rpc-defi[.]app

This domain, rpc-defi.app, operates as a crypto drainer infrastructure designed to siphon cryptocurrency assets from connected digital wallets. Analysis indicates the site employs deceptive decentralized finance (DeFi) interfaces to trick users into authorizing malicious smart contract transactions, enabling unauthorized fund transfers without explicit consent. The threat specifically targets wallet private keys and session tokens through fake RPC endpoints, making it particularly dangerous for users interacting with blockchain applications. Infrastructure analysis reveals the domain was registered on April 16, 2026, through Gransy s.r.o. d/b/a subreg.cz, a registrar frequently associated with high-risk domains. It currently resolves to the IP address 185.255.122.89, which hosts multiple confirmed malicious endpoints. Detection metrics show only 1 of 95 security vendors on VirusTotal flagged this domain at the time of analysis, suggesting either recent deployment or effective evasion techniques. The domain has since been taken offline, but residual risk remains for users who previously interacted with it. Users who visited rpc-defi.app should immediately revoke all connected wallet authorizations through their wallet provider's interface. All active sessions should be terminated, and any associated browser extensions or cached data cleared. Wallets used on this domain must be considered compromised; users should transfer remaining assets to new wallets with fresh seed phrases. Network-level indicators, including the IP 185.255.122.89 and domain registration details, should be added to security monitoring systems to detect potential follow-up attacks. Continuous monitoring of transaction histories is recommended for at least 30 days post-exposure to identify delayed unauthorized transfers.