rh[.]pafft[.]today

The domain rh.pafft.today has been identified as a brand impersonation threat targeting Robinhood, a financial services platform. Analysis confirms the domain is currently offline, though it previously hosted a phishing page mimicking Robinhood’s official interface, as indicated by the page title 'Robinhood: 24/5 Commission-Free Stock Trading Investing.' This activity aligns with credential harvesting or fraudulent investment schemes aimed at users of the legitimate service. Infrastructure analysis reveals the domain was registered on February 15, 2025, through GoDaddy.com, LLC. It resolves to the IP address 104.21.18.104, associated with AS13335 (Cloudflare, Inc.) in the United States. Security vendors on VirusTotal flagged the domain at a rate of 19 out of 95, indicating moderate to high confidence in its malicious nature. The domain appears on one security blocklist and lacks an SSL certificate, further reducing its legitimacy. No historical DNS records suggest prolonged operational use, consistent with short-lived phishing campaigns. Current status confirms the domain is offline, though residual risk remains due to potential re-activation or migration to similar infrastructure. Organizations are advised to block the domain and its resolving IP at the perimeter. Users should be alerted to verify the authenticity of financial service communications, particularly those soliciting login credentials or investment actions. Monitoring for newly registered domains impersonating Robinhood or other financial brands is recommended to preempt similar threats.