robiinhoid-logix[.]gitbook[.]io

This domain, robiinhoid-logix.gitbook.io, was created on February 21, 2026 and is currently resolved to the Cloudflare‑owned address 104.18.40.47 located in the United States. The site is served through Cloudflare DNS (dahlia.ns.cloudflare.com, hugh.ns.cloudflare.com) and presents a TLS certificate issued by Google Trust Services under the WE1 intermediate, indicating a valid HTTPS endpoint. HTTP requests receive a 307 temporary redirect response, and the page title returned by the server reads “Róbinhood Login | Log in to My Account”, which directly references the Robinhood brand. The infrastructure has been classified as a credential‑phishing campaign targeting Robinhood users, and it is listed as high‑risk and active in threat feeds. Blocklist coverage includes PhishDestroy and PhishingDB, and the domain appears on two additional security blocklists. VirusTotal analysis shows that 13 of 93 scanning engines flagged the domain, reinforcing the malicious assessment. Observed technologies include GitBook, Google Cloud services, HSTS enforcement, Google Cloud Trace, and support for HTTP/3, all typical of a legitimate content‑hosting platform being abused. At present, no additional page content has been captured beyond the title, so the exact phishing payload cannot be confirmed, but the available evidence is sufficient to warrant defensive action. Organizations should add the domain and its resolving IP to outbound and inbound filtering rules, monitor DNS queries for the domain, and advise users to avoid any unsolicited login prompts claiming to be from Robinhood.