robinhiodlogmx[.]gitbook[.]io

PhishDestroy has identified robinhiodlogmx.gitbook.io as a high-risk domain engaged in a generic phishing campaign specifically targeting Robinhood users. This domain poses a direct threat to individuals seeking to access their Robinhood accounts, as it attempts to harvest login credentials through a fraudulent login page titled 'Róbinhood Login | Log in to My Account'. The site is currently offline, but users should remain vigilant as similar domains may appear.

The technical analysis reveals several concerning indicators. VirusTotal flagged the domain with 16 out of 95 security vendors marking it as malicious. The SSL certificate is issued by Google Trust Services (WE1), which is a legitimate CA but does not vouch for the site's intent. The domain was registered through Cloudflare, Inc and resolves to IP address 172.64.147.209. Created on March 30, 2014, the domain has a long history, yet its current use is clearly fraudulent. Google Safe Browsing specifically flags it for phishing, and it appears on one security blocklist. These data points collectively underscore the high-risk nature of this domain.

PhishDestroy recommends that users who may have interacted with this domain, especially those who entered their Robinhood credentials, should immediately change their passwords and enable two-factor authentication on their accounts. Additionally, monitor account activity for unauthorized transactions and report any suspicious behavior to Robinhood support. As a general practice, always verify the URL before entering sensitive information and avoid clicking on links from unsolicited messages or emails. Staying informed about the latest phishing tactics can help prevent falling victim to such schemes.