rivagency[.]xyz

This domain, rivagency.xyz, is actively engaged in credential phishing targeting users of Riverside, a legitimate podcast and video recording software platform. The site impersonates the official Riverside service interface, presenting a fraudulent login portal designed to capture user credentials, including usernames, passwords, and potentially multifactor authentication tokens. Analysis indicates the domain is currently active and resolving to infrastructure associated with malicious activity. Infrastructure analysis reveals the domain was registered on April 09, 2026, through Global Domain Group LLC, a registrar frequently observed in phishing operations. It resolves to the IP address 18.67.93.40, hosted within AS60117 (Host Sailor Ltd) in the Netherlands. The domain is flagged by 3 of 95 security vendors on VirusTotal, appears on one security blocklist (PhishDestroy), and uses a Let's Encrypt SSL certificate issued under the YR2 configuration. The page title, 'Riverside: HD Podcast & Video Software | Free Recording & Editing,' precisely matches the branding of the legitimate Riverside service, increasing the likelihood of successful deception. Current status confirms the domain remains active and accessible, posing an ongoing threat to users seeking podcast recording tools. Organizations and individuals are advised to block the domain and its associated IP at the network perimeter. Endpoint protection systems should be updated to include rivagency.xyz in phishing and malicious domain filters. Users who may have interacted with the site should immediately reset credentials on the legitimate Riverside platform and monitor accounts for unauthorized access. Network administrators are recommended to review logs for connections to 18.67.93.40 and investigate potential credential exposure incidents.