riversidecorp[.]app

Analysis of riversidecorp.app, created on February 21, 2026 and currently taken offline, shows multiple indicators of a brand impersonation campaign targeting Apple. The domain is registered through NiceNIC International Group Co., Limited and resolves to the Cloudflare address 172.67.173.178, which is associated with AS13335 Cloudflare, Inc. in the United States. No SSL certificate is present, and the site is served from Cloudflare nameservers justin.ns.cloudflare.com and margot.ns.cloudflare.com, suggesting the infrastructure is leveraged for fast content delivery rather than security.

The page title returned by the host, "Riverside: HD Podcast & Video Software | Free Recording & Editing," bears no relation to Apple, indicating a mismatch between the advertised service and the claimed brand. VirusTotal scans have reported 2 detections out of 95 security vendors, and the domain appears on three external blocklists, including PhishDestroy, MetaMask, and SEAL, reinforcing the malicious classification. Gridinsoft assigns a trust score of 0 out of 100, underscoring the low credibility of the host.

While the exact phishing kit or page content has not been disclosed, the convergence of a brand impersonation label, low trust metrics, and multiple blocklist listings provides sufficient evidence for defensive action. Security teams should continue to block the domain at perimeter filters, monitor DNS queries for the associated IP, and update threat intelligence feeds with the observed indicators. Further investigation of the site content, should it reappear, would be required to confirm any credential harvesting mechanisms.