app[.]riversnetwork[.]net

The domain app.riversnetwork.net is an active brand‑impersonation site targeting Google. It was registered on February 21 2026 through PDR Ltd. d/b/a PublicDomainRegistry.com and uses the nameservers ns1.verification‑hold.suspended‑domain.com and ns2.verification‑hold.suspended‑domain.com. The TLS certificate presented is identified as “WE2”, and the site returns HTTP 200 responses, indicating a fully operational web server. Infrastructure analysis shows the domain resolves to IP 142.250.181.228, which belongs to AS15169, owned by Google LLC, placing the host within the United States. Despite the legitimate‑looking address range, the domain has a Gridinsoft trust score of 1 / 100 and is listed on two security blocklists. VirusTotal scans have flagged the domain by nine out of ninety‑five security vendors, and the site is already blocked by PhishDestroy and ScamSniffer. The landing page reports a title of “Google”, confirming the intent to masquerade as an official Google service. No additional content is disclosed in the available intelligence, so the exact phishing vector (credential‑harvesting forms, malicious downloads, or redirection) remains uncertain. The combination of brand impersonation, a matching Google‑owned IP, and a low trust score suggests the site is being used to lure victims into submitting Google credentials or to deliver further malicious payloads. Defenders should immediately add app.riversnetwork.net to DNS‑based deny lists and web‑filtering policies. Email gateways should be tuned to detect messages that reference this domain or contain suspicious Google‑related branding. Continuous monitoring of the domain’s resolution and any changes to its TLS certificate is advised, as the operators may pivot to alternative IP ranges. Incident response teams should treat any credential submissions to this site as compromised and enforce password resets for affected accounts.