openrpc[.]online

This domain is flagged as an elevated-risk brand impersonation threat specifically targeting Avalanche, a prominent blockchain platform. Analysis indicates the site is designed to deceive users into interacting with fraudulent decentralized application (dApp) interfaces, likely facilitating unauthorized transactions or credential harvesting under the guise of legitimate RPC services. The page title, 'RPC-Dapps,' further corroborates the intent to mimic Avalanche’s infrastructure, increasing the likelihood of successful social engineering attacks against cryptocurrency users. Infrastructure analysis reveals multiple high-confidence indicators of malicious activity. The domain openrpc.online was registered on February 21, 2026, through NameSilo, LLC, a registrar frequently associated with abusive registrations. It resolves to the IP address 196.251.100.87, which has been linked to prior phishing campaigns. Detection metrics show 10 out of 95 security vendors on VirusTotal flagging the domain as malicious, while AlienVault OTX lists it in one threat intelligence pulse. The domain appears on a single security blocklist, and Gridinsoft assigns it a trust score of 0/100, indicating no legitimate use. The combination of recent registration, low detection thresholds, and association with known malicious infrastructure underscores the elevated risk posed by this domain. Mitigation measures should focus on disrupting user interaction with the fraudulent domain and preventing further exploitation. Network-level blocking of the IP address 196.251.100.87 and the domain openrpc.online is recommended to prevent access. Users of Avalanche or related dApps should be alerted to verify the authenticity of RPC endpoints and avoid interacting with unofficial or recently registered domains. Wallet providers and crypto platforms are advised to monitor for transactions originating from this domain and implement warnings for users attempting to connect to it. Given the domain’s current offline status, continuous monitoring for re-registration or similar impersonation attempts is critical to preempt future campaigns.