Criticalscore 76 · flagged Friday, August 28, 2026

robinhood-drop.xyz

Appeared in the .xyz zone on Friday, August 28, 2026; by the end of that day the census found active website about automotive. Full domain report

Signals, not verdicts. A domain appears here because heuristics matched its name, its infrastructure or the page it served on its first day. Where a model has looked at it, that is shown as an opinion with a confidence, not as a finding. Nothing on this page says a site is malicious. Read the evidence and decide for yourself.

Own one of these names and think the listing is wrong? Tell us and a person will look.

What matched

brand in the name
matched: robinhood
+30
TLD with a high abuse rate
matched: xyz
+8
brand name behind Cloudflare
matched: cloudflare.com
+6
brand name at a retail registrar
matched: Web Commerce Communications Limited dba
+8
brand name at a watch-list registrar
matched: Web Commerce Communications Limited dba
+6
form on a brand-styled page
matched: has_form
+18
Registrar
Web Commerce Communications Limited dba WebNic.cc
Nameserver provider
Nameservers
alla.ns.cloudflare.com, keenan.ns.cloudflare.com
First-day state
active website
HTTP status
200
Page title
AutoCare - Car Repair HTML Template
Has a form
yes
Brand echoed
robinhood

Model opinions

Second opinionlooks like phishingtarget: Robinhoodconfidence 76%· claude-opus-5

Brand-squat name 'robinhood-drop' (airdrop lure) serving a cloaked page: an off-the-shelf 'AutoCare - Car Repair HTML Template' with randomly injected junk tokens (classic anti-detection obfuscation), a blank rendered screenshot, a form, and Sui blockchain/Discord/Twitter links — the shape of a crypto wallet-drainer 'airdrop claim' page trading on the Robinhood name.

First passlooks like abuseconfidence 85%· claude-haiku-4-5

The domain 'robinhood-drop.xyz' is a brand-squat typosquat of Robinhood (financial services), but the actual page content is an 'AutoCare - Car Repair HTML Template' with no login form attempting to capture Robinhood credentials. This is a parked/template page under a misleading name whose purpose appears to be domain speculation or SEO manipulation rather than active phishing impersonation.

A model looked at the screenshot and page text and wrote what it thought. It can be wrong, and it is not a finding.

What the page looked like on Friday, August 28, 2026

Screenshot of robinhood-drop.xyz taken by the zone census on 2026-08-28

Same data as JSON: /api/zone/domain/robinhood-drop.xyz. This page is not indexed by search engines and does not link to the site it describes.