robmhood--logen-en[.]tem3[.]io

The domain robmhood--logen-en.tem3.io is currently active and flagged as a high-risk Robinhood brand impersonation site, specifically designed for credential theft targeting financial account holders. Analysis indicates the domain mimics legitimate login portals to harvest user credentials, potentially leading to unauthorized access to brokerage or cryptocurrency accounts. The site remains operational as of the latest verification, posing an immediate threat to unsuspecting users seeking official financial services. Infrastructure analysis reveals the domain was registered on February 21, 2026, through GoDaddy.com, LLC, a registrar frequently observed in fraudulent campaigns. It resolves to the IP address 188.114.96.3, hosted on autonomous system AS13335, associated with a content delivery network known for providing anonymity to malicious actors. The domain is flagged by 17 of 95 security vendors on VirusTotal, while two independent security blocklists have listed it for phishing-related activity. The SSL certificate, issued by Google Trust Services under the WE1 intermediate, further corroborates the use of legitimate-appearing encryption to deceive targets. Notably, the page title explicitly states 'Suspected phishing site | Cloudflare,' suggesting prior detection by automated security systems. Current risk assessment categorizes this domain as high severity due to its active status, brand impersonation of a widely recognized financial platform, and confirmed credential theft objectives. Users are strongly advised to avoid interaction with the domain and any associated links. Organizations should update web filtering rules to block access to robmhood--logen-en.tem3.io and its resolving IP address. Financial institutions and security teams are recommended to monitor for credential reuse attempts originating from this campaign, particularly those targeting Robinhood account holders. Immediate reporting to relevant abuse contacts, including the hosting provider and registrar, is encouraged to facilitate takedown efforts.