rabinhood-login[.]gitbook[.]io

The domain rabinhood-login.gitbook.io is currently active and classified as a high‑risk brand‑impersonation operation. It presents a page title that reads "Róbinhood Login | Log in to My Account | Róbinhood Login | Log in to My Account," indicating an attempt to lure victims into entering credentials for a service that resembles Robinhood. The domain is explicitly identified as a credential‑phishing vector targeting users across the internet.

Infrastructure analysis shows the site is served through Cloudflare, with authoritative nameservers dahlia.ns.cloudflare.com and hugh.ns.cloudflare.com. The host resolves to IP address 172.64.147.209, which belongs to AS13335 (Cloudflare, Inc.) and is geolocated in the United States. TLS termination is provided by Google Trust Services under the WE1 certificate, and the service supports HTTP/3. An HTTP 307 redirect is observed, suggesting the site may forward traffic to additional pages after initial access.

Detection data reinforces the malicious assessment. VirusTotal records indicate that 20 out of 95 security vendors have flagged the domain, and the site appears on two independent phishing blocklists, including PhishDestroy and PhishingDB. Gridinsoft assigns a trust score of 0 out of 100, and the domain is listed on two broader security blocklists. The page title, combined with the high vendor detection rate and blocklist presence, provides concrete evidence of a credential‑phishing campaign.

Defenders should block the domain at network and DNS layers, incorporate it into email filtering rules, and monitor for any outbound connections to the associated IP address. Continuous reconnaissance of the domain’s DNS records is advised, as Cloudflare‑hosted infrastructure can be re‑configured rapidly. Organizations should also educate users about the specific page title pattern to reduce the likelihood of credential submission to this fraudulent site.