links-robinhood.account.nohfai.com

Summary

This website contacted 3 IPs in 1 countries across 3 domains to perform 7 HTTP transactions. The main IP is 159.203.93.226, located in Clifton, United States and belongs to DIGITALOCEAN-ASN, US. The main domain is links-robinhood.account.nohfai.com.
TLS certificate: Issued by R3 on January 9th 2024. Valid for: 3 months.

This is the only time links-robinhood.account.nohfai.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Robinhood (Financial)

Community Verdicts: Malicious — 1 votes Show Verdicts

Domain & IP information

	IP Address	AS Autonomous System
1 1	44.233.158.72 44.233.158.72	16509 (AMAZON-02) (AMAZON-02)
1 5	159.203.93.226 159.203.93.226	14061 (DIGITALOC...) (DIGITALOCEAN-ASN)
2	18.173.187.38 18.173.187.38	16509 (AMAZON-02) (AMAZON-02)
7	3

1 44.233.158.72 (Boardman, United States) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-44-233-158-72.us-west-2.compute.amazonaws.com

t2m.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 159.203.93.226 (Clifton, United States) 1 redirects

ASN14061 (DIGITALOCEAN-ASN, US)
PTR: host.punyabuyerku.nightmare

links-robinhood.account.nohfai.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 18.173.187.38 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-173-187-38.muc50.r.cloudfront.net

cdn.robinhood.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
5	nohfai.com 1 redirects links-robinhood.account.nohfai.com	180 KB
2	robinhood.com cdn.robinhood.com — Cisco Umbrella Rank: 42134	758 KB
1	t2m.io 1 redirects t2m.io — Cisco Umbrella Rank: 339963	364 B
7	3

	Domain	Requested by
5	links-robinhood.account.nohfai.com	1 redirects links-robinhood.account.nohfai.com
2	cdn.robinhood.com	links-robinhood.account.nohfai.com
1	t2m.io	1 redirects
7	3

This site contains no links.

Subject Issuer	Validity	Valid
links-robinhood.account.nohfai.com R3	`2024-01-09` - `2024-04-08`	3 months	crt.sh
*.robinhood.com DigiCert TLS RSA SHA256 2020 CA1	`2023-03-13` - `2024-03-12`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://links-robinhood.account.nohfai.com/signin/57fcd9193616bb23e0bf4d9470850592f78bc68f0a698fb28d53a957c7690574
Frame ID: B75E8DEC61A3A9C96B6B818A9860CF85
Requests: 7 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Log In | Robinhood

Page URL History Show full URLs

https://t2m.io/7FvJA1z HTTP 301
https://links-robinhood.account.nohfai.com/?cverify HTTP 307
https://links-robinhood.account.nohfai.com/signin/57fcd9193616bb23e0bf4d9470850592f78bc68f0a698fb28d53a957c7690574 Page URL

Page Statistics

7
Requests

86 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

3
IPs

1
Countries

937 kB
Transfer

965 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://t2m.io/7FvJA1z HTTP 301
https://links-robinhood.account.nohfai.com/?cverify HTTP 307
https://links-robinhood.account.nohfai.com/signin/57fcd9193616bb23e0bf4d9470850592f78bc68f0a698fb28d53a957c7690574 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

7 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

Primary Request 57fcd9193616bb23e0bf4d9470850592f78bc68f0a698fb28d53a957c7690574 Show response
links-robinhood.account.nohfai.com/signin/
Redirect Chain

https://t2m.io/7FvJA1z
https://links-robinhood.account.nohfai.com/?cverify
https://links-robinhood.account.nohfai.com/signin/57fcd9193616bb23e0bf4d9470850592f78bc68f0a698fb28d53a957c7690574

35 KB
5 KB

326ms
319ms

Document
text/html

159.203.93.226
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://links-robinhood.account.nohfai.com/signin/57fcd9193616bb23e0bf4d9470850592f78bc68f0a698fb28d53a957c7690574
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 159.203.93.226 Clifton, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS: host.punyabuyerku.nightmare
Software: Apache /
Resource Hash: 50c89fc4223d3b049a79d463cf600745ae1a2ffde70be130eceffa63bdd80489

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Cache-Control: no-store, no-cache, must-revalidate
Connection: Keep-Alive
Content-Encoding: gzip
Content-Type: text/html; charset=UTF-8
Date: Tue, 09 Jan 2024 17:10:42 GMT
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Keep-Alive: timeout=5, max=99
Pragma: no-cache
Server: Apache
Transfer-Encoding: chunked
Vary: Accept-Encoding

Redirect headers

Cache-Control: no-store, no-cache, must-revalidate
Connection: Keep-Alive
Content-Encoding: gzip
Content-Type: text/html; charset=UTF-8
Date: Tue, 09 Jan 2024 17:10:41 GMT
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Keep-Alive: timeout=5, max=100
Location: https://links-robinhood.account.nohfai.com/signin/57fcd9193616bb23e0bf4d9470850592f78bc68f0a698fb28d53a957c7690574
Pragma: no-cache
Server: Apache
Transfer-Encoding: chunked
Vary: Accept-Encoding

GET
H/1.1 200
OK main.css
links-robinhood.account.nohfai.com/NIGHTMARE/assets/css/ 136 KB
137 KB 376ms
375ms Stylesheet
text/css 159.203.93.226
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://links-robinhood.account.nohfai.com/NIGHTMARE/assets/css/main.css

Requested by

Host: links-robinhood.account.nohfai.com
URL: https://links-robinhood.account.nohfai.com/signin/57fcd9193616bb23e0bf4d9470850592f78bc68f0a698fb28d53a957c7690574

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

159.203.93.226 Clifton, United States, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

host.punyabuyerku.nightmare

Software

Apache /

Resource Hash

13e70f56eb9c1daaca4a4fb471496582aa773c82639f6e6fc93d2925fd8f7b60

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://links-robinhood.account.nohfai.com/signin/57fcd9193616bb23e0bf4d9470850592f78bc68f0a698fb28d53a957c7690574
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

Date: Tue, 09 Jan 2024 17:10:42 GMT
Last-Modified: Mon, 06 Mar 2023 17:55:47 GMT
Server: Apache
X-FRAME-OPTIONS: SAMEORIGIN
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=98
Content-Length: 139670

GET
H2 200 632fcb3e7ed928b2a960f3e003d10b44.jpg
cdn.robinhood.com/assets/generated_assets/webapp/ 378 KB
379 KB 421ms
227ms Image
image/jpeg 18.173.187.38
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.robinhood.com/assets/generated_assets/webapp/632fcb3e7ed928b2a960f3e003d10b44.jpg
Requested by: Host: links-robinhood.account.nohfai.com
URL: https://links-robinhood.account.nohfai.com/signin/57fcd9193616bb23e0bf4d9470850592f78bc68f0a698fb28d53a957c7690574
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.173.187.38 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-173-187-38.muc50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 01373b02ad74b5c99cc5abd66cc1acf1cc4fffc85a51a16212e6f40d0de3f126

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://links-robinhood.account.nohfai.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

date: Sat, 06 Jan 2024 23:25:38 GMT
x-amz-version-id: PoIhcChpT0cSJtwVGrPw9Ghq6AqCPYF_
via: 1.1 ed0321bab00e6823808eaacb7b137e08.cloudfront.net (CloudFront)
last-modified: Mon, 25 Apr 2022 23:37:31 GMT
server: AmazonS3
x-amz-cf-pop: MUC50-P4
age: 236705
etag: "cdfcb3cb965d71cf114d0aeb8f0a50cd"
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-type: image/jpeg
cache-control: public,max-age=2419200,immutable
accept-ranges: bytes
content-length: 387068
x-amz-cf-id: pG5w31JGfl6K8tCk5yeV_Sub8XvOrtFpxdhuioE3WhlIEgrerckCFg==

GET
H2 200 632fcb3e7ed928b2a960f3e003d10b44.jpg
cdn.robinhood.com/assets/generated_assets/webapp/web-platform-prefetch-sdp/member/ 378 KB
379 KB 265ms
72ms Image
image/jpeg 18.173.187.38
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.robinhood.com/assets/generated_assets/webapp/web-platform-prefetch-sdp/member/632fcb3e7ed928b2a960f3e003d10b44.jpg
Requested by: Host: links-robinhood.account.nohfai.com
URL: https://links-robinhood.account.nohfai.com/signin/57fcd9193616bb23e0bf4d9470850592f78bc68f0a698fb28d53a957c7690574
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.173.187.38 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-173-187-38.muc50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 01373b02ad74b5c99cc5abd66cc1acf1cc4fffc85a51a16212e6f40d0de3f126

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://links-robinhood.account.nohfai.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

date: Sun, 07 Jan 2024 17:29:51 GMT
x-amz-version-id: 8INWXEadNYmHgBZkdxgGT_EoGR0b1QV2
via: 1.1 ed0321bab00e6823808eaacb7b137e08.cloudfront.net (CloudFront)
last-modified: Fri, 21 Oct 2022 22:27:06 GMT
server: AmazonS3
x-amz-cf-pop: MUC50-P4
age: 171652
etag: "cdfcb3cb965d71cf114d0aeb8f0a50cd"
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-type: image/jpeg
cache-control: public,max-age=31536000,immutable
accept-ranges: bytes
content-length: 387068
x-amz-cf-id: wiV17_MHQ9v53mfrkZzBGpcZ9Rua_jE3C5OXKvtl2kh7N_ilknLKTQ==

GET
H/1.1 200
OK 8b42e3fc6d1d161d6fbd7487babe6cfe.woff2
links-robinhood.account.nohfai.com/NIGHTMARE/assets/fonts/ 19 KB
19 KB 557ms
557ms Font
font/woff2 159.203.93.226
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://links-robinhood.account.nohfai.com/NIGHTMARE/assets/fonts/8b42e3fc6d1d161d6fbd7487babe6cfe.woff2

Requested by

Host: links-robinhood.account.nohfai.com
URL: https://links-robinhood.account.nohfai.com/NIGHTMARE/assets/css/main.css

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

159.203.93.226 Clifton, United States, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

host.punyabuyerku.nightmare

Software

Apache /

Resource Hash

d6e0f9a85b076741a771ec8574c1278fb65fe34160e73bd8beffa2f927831302

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://links-robinhood.account.nohfai.com/NIGHTMARE/assets/css/main.css
Origin: https://links-robinhood.account.nohfai.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

Date: Tue, 09 Jan 2024 17:10:49 GMT
Last-Modified: Mon, 06 Mar 2023 17:52:03 GMT
Server: Apache
X-FRAME-OPTIONS: SAMEORIGIN
Content-Type: font/woff2
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=97
Content-Length: 18968

GET
H/1.1 200
OK ece4dfe7c8753c6ed9e4ede8ad811074.woff2
links-robinhood.account.nohfai.com/NIGHTMARE/assets/fonts/ 19 KB
19 KB 394ms
393ms Font
font/woff2 159.203.93.226
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://links-robinhood.account.nohfai.com/NIGHTMARE/assets/fonts/ece4dfe7c8753c6ed9e4ede8ad811074.woff2

Requested by

Host: links-robinhood.account.nohfai.com
URL: https://links-robinhood.account.nohfai.com/NIGHTMARE/assets/css/main.css

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

159.203.93.226 Clifton, United States, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

host.punyabuyerku.nightmare

Software

Apache /

Resource Hash

6573ba5ca76b29d5ffe83d94b27a4a8a09c8d5c8d5f2ca0719aaeef6856042d8

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://links-robinhood.account.nohfai.com/NIGHTMARE/assets/css/main.css
Origin: https://links-robinhood.account.nohfai.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

Date: Tue, 09 Jan 2024 17:10:49 GMT
Last-Modified: Mon, 06 Mar 2023 17:52:05 GMT
Server: Apache
X-FRAME-OPTIONS: SAMEORIGIN
Content-Type: font/woff2
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 19072

GET f31b2ecb2f8e039d53bd75d5314229c7.woff2
links-robinhood.account.nohfai.com/NIGHTMARE/assets/fonts/ 0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: links-robinhood.account.nohfai.com
URL: https://links-robinhood.account.nohfai.com/NIGHTMARE/assets/fonts/f31b2ecb2f8e039d53bd75d5314229c7.woff2

Verdicts & Comments Add Verdict or Comment

Malicious page.domain
Submitted on January 9th 2024, 5:12:13 pm UTC — From United States

Threats: Scam Counterfeit
Comment: Scam impersonating Robinhood Markets. Do not enter personal information on this site.

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Robinhood (Financial)

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| documentPictureInPicture

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			links-robinhood.account.nohfai.com/	1969-12-31 23:59:59	Name: PHPSESSID Value: 5cc3d2f2fb145d8eda62252e29fe0712

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdn.robinhood.com
links-robinhood.account.nohfai.com
t2m.io
links-robinhood.account.nohfai.com
159.203.93.226
18.173.187.38
44.233.158.72
01373b02ad74b5c99cc5abd66cc1acf1cc4fffc85a51a16212e6f40d0de3f126
13e70f56eb9c1daaca4a4fb471496582aa773c82639f6e6fc93d2925fd8f7b60
50c89fc4223d3b049a79d463cf600745ae1a2ffde70be130eceffa63bdd80489
6573ba5ca76b29d5ffe83d94b27a4a8a09c8d5c8d5f2ca0719aaeef6856042d8
d6e0f9a85b076741a771ec8574c1278fb65fe34160e73bd8beffa2f927831302

links-robinhood.account.nohfai.com Open in urlscan Pro 159.203.93.226 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Community Verdicts: Malicious — 1 votes Show Verdicts

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Page Statistics

7 Requests

86 %HTTPS

0 %IPv6

3 Domains

3 Subdomains

3 IPs

1 Countries

937 kBTransfer

965 kBSize

1 Cookies

0 Outgoing links

Page URL History

Redirected requests

7 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

Malicious page.domain Submitted on January 9th 2024, 5:12:13 pm UTC — From United States

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

1 JavaScript Global Variables

1 Cookies

Indicators

links-robinhood.account.nohfai.com Open in urlscan Pro
159.203.93.226 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

7
Requests

86 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

3
IPs

1
Countries

937 kB
Transfer

965 kB
Size

1
Cookies

7 HTTP transactions
0 data transactions

Malicious page.domain
Submitted on January 9th 2024, 5:12:13 pm UTC — From United States

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!