robinhlxd-lxgin[.]gitbook[.]io

Analysis of the domain robinhlxd-lxgin.gitbook.io indicates a high-risk brand impersonation threat targeting Robinhood users. The domain, registered on March 30, 2014, is hosted through Cloudflare and resolves to the IP address 172.64.147.209. The page title explicitly mimics Robinhood's login portal, displaying 'Róbinhood Login - Log in to My Account' twice, which aligns with the reported brand impersonation classification. Infrastructure analysis reveals the use of GitBook, Google Cloud, and Cloudflare technologies, alongside HTTP/3 and HSTS protocols, suggesting a structured hosting environment commonly exploited for phishing campaigns. The domain is actively flagged by four security blocklists, including PhishDestroy, PhishingDB, OISD, and BLP-Malware. Additionally, 13 out of 95 security vendors on VirusTotal have detected this domain as malicious. A Gridinsoft trust score of 0/100 further corroborates its high-risk status. The SSL certificate is issued by Google Trust Services, which does not mitigate the threat, as legitimate certificates are frequently abused in phishing operations. Defenders should treat this domain as an active threat. The combination of an established registration date, brand-specific page title, and multiple security vendor detections indicates a deliberate impersonation attempt rather than an opportunistic scam. No evidence suggests the domain has been taken down or remediated as of July 12, 2026. Organizations should block the domain at the network level and monitor for credential harvesting attempts linked to this infrastructure. Further investigation into associated IPs or certificates may reveal additional compromised assets.