rpc-health[.]app

The domain rpc-health.app was registered on March 12, 2026 via Gransy s.r.o. d/b/a subreg.cz and uses the authoritative name servers ns1.freednsdedi.com and ns2.freednsdedi.com. The TLS certificate, identified as R12, was observed for the site. VirusTotal scans recorded four positive detections out of ninety‑four submitted engines, indicating that multiple security vendors flagged the domain as malicious.

The public HTTP response returned the title “Index of /”, and the site is currently offline. Blocking services PhishDestroy, MetaMask, and SEAL have listed the domain, and it appears on three additional security blocklists. No IP address, ASN, or geographic hosting information is provided in the current intelligence, and no safe‑browsing or OTX entries are referenced. Because the page content beyond the title has not been captured, the exact phishing payload or target brand cannot be confirmed at this time.

Defenders should continue to deny traffic to rpc‑health.app, add the domain to perimeter filtering rules, and monitor for any re‑activation. Ongoing observation of the registrar’s activity and the listed name servers may reveal future infrastructure changes. The presence of multiple vendor detections and blocklist entries suggests a non‑trivial malicious operation, and the offline status does not preclude future reuse of the same domain or associated hosting assets. Organizations are advised to treat rpc‑health.app as a confirmed phishing infrastructure and to incorporate it into threat‑intel feeds and incident‑response playbooks.