riversidecorp[.]org

The domain riversidecorp.org was observed as a brand impersonation campaign targeting Apple. It was registered on February 21 2026 through PDR Ltd. d/b/a PublicDomainRegistry.com and resolves to the Cloudflare address 172.67.210.49, which is hosted in the United States under ASN 13335 (Cloudflare, Inc.). No SSL certificate is presented, indicating the site is served over plain HTTP. The page title returned for the host is "Riverside: HD Podcast & Video Software | Free Recording & Editing", a mismatch to the Apple brand but the intelligence explicitly tags the domain as impersonating Apple. The domain appears on three security blocklists and is actively blocked by PhishDestroy, MetaMask, and SEAL.

VirusTotal records show that two of ninety‑three security vendors have flagged the domain, and AlienVault OTX includes it in one threat pulse. Gridinsoft assigns a trust score of zero out of one hundred, reinforcing the malicious assessment. Nameservers are arnold.ns.cloudflare.com and audrey.ns.cloudflare.com, both typical of Cloudflare‑hosted services. As of the report date, July 24 2026, the site is taken offline, limiting immediate exposure but leaving the infrastructure artifacts available for attribution and future tracking.

Uncertainties remain regarding the actual landing‑page content and specific tactics used to lure Apple users, as the page has not been captured and no SSL certificate is present. Defenders should add riversidecorp.org to block lists and ensure existing URL filtering solutions reference the three known blocklists. Monitoring for re‑registration of the domain or reuse of the same IP address range is advisable, as is reviewing other domains that share the same Cloudflare nameservers for potential related activity. Incident response teams should audit recent Apple‑related credential submissions for possible compromise and reinforce user awareness about brand‑impersonation scams that may not rely on visual similarity alone.