robinhoodloginn[.]gitbook[.]io

robinhoodloginn.gitbook.io was registered on March 24, 2026 and resolves to the Cloudflare‑owned address 104.18.40.47, which is geolocated to Canada. The domain is served through Cloudflare’s infrastructure, identified by the nameservers dahlia.ns.cloudflare.com and hugh.ns.cloudflare.com and the presence of HTTP/3. TLS termination is provided by a Google Trust Services certificate issued to “WE1”, confirming that the site uses a legitimate certificate chain but does not authenticate the underlying content. The site has been flagged by multiple security platforms: VirusTotal’s recent scan recorded 16 detections out of 95 scanned vendors, and the domain appears on one public blocklist. PhishDestroy has already listed the domain as malicious, and the current HTTP response is a 403 status code, indicating that direct content retrieval is being blocked by the hosting provider. The domain is classified as a brand‑impersonation campaign targeting Robinhood, with the explicit intent of credential phishing. Publicly observable artifacts stop at the HTTP 403 response; the exact phishing landing page content, credential collection mechanisms, or any associated command‑and‑control infrastructure have not been disclosed in open sources. Consequently, while the infrastructure is confirmed active, the full scope of the phishing workflow—including any redirects, payloads, or exfiltration endpoints—remains unknown pending deeper investigation or sink‑hole data. Defenders should immediately block 104.18.40.47 and the fully qualified domain name robinhoodloginn.gitbook.io at perimeter and DNS layers. Continuous monitoring of Cloudflare‑hosted domains that mimic Robinhood branding is advised, and any inbound traffic to the IP should be logged and, where possible, redirected to a safe sinkhole for further analysis. End‑user awareness campaigns should highlight the legitimate Robinhood login URL and advise users to verify TLS certificates and domain spelling before entering credentials.