chain-robinhood[.]io

This domain, chain-robinhood.io, is actively impersonating the Robinhood financial services platform as of July 12, 2026. Registered on March 7, 2026, through NiceNIC International Group Co., Limited, the site resolves to 188.114.96.3, hosted on Cloudflare's infrastructure (AS13335). Analysis indicates the domain is configured with Cloudflare nameservers (cartman.ns.cloudflare.com and joan.ns.cloudflare.com) and employs a Let's Encrypt SSL certificate, suggesting an attempt to appear legitimate through standard security practices. However, the site is flagged by four out of ninety-five security vendors on VirusTotal, and it appears on three independent security blocklists, including PhishDestroy and MetaMask's threat feeds. Infrastructure review reveals the use of HTTP/3 and HSTS, which are often leveraged to evade detection and inspection. The domain returns an HTTP 200 status, indicating an operational frontend designed to mimic Robinhood's interface. While the exact phishing kit or backend infrastructure remains unconfirmed, the combination of brand impersonation, Cloudflare hosting, and low trust scores (0/100 from Gridinsoft) strongly suggests credential harvesting or cryptocurrency wallet compromise as the primary objective. Defenders should treat this domain as high-risk and implement immediate mitigation measures. Network-level blocking of 188.114.96.3 and the domain itself is recommended, along with monitoring for related subdomains or newly registered lookalike domains. Organizations should also alert users to the specific threat, particularly those interacting with Robinhood-branded communications or services. Given the domain's persistence since March 2026, it is likely part of a broader campaign, and further indicators may emerge as the operation evolves.