auth3robinhood[.]com

Analysis of the domain auth3robinhood.com indicates a credential phishing campaign impersonating the Robinhood brand. The domain was created on December 14, 2025 and registered through Gname.com Pte. Ltd. It is served by the nameservers a.share-dns.com, a12.share-dns.com, b.share-dns.net, and b12.share-dns.net, and resolves to the IP address 198.18.1.100. No SSL certificate is present, and the observed page title is "Log In | Robinhood," which aligns with the reported scam type of credential phishing. The domain appears on a single security blocklist and is actively blocked by PhishDestroy.

VirusTotal scanning shows that 16 of 95 security vendors have flagged the domain, reinforcing the malicious assessment. Trust scoring services reflect extreme risk: Gridinsoft assigns a score of 0 out of 100, while Scamadviser rates it 1 out of 100. Current operational status is offline, but the infrastructure details remain valuable for defensive measures.

Organizations should add auth3robinhood.com and its resolving IP 198.18.1.100 to block lists, incorporate the domain pattern into email and web‑filtering rules, and monitor for any re‑registration or related domains using the same registrar or nameserver set. Continuous threat‑intel feeds should be consulted for updates, and any attempted credential submissions to this domain should be treated as compromised. The evidence presented—registration data, DNS configuration, lack of TLS, detection counts, and low trust scores—provides a comprehensive basis for mitigation and ongoing vigilance.