robinhood-chain[.]org

This domain, robinhood-chain.org, is an impersonation site designed to mimic the Robinhood brand. The page title "Just a moment..." suggests the site employed a challenge page, likely to obscure its true phishing or credential harvesting intent from users and automated scanners. The threat posed is brand impersonation, potentially used to trick users into providing login credentials, financial information, or downloading malicious content under the guise of the legitimate Robinhood service.

Technical analysis reveals the site was registered through Cloudflare, Inc. on 2026-02-21, a very recent creation date. It is hosted on IP address 172.67.139.118, which is assigned to AS13335 Cloudflare, Inc. and located in the United States. The SSL certificate was issued by Google Trust Services / WE1. VirusTotal detection shows 3 out of 95 vendors flagged the site as malicious, with specific flags from Gridinsoft, SOCRadar, and Trustwave. The domain appears on three blocklists.

The domain currently has a status of DOWN/OFFLINE. The risk level is assessed as high due to the confirmed brand impersonation, recent creation date, and active flagging by security vendors, indicating a clear intent to deceive users.