robinhoodvotes[.]live

Analysis of robinhoodvotes.live identifies a high-risk brand impersonation domain registered on July 13, 2026 through Global Domain Group LLC. The domain resolves to IP 172.67.212.144 and presents a page titled 'Token', suggesting a focus on cryptocurrency or authentication credentials. SSL certificate issued by Google Trust Services indicates encrypted communication, a common tactic to appear legitimate. As of July 14, 2026, the domain remains active with minimal detection coverage: one security vendor flags it on VirusTotal, and AlienVault OTX lists it in two threat intelligence pulses. The specific phishing kit or payload is not yet confirmed, but the combination of a recent registration, brand impersonation of Robinhood, and token-related page title aligns with credential harvesting or fraudulent token distribution schemes. Defenders should treat this domain as active and malicious, block resolution at network level, and monitor for related infrastructure using the IP 172.67.212.144 or registration details from Global Domain Group LLC. Further analysis of the page content is required to determine exact attack vectors or payload delivery mechanisms.