Is roblnhoods.com a scam? TrustSniffer's high-risk assessment: 0/100

Security Alert

Fortinet, Google flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

The domain presented to automated visitors only a security interstitial headed "Suspected Phishing". The interstitial states that the destination site has been reported for potential phishing, and it offers a "Learn More" link and an "Ignore & Proceed" option. The captured page carries no products, pricing, forms, contact details or legal identity of its own. The underlying site's purpose and business model therefore cannot be determined from what was captured. What is observable is a very recently created domain whose only visible content is a third-party phishing warning.

Scam/Impersonation Risk

The evidence converges on an elevated, actively cautionary risk posture. The domain is on a confirmed blacklist: a major browser-safety service classifies it under the social-engineering (phishing) category, and a second external blacklist source corroborates this. Two tier-one security vendors independently flag the domain, which supports that listing. The interstitial matches this reputation by warning that the site attempts to steal sensitive information by posing as a safe source. The domain was created only days before the assessment. Phishing infrastructure is typically short-lived and registered shortly before use, and this is consistent with that pattern. The captured page showed no brand impersonation and no conflicting legal identities, because it carries no identity content at all. Those absences do not offset the confirmed blacklist. The behavioural review found no wallet-connection, clipboard-manipulation or hidden-form activity. This reflects what the interstitial exposed, not the behaviour of the destination site, so it cannot clear the site. Evidence:

• Homepage: the page captured is a security warning stating the site "has been reported for potential phishing", with an "Ignore & Proceed" bypass option.
• External reputation: the browser-safety service lists the domain for social engineering, and the second blacklist source and two tier-one vendors corroborate the listing.
• Domain provenance: registered in 2026 (~12 days old, 0.03 years) through NICENIC INTERNATIONAL GROUP CO., LIMITED.
• Web archive: 2 snapshots spanning 2026-10-08 to 2026-10-09, with no established history.

Regulatory Verification Notes

The captured page contains no legal pages, company name, registration number or licence statement. No regulatory standing can be attributed to the operator, and the real-world operator's identity remains unverified. Ownership is not disclosed in registration data either, which is a case of ownership opacity and not an identity contradiction. Opacity is aggravated by the confirmed blacklist and the domain's age. The site claims no licence and no third-party regulatory source supports it. No broker-reputation record matches the domain, so there is no regulator-style signal to weigh either way. A valid certificate is present, but it is a basic domain-validation certificate that confirms only encrypted transport, not who operates the site. Evidence:

• Homepage: no operator name, licence reference, address or contact channel is visible on the captured page.
• Transport encryption: TLS certificate issued by YE2 (DV), valid to 2027-01-05.
• Hosting: served from AS13335 (Cloudflare, Inc., US).
• Registration: created 2026-10-07 and set to expire 2027-10-07, a one-year term from a new registration.

What to Verify Next

Treat the phishing warning as the controlling fact and do not bypass it. Anyone claiming a legitimate relationship with this domain should obtain the operator's legal entity name and then confirm it independently with the relevant company registry and any licensing authority. The supposed operator should be contacted only through an official channel already known from an independent source, such as a published corporate directory or a prior verified relationship. If a link to this domain arrived by message, advertisement or social post, the sender should be contacted through a separate channel to check its origin. If the domain is believed to be mistaken for a brand, the organization concerned should be told, and a report can be filed with the relevant anti-phishing authority. Evidence:

• Homepage: the only action offered is to ignore the warning and proceed, with no contact or identity information to check against.
• External reputation: the blacklisting and the vendor detections are current and are not explained by anything on the captured page.
• Registration data: the owner details are incomplete, so identity can be established only by independent, offline confirmation.

Summary Verdict

The domain is assessed at a critical trust level and carries an elevated risk posture. Current external threat detections decide the outcome. The operator's identity is unverified, and the domain has no history to counterbalance the adverse reputation. The evidence does not support treating this site as legitimate.

Infrastructure Integrity

The domain resolves entirely to Cloudflare edge addresses, and no origin server was observable. Edge-only visibility prevents independent confirmation of where the content is actually hosted and can mask rapid content changes. The fronting service's own phishing interstitial shows that its abuse controls have already acted against this domain. A recognised CDN and WAF is a mitigating factor for availability and basic exposure only. Here it cannot offset the external threat detections or serve as evidence of legitimacy. A young domain with sparse subdomain structure is a minor unconfirmed heuristic and is not treated as a separate risk.

Closing Assessment

The warning should not be bypassed, and the domain should not be used for login, credential entry, payments or any financial interaction. Any contact with it should be limited to passive observation from an isolated environment, and nothing should be downloaded. Organizations should consider blocking the domain at the web-filter or email-gateway level, and anyone who has already submitted credentials or payment details should change those credentials and notify the relevant financial institution.