riverscounselling[.]com

This domain is flagged as an elevated-risk brand impersonation threat targeting Google. Analysis indicates the site was designed to mimic legitimate Google services, likely to harvest user credentials, distribute malicious payloads, or facilitate fraudulent transactions under the guise of a trusted brand. The threat type, brand_impersonation, is confirmed through technical indicators and behavioral patterns observed in the infrastructure. Infrastructure analysis reveals the domain riverscounselling.com was registered through 1API GmbH on August 18, 2022, and resolves to the IP address 142.251.150.119. Detection metrics show the domain appears on one security blocklist, with a Gridinsoft trust score of 0/100. AlienVault OTX records the domain in one threat intelligence pulse, while VirusTotal reports 17 out of 95 security vendors flagging the domain as malicious. The page title, 'Google,' further corroborates the impersonation attempt, aligning with the observed threat type. Mitigation steps for this specific threat include immediate blocking of the domain and associated IP address across network security controls. Organizations should deploy email filtering rules to quarantine messages containing links to riverscounselling.com, as phishing campaigns often leverage such domains in credential harvesting attacks. End-users should be educated on recognizing brand impersonation tactics, particularly the use of lookalike domains and spoofed login pages. Security teams are advised to monitor for related indicators of compromise, including the registrar (1API GmbH) and creation date, which may assist in identifying additional malicious domains registered through the same infrastructure.