robinhoodmobileauto[.]com

Analysis of robinhoodmobileauto.com indicates this domain was actively impersonating the Robinhood brand as part of a brand impersonation scam. Registered on June 19, 2025, through Wix.Com Ltd., the domain resolved to IP address 34.149.87.45, hosted on Google Cloud infrastructure (AS396982). The page title, 'Robinhood Mobile Auto | mobile auto repair | Cumming, GA, USA,' suggests an attempt to deceive users by combining the Robinhood brand with unrelated services, a common tactic in phishing operations to bypass casual scrutiny. The domain was flagged by 16 of 95 security vendors on VirusTotal and appears in 15 AlienVault OTX threat intelligence pulses, indicating widespread detection.

It was also blocked by PhishDestroy and listed on one security blocklist. The site employed Wix hosting, React for frontend development, and Google Cloud CDN, with HSTS and HTTP/3 enabled, reflecting a technically competent setup typical of modern phishing campaigns. As of the report date, the domain returns an HTTP 404 status and is marked as offline, though this does not preclude future reactivation.

The SSL certificate, issued by Google Trust Services, remains valid, which may be leveraged in future malicious activity. Defenders should treat this domain as a confirmed brand impersonation threat, particularly given its association with Robinhood and its presence in multiple threat intelligence feeds. Network-level blocks and monitoring for re-emergence are recommended, along with alerting users who may have interacted with the domain prior to its takedown.