robinhoodlogin[.]start[.]page

The domain robinhoodlogin.start.page is currently active and has been classified as a high‑risk brand‑impersonation site targeting Robinhood users. The site presents the page title “Robinhood Login,” which aligns with the reported scam type of credential phishing. Infrastructure analysis shows the domain was registered on February 21, 2026 through NameCheap, Inc., and resolves to the Cloudflare address 104.18.25.210 (AS13335, United States). DNS resolution uses Cloudflare nameservers dom.ns.cloudflare.com and tess.ns.cloudflare.com, and the TLS certificate is issued by Google Trust Services under the WE1 root. The site serves HTTP 200 responses and employs Cloudflare and CookieYes technologies, including HTTP/3. Threat intelligence feeds indicate the domain appears on one security blocklist and has been blocked by PhishDestroy. On VirusTotal, 20 of 93 security vendors have flagged the domain, and Gridinsoft assigns a trust score of 0 / 100, reinforcing the malicious assessment. No additional content analysis is available beyond the page title, so the exact phishing page layout cannot be confirmed. Defenders should add the domain to network‑level deny lists, monitor DNS queries for the associated Cloudflare IP, and consider sinkholing the address to disrupt traffic. Continuous re‑evaluation is advised, as the infrastructure could be repurposed or shifted to new hosting locations.