public company · US
Robinhood
Robinhood Markets, Inc.
- Primary official domain
- robinhood.com
- Reviewed official domains
- 1 (directory review; organization has not verified)
- Directory source
- BreachScout directory · Suggest a correction
Matching domains, 30 days
50
registrable domains containing the brand; source date or last feed observation
First source-reported, 30 days
0
domains first source-reported within 30 days
First observed, 30 days
53
domains first observed by DomainSpoof in feeds
Email policy (primary domain)
DMARC quarantine
SPF Over lookup limit (18 of 10) · Mail: Receives mail (5 MX hosts) · checked 2026-10-19 · published policy
What we watch for
Hostnames in phishing feeds and certificate logs are matched on these brand tokens; feed target labels are matched on the aliases. Generated spellings (typos, lure words, look-alike characters, other top-level domains) are derived from the official domains and tokens and checked against feeds, certificate logs and DNS.
- Brand tokens
- robinhood
- Label aliases
- Robinhood
- Official domains
- robinhood.com (all)
- Generated spellings
- 120 tracked · 70 observed somewhere · 50 not observed (all)
- Can receive mail
- 32 spellings and 9 reported domains publish MX records · mail at Above.com parking (parking placeholder) 12 · h-email.net (parking placeholder) 6 · hostedmxserver.com 4 · 14 more (70 spellings and 50 reported domains of the last 30 days checked; MX shows the domain can receive mail, not who operates it)
Matching domains with source reports or listings
Source claims are shown separately from our company matches. Default scope: brand in hostname. Choose “All associations” to include source-labelled matches on other sites.
| Domain / hostname | Source claim | Company match (DomainSpoof) | Date (mixed basis) | Latest DNS | Sources / records | Finding details |
|---|---|---|---|---|---|---|
robinhoodchain[.]blockscout[.]comMail: MXSPFDMARC · checked 2026-10-19mail at Google (consumer mailbox) · DMARC policy reject · sends via Proton, Google, SendGrid | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-20Observed in feed | Alive104.26.0.65CloudflareCloudflare (AS13335) · US104.26.1.65CloudflareCloudflare (AS13335) · US172.67.72.116CloudflareCloudflare (AS13335) · US2606:4700:20::681a:141CloudflareCloudflare (AS13335) · US2606:4700:20::681a:41CloudflareCloudflare (AS13335) · US2606:4700:20::ac43:4874CloudflareCloudflare (AS13335) · USchecked 2026-10-20 05:00 UTC | 1 source · 1 record | Details |
robinhood-chain-testnet[.]free[.]nfMail: MXSPF · checked 2026-10-19mail at iFastNet (web / mail hosting) | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-20Observed in feed | Alive185.27.134.24 · Confirmed phishing host address (DomainSpoof, 48 hours)WILDCARD-AS Wildcard UK Limited (AS34119) · GBchecked 2026-10-20 04:55 UTC | 1 source · 1 record | Details |
acc0unt[.]login[.]robinhood[.]mwtechti[.]comMail: MXSPF · checked 2026-10-19mail at Titan (web / mail hosting) · sends via Titan | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-20Observed in feed | Alive178.128.80.227 · Confirmed phishing host address (DomainSpoof, 48 hours)DigitalOceanDigitalOcean (AS14061) · USchecked 2026-10-20 05:10 UTC | 1 source · 1 record | Details |
poohrobinhood[.]comMail: MXSPF · checked 2026-10-19mail at Namecheap forwarding (mail forwarding) · sends via Namecheap forwarding | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-20Observed in feed | Alive75.2.60.5Amazon Web ServicesAmazon Web Services (AS16509) · USacd89244c803f7181.awsglobalaccelerator.comchecked 2026-10-20 05:00 UTC | 1 source · 1 record | Details |
robinhood-tape[.]techMail: MXSPF · Confirmed phishing host address (DomainSpoof, 48 hours) · checked 2026-10-19mail at REG.RU (web / mail hosting) · sends via REG.RU | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-20Observed in feed | Alive37.140.192.210 · Confirmed phishing host address (DomainSpoof, 48 hours)AS-REG (AS197695) · RUserver125.hosting.reg.ru2a00:f940:2:2:1:1:0:125AS-REG (AS197695) · RUchecked 2026-10-20 05:00 UTC | 1 source · 1 record | Details |
robinhooddrugs[.]comMail: MXSPF · checked 2026-10-19mail at Google (consumer mailbox) · sends via Google | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-20Observed in feed | Alive185.230.63.107WixWix (AS58182) · ILunalocated.63.wixsite.com185.230.63.171WixWix (AS58182) · ILunalocated.63.wixsite.com185.230.63.186WixWix (AS58182) · ILunalocated.63.wixsite.comchecked 2026-10-20 05:00 UTC | 1 source · 1 record | Details |
securewallet-robinhood[.]comMail: MX · Confirmed phishing host address (DomainSpoof, 48 hours), Emerging Threats open block list, Spamhaus DROP (credit: The Spamhaus Project)SPFDMARC · checked 2026-10-19mail at securewallet-robinhood.com · DMARC policy none (monitor only) | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-20Observed in feed | Alive45.153.34.38 · Confirmed phishing host address (DomainSpoof, 48 hours), Emerging Threats open block list, Spamhaus DROP (credit: The Spamhaus Project)TECHTIES-AS - TechTies Inc. (AS197170) · SCchecked 2026-10-20 05:00 UTC | 1 source · 1 record | Details |
home-en-robinhood-cdn[.]free[.]site[.]proMail: MXSPFDMARC · checked 2026-10-19mail at Microsoft 365 (consumer mailbox) · DMARC policy reject · sends via Microsoft 365, retailspf.smtp.com, turbo-smtp.com, SendGrid +1 | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-20Observed in feed | Alive139.162.4.252 · Confirmed phishing host address (DomainSpoof, 48 hours)Akamai LinodeAkamai Linode (AS63949) · SG139-162-4-252.ip.linodeusercontent.comchecked 2026-10-20 05:00 UTC | 1 source · 1 record | Details |
robinhoodilogin[.]tilda[.]wsMail: MXSPFDMARC · checked 2026-10-19mail at Yandex (consumer mailbox) · DMARC policy quarantine · sends via Yandex | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-20Observed in feed | Alive194.48.203.15 · Confirmed phishing host address (DomainSpoof, 48 hours)TILDA-IE-1 (AS205282) · AE194.48.203.16 · Confirmed phishing host address (DomainSpoof, 48 hours)TILDA-IE-1 (AS205282) · AE194.48.203.17 · Confirmed phishing host address (DomainSpoof, 48 hours)TILDA-IE-1 (AS205282) · AEchecked 2026-10-20 05:00 UTC | 1 source · 1 record | Details |
9 registrable domains · 9 hostnames · page 1 of 1
A feed listing or DNS answer alone cannot confirm current phishing. Removal from a feed does not confirm resolution.