riverside[.]stream

The domain riverside.stream was registered through Namecheap Inc. on June 24, 2026 and remains active as of the report date, August 01, 2026. Its authoritative DNS is served by damien.ns.cloudflare.com and roxy.ns.cloudflare.com, both Cloudflare nameservers, and the A record resolves to 188.114.96.3. The domain appears on three public security blocklists and is currently listed by PhishDestroy, MetaMask, and SEAL, indicating that multiple downstream protection services have already flagged it as malicious.

A VirusTotal scan involving 91 antivirus and URL‑reputation vendors returned no detections; however, the lack of a positive match does not constitute evidence of benign intent and must be interpreted in the context of other indicators. No additional intelligence such as SSL certificate details, HTTP status codes, page titles, or content analysis has been disclosed, leaving the precise phishing payload and target brand undefined. Given the confirmed presence on blocklists, the association with Cloudflare infrastructure—commonly abused for fast‑flux or proxying malicious content—and the recent creation date, defenders should proactively block the domain at perimeter firewalls, DNS resolvers, and endpoint web filters.

Continuous monitoring of DNS query logs for the IP 188.114.96.3 and the two Cloudflare nameservers is advised, as is periodic re‑scanning on VirusTotal or similar sandboxes to capture any future payload changes. Integration of the domain into threat‑intel feeds and SIEM correlation rules will aid in detecting potential lateral use of the same infrastructure in related campaigns.