robiinhud-logiin[.]gitbook[.]io

Analysis of the domain robiinhud-logiin.gitbook.io indicates active brand impersonation targeting Robinhood, a financial services platform. The domain, registered on March 30, 2014, resolves to the IP address 104.18.40.47 and is currently flagged by 13 of 95 security vendors on VirusTotal. The page title, 'Róbinhood Login | Róbinhood Login,' closely mimics the legitimate Robinhood login portal, though the use of accented characters ('ó') may serve as a distinguishing indicator. Infrastructure analysis reveals the use of GitBook for hosting, alongside Cloudflare and Google Cloud services, with HTTP/3 and HSTS enabled. The domain appears on two security blocklists, including PhishDestroy and PhishingDB, and is assigned a trust score of 0/100 by Gridinsoft. The SSL certificate is issued by Google Trust Services, which does not inherently confirm legitimacy but suggests a level of technical sophistication in the deployment. The domain's creation date predates the impersonation activity, which may indicate either a compromised or repurposed resource. No evidence of a specific phishing kit or additional malicious payloads has been confirmed at this time. Defenders should treat this domain as high-risk and prioritize blocking or monitoring access to it, particularly in environments where Robinhood credentials are used. Further investigation into associated infrastructure, such as the resolving IP and related domains, is recommended to identify potential broader campaigns.