robnhxodlogen[.]gitbook[.]io

PhishDestroy has assessed robnhxodlogen.gitbook.io as a high-risk domain engaged in credential theft, specifically impersonating the Robinhood login page to harvest user passwords. The site, now offline, posed as a legitimate Robinhood portal with the title "Róbinhood Login | Log in to My Account," tricking users into entering sensitive information. This brand impersonation campaign targeted cryptocurrency investors and required immediate action.

The domain was created on March 30, 2014, and resolved to IP address 172.64.147.209, hosted by Cloudflare, Inc. with an SSL certificate from Google Trust Services (WE1). VirusTotal flagged it with 18 out of 95 security vendors marking it malicious, and it appeared on one security blocklist. Google Safe Browsing also flagged it for phishing, confirming the threat. Despite being registered years ago, the domain was weaponized recently for this attack.

To protect against such credential theft, users should always verify URLs before entering login details, enable two-factor authentication on financial accounts, and report suspicious sites to security vendors. Since the site is offline, the immediate risk is reduced, but similar domains may emerge. PhishDestroy recommends monitoring account activity for unauthorized access and using password managers to avoid reusing credentials across platforms.