robinhood-verify.com

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 4 HTTP transactions. The main IP is 185.193.127.130, located in Finland and belongs to ABSTRACT, FI. The main domain is robinhood-verify.com.
TLS certificate: Issued by R3 on October 23rd 2023. Valid for: 3 months.

This is the only time robinhood-verify.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Robinhood (Financial)

Domain & IP information

	IP Address	AS Autonomous System
3	185.193.127.130 185.193.127.130	39287 (ABSTRACT) (ABSTRACT)
1	18.66.97.118 18.66.97.118	16509 (AMAZON-02) (AMAZON-02)
4	2

3 185.193.127.130 (Finland)

ASN39287 (ABSTRACT, FI)
PTR: b9c17f82.host.njalla.net

robinhood-verify.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.66.97.118 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-66-97-118.fra56.r.cloudfront.net

cdn.robinhood.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
3	robinhood-verify.com robinhood-verify.com	10 KB
1	robinhood.com cdn.robinhood.com — Cisco Umbrella Rank: 23939	379 KB
4	2

	Domain	Requested by
3	robinhood-verify.com	robinhood-verify.com
1	cdn.robinhood.com	robinhood-verify.com
4	2

This site contains no links.

Subject Issuer	Validity	Valid
robinhood-verify.com R3	`2023-10-23` - `2024-01-21`	3 months	crt.sh
*.robinhood.com DigiCert TLS RSA SHA256 2020 CA1	`2023-03-13` - `2024-03-12`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://robinhood-verify.com/
Frame ID: 408C9DF17BE440504ADD05D65947BD29
Requests: 4 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Log In | Robinhood

Page Statistics

4
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

389 kB
Transfer

391 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

4 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request / Show response robinhood-verify.com/	6 KB 2 KB	356ms 66ms	Document text/html	185.193.127.130 ABSTRACT
General Check archive.org Show headers Download Go to Full URL https://robinhood-verify.com/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 185.193.127.130 , Finland, ASN39287 (ABSTRACT, FI), Reverse DNS b9c17f82.host.njalla.net Software nginx/1.18.0 (Ubuntu) / Resource Hash `8245ee9d3985889e9a8b272db89ba0053661ebbd9102e53d5fb00afb1bb4a5bc` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36 accept-language fi-FI,fi;q=0.9 Response headers Connection keep-alive Content-Encoding gzip Content-Type text/html; charset=utf-8 Date Tue, 24 Oct 2023 09:22:13 GMT Server nginx/1.18.0 (Ubuntu) Transfer-Encoding chunked Vary Cookie
GET H/1.1	200 OK	main.css robinhood-verify.com/static/css/	7 KB 7 KB	64ms 63ms	Stylesheet text/css	185.193.127.130 ABSTRACT
General Check archive.org Show headers Download Go to Full URL https://robinhood-verify.com/static/css/main.css Requested by Host: robinhood-verify.com URL: https://robinhood-verify.com/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 185.193.127.130 , Finland, ASN39287 (ABSTRACT, FI), Reverse DNS b9c17f82.host.njalla.net Software nginx/1.18.0 (Ubuntu) / Resource Hash `e891b25f30d47facfb5aec2ba177b329cfc57a98ee098ec9a31bf7b27385ab7d` Request headers accept-language fi-FI,fi;q=0.9 Referer https://robinhood-verify.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36 Response headers Date Tue, 24 Oct 2023 09:22:14 GMT Last-Modified Mon, 23 Oct 2023 10:00:52 GMT Server nginx/1.18.0 (Ubuntu) ETag "1698055252.0-6871-2925269498" Content-Type text/css; charset=utf-8 Cache-Control no-cache Content-Disposition inline; filename=main.css Connection keep-alive Content-Length 6871
GET H/1.1	200 OK	media.css robinhood-verify.com/static/css/	367 B 695 B	126ms 62ms	Stylesheet text/css	185.193.127.130 ABSTRACT
General Check archive.org Show headers Download Go to Full URL https://robinhood-verify.com/static/css/media.css Requested by Host: robinhood-verify.com URL: https://robinhood-verify.com/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 185.193.127.130 , Finland, ASN39287 (ABSTRACT, FI), Reverse DNS b9c17f82.host.njalla.net Software nginx/1.18.0 (Ubuntu) / Resource Hash `6d8de7f5ce2af84984e99a2f5fad176a85f4fb881c307afd7755c56b0aba2af0` Request headers accept-language fi-FI,fi;q=0.9 Referer https://robinhood-verify.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36 Response headers Date Tue, 24 Oct 2023 09:22:14 GMT Last-Modified Tue, 17 Oct 2023 12:29:23 GMT Server nginx/1.18.0 (Ubuntu) ETag "1697545763.0-367-3231912533" Content-Type text/css; charset=utf-8 Cache-Control no-cache Content-Disposition inline; filename=media.css Connection keep-alive Content-Length 367
GET H2	200	632fcb3e7ed928b2a960f3e003d10b44.jpg cdn.robinhood.com/assets/generated_assets/webapp/web-platform-prefetch-sdp/member/	378 KB 379 KB	253ms 75ms	Image image/jpeg	18.66.97.118 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://cdn.robinhood.com/assets/generated_assets/webapp/web-platform-prefetch-sdp/member/632fcb3e7ed928b2a960f3e003d10b44.jpg Requested by Host: robinhood-verify.com URL: https://robinhood-verify.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.66.97.118 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-66-97-118.fra56.r.cloudfront.net Software AmazonS3 / Resource Hash `01373b02ad74b5c99cc5abd66cc1acf1cc4fffc85a51a16212e6f40d0de3f126` Request headers accept-language fi-FI,fi;q=0.9 Referer https://robinhood-verify.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36 Response headers date Mon, 23 Oct 2023 10:52:19 GMT x-amz-version-id 8INWXEadNYmHgBZkdxgGT_EoGR0b1QV2 via 1.1 9015971351bc982a04ee209a022bb1f8.cloudfront.net (CloudFront) last-modified Fri, 21 Oct 2022 22:27:06 GMT server AmazonS3 x-amz-cf-pop FRA56-P2 age 80995 etag "cdfcb3cb965d71cf114d0aeb8f0a50cd" x-amz-server-side-encryption AES256 x-cache Hit from cloudfront content-type image/jpeg cache-control public,max-age=31536000,immutable accept-ranges bytes content-length 387068 x-amz-cf-id BXigUoSvVXUrEmII2PrjrC4HwYCUKbQc82WlGOS4em-pKMBdjPAGxQ==

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Robinhood (Financial)

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| pwdVisibility

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			robinhood-verify.com/	1969-12-31 23:59:59	Name: session Value: eyJjc3JmX3Rva2VuIjoiNGI4ZGQ2MzczNDI5NWU2ZDM2YjQ4NzQ1NDk2ZDQxM2JhZmNlZDliMCJ9.ZTeMxQ.Z6HzfDST2nOIemTamHsLayi4Gdw

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdn.robinhood.com
robinhood-verify.com
18.66.97.118
185.193.127.130
01373b02ad74b5c99cc5abd66cc1acf1cc4fffc85a51a16212e6f40d0de3f126
6d8de7f5ce2af84984e99a2f5fad176a85f4fb881c307afd7755c56b0aba2af0
8245ee9d3985889e9a8b272db89ba0053661ebbd9102e53d5fb00afb1bb4a5bc
e891b25f30d47facfb5aec2ba177b329cfc57a98ee098ec9a31bf7b27385ab7d

robinhood-verify.com Open in urlscan Pro 185.193.127.130 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page Statistics

4 Requests

100 %HTTPS

0 %IPv6

2 Domains

2 Subdomains

2 IPs

2 Countries

389 kBTransfer

391 kBSize

1 Cookies

0 Outgoing links

Redirected requests

4 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

1 JavaScript Global Variables

1 Cookies

Indicators

robinhood-verify.com Open in urlscan Pro
185.193.127.130 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

4
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

389 kB
Transfer

391 kB
Size

1
Cookies

4 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!