosted on infrastructure associated with elevated risk. VirusTotal reports 17 out of 95 security vendors flagging the domain as malicious, a detection rate consistent with active phishing campaigns. The domain was registered on January 22, 2021, through Squarespace Domains II LLC, and currently resolves to IP address 104.21.37.85, a Cloudflare-hosted endpoint in the United States. It appears on one security blocklist, and SSL certificate analysis reveals a Google Trust Services / WE1 certificate, which does not mitigate the underlying threat. The use of Cloudflare infrastructure is notable, as it may obscure the true origin of the malicious content and complicate takedown efforts. Users who have visited www-robinhood-wallet.typedream.app or entered credentials on the site should take immediate action to mitigate risk. First, revoke any active sessions associated with the impersonated service and reset passwords using a known secure device. Enable multi-factor authentication (MFA) if not already active, and monitor financial accounts for unauthorized transactions. If cryptocurrency wallets or sensitive financial data were accessed, consider transferring assets to a new wallet and reporting the incident to relevant financial institutions. Additionally, scan the device used to access the site for malware, as phishing pages may deploy secondary payloads. Report the domain to security teams at the impersonated brand to support broader mitigation efforts.