validate-robinhood[.]com

PhishDestroy first observed validate-robinhood.com on Mar 17, 2026. The hostname explicitly references Robinhood; stored content metadata identifies the same apparent target. The captured page title is “Access Robinhood Staking”. Stored page analysis classifies the content as brand impersonation. Current evidence score: 95/100 (critical).

Positive findings are stored from 6 sources: VirusTotal, Google Safe Browsing, DNS security resolvers, Cloudflare Radar, URLQuery, and URLScan. VirusTotal recorded 24 detections among 94 engines: ADMINUSLabs, Criminal IP, alphaMountain.ai, BitDefender, Cluster25, CRDF, CyRadar, Ermes, ESET, Emsisoft, Forcepoint ThreatSeeker, Fortinet, G-Data, Google Safebrowsing, Gridinsoft, Kaspersky, LevelBlue, Lionic, Netcraft, OpenPhish, SOCRadar, Sophos, VIPRE, Webroot on Mar 19, 2026 at 11:02 UTC. Google Safe Browsing flagged the domain: Social Engineering on Mar 17, 2026 at 14:18 UTC. DNS security checks returned 1 blocking result across 14 tested policies: Brand Robinhood; no observation timestamp was retained. Cloudflare Radar classified the hostname as malicious and assigned the categories security threats, phishing, and security risks; its verdict timestamp was not retained. URLQuery recorded 2 threat-system alerts on Mar 17, 2026 at 12:22 UTC. URLScan returned a malicious verdict with score 100; scan metadata linked the capture to Robinhood and assigned phishing as its category on Jul 29, 2026 at 03:13 UTC. Non-positive and contextual checks: The separate external-blocklist snapshot contained no matches on Aug 8, 2026 at 10:20 UTC. PhishStats returned no feed match on Mar 17, 2026 at 14:19 UTC.

HTTP 502 was recorded on Aug 8, 2026 at 02:35 UTC; content was unavailable. Latest classified outcome: registration hold observed; cause registrar client hold; mechanism client hold; observed actor NICENIC INTERNATIONAL GROUP CO., LIMITED on Aug 8, 2026 at 02:29 UTC. Registration records for the domain list NiceNIC International Group Co., Limited as the registrar and Mar 16, 2026 as the creation date. Registration preceded first observation by 1 day. At collection time, the hostname resolved to 192.142.37.7 on AS214036 (ULTAHOST-AS Ultahost, Inc., US). The recorded endpoint location is Madrid, ES. The stored server header is nginx. DOM analysis on Jul 29, 2026 at 04:05 UTC returned 83/100. The evidence archive retains 3 visual captures from PhishDestroy, URLScan, and URLQuery. TLS metadata lists Let's Encrypt as the certificate issuer.

The content indicators and 6 positive source findings support the current Robinhood-themed brand impersonation classification.