rpc-secure[.]app

This domain, rpc-secure.app, is currently under investigation for credential theft targeting cryptocurrency wallet users. The site presents itself as a recovery or support service for crypto wallet issues, a common tactic to lure victims into submitting sensitive credentials such as private keys, seed phrases, or login details. As of the latest assessment, the domain remains active and has not been flagged by security vendors, indicating it may still be in the early stages of deployment or evading detection through obfuscation techniques. Infrastructure analysis reveals that rpc-secure.app resolves to the IP address 185.255.122.102 and was registered on April 24, 2026, through Gransy s.r.o. d/b/a subreg.cz. The domain employs a Let's Encrypt SSL certificate, which provides basic encryption but does not validate the legitimacy of the site. VirusTotal reports zero detections out of 95 vendors, suggesting the domain has not yet been widely recognized as malicious. The page title, 'Crypto Wallet Issues? You're Covered!', directly appeals to users experiencing wallet-related problems, a red flag for targeted credential harvesting. The current risk level for rpc-secure.app is classified as under investigation due to its active status and lack of prior detection. Users are advised to exercise extreme caution and avoid interacting with the domain. Security teams should monitor the IP address 185.255.122.102 and the registrar subreg.cz for additional malicious domains. Blocklisting the domain at the network level and alerting end-users to the threat are recommended actions. If credentials have already been submitted, immediate revocation and migration to a new wallet are critical to mitigate potential asset loss.