roobiinhood-us-signin[.]godaddysites[.]com

The domain roobiinhood-us-signin.godaddysites.com is identified as a brand impersonation phishing site targeting Robinhood, a financial services platform. Analysis confirms the domain was designed to deceive users into submitting login credentials by replicating the official Robinhood sign-in interface. The page title, "Róbinhood Login | Log in to My Account," closely mirrors legitimate branding, increasing the likelihood of successful social engineering attacks. Infrastructure analysis reveals the domain was registered through GoDaddy.com, LLC on February 21, 2026, and resolves to the IP address 13.248.243.5, hosted on Amazon.com, Inc. (AS16509). The SSL certificate is issued by GoDaddy.com, Inc. under the Go Daddy Secure Certificate Authority - G2. The domain appears on one security blocklist and is flagged by 19 of 95 security vendors on VirusTotal. Detection engines classify it as a phishing threat, with no legitimate use case identified. The domain is currently offline, but similar threats may reemerge. Organizations and users are advised to block the domain and its associated IP (13.248.243.5) at the network level. Security teams should monitor for phishing campaigns impersonating financial platforms, particularly those using misspelled or visually similar domain names. End-users should verify domain authenticity before entering credentials and enable multi-factor authentication on financial accounts to mitigate credential theft risks.