rh[.]maiv[.]today

The domain rh.maiv.today has been identified as a brand impersonation threat, specifically targeting the financial services brand Robinhood. The domain is currently offline, which suggests that it may have been taken down by security measures or abandoned by the threat actors.

Analysis indicates that rh.maiv.today was flagged by 15 of 95 VirusTotal security vendors, highlighting the elevated risk level associated with this domain. The domain was registered through GoDaddy.com, LLC, and resolved to the IP address 172.67.161.176, which is located in the United States and is part of the AS13335 Cloudflare, Inc. network. The domain was created on March 16, 2025, and currently appears on 1 security blocklist. The SSL certificate for the domain was issued by Google Trust Services, which could have been used to lend a false sense of security to potential victims. The page title, 'Robinhood: 24/5 Commission-Free Stock Trading Investing,' closely mimics the legitimate Robinhood website, enhancing the likelihood of user deception.

Given the current status of the domain as offline, it is recommended that organizations and individuals continue to monitor for any reactivation. Security teams should ensure that their intrusion detection systems and firewalls are updated with the latest blocklists to prevent access to this domain if it becomes active again. Additionally, user education and awareness campaigns should emphasize the importance of verifying the authenticity of financial websites and avoiding clicking on suspicious links or entering personal information on unverified domains.