voterobinhood[.]live

This domain, voterobinhood.live, was registered on July 13, 2026, through Global Domain Group LLC and is actively impersonating Robinhood, a well-known financial services platform. Analysis indicates the domain resolves to IP address 172.67.173.111, which is part of a content delivery network infrastructure often exploited for hosting fraudulent sites. The SSL certificate is issued by Google Trust Services, a common practice among both legitimate and malicious domains to evade browser security warnings. The page title, 'Token,' suggests a focus on cryptocurrency or authentication tokens, aligning with typical phishing tactics targeting financial platforms. Threat intelligence sources reveal that one of 95 security vendors on VirusTotal has flagged this domain, though the specific detection context remains unverified. Additionally, the domain appears in two AlienVault OTX threat intelligence pulses, indicating prior identification in malicious activity tracking. The combination of recent registration, brand impersonation, and minimal but present security vendor detections raises concerns about its intent. Defenders should prioritize monitoring for connections to 172.67.173.111 and the domain itself, particularly in environments where Robinhood services are accessed. The use of a content delivery network complicates geolocation-based blocking, necessitating DNS-level or certificate-based mitigations. While the exact content of the site has not been analyzed, the 'Token' page title and Robinhood impersonation suggest a likely credential harvesting or fraudulent token distribution scheme. Organizations should treat this domain as high-risk until further analysis or takedown occurs.