robnhodlogox[.]gitbook[.]io

Analysis indicates that robnhodlogox.gitbook.io is an active credential-phishing domain impersonating Robinhood. The domain resolves to 172.64.147.209, a Cloudflare IP address located in California, and is hosted on GitBook infrastructure. The page title, 'Róbinhood Login | Log in to My Account,' closely mimics the legitimate Robinhood login portal, though the exact visual content of the site has not been analyzed. The domain was registered on May 11, 2026, and remains operational as of July 12, 2026. Technical indicators include the use of GitBook, Google Cloud, HSTS, Google Cloud Trace, and HTTP/3. The domain is flagged by Google Safe Browsing for social engineering and has a Gridinsoft trust score of 0/100. It appears on at least one security blocklist, and 18 of 92 security vendors on VirusTotal have flagged the domain. The SSL certificate is issued by Google Trust Services (WE1), and the site returns an HTTP 307 status code, which may be used for temporary redirects. Defenders should treat this domain as high-risk due to its active status, confirmed brand impersonation, and detection by multiple security mechanisms. Network-level blocking of 172.64.147.209 and the domain itself is recommended. Organizations should also monitor for credential submissions or redirects associated with this infrastructure, as the site is designed to harvest login credentials. Further investigation into GitBook-hosted domains with similar naming patterns may reveal additional phishing activity.