rpcnow[.]app

This domain was registered on 2026-03-05 through Gransy s.r.o. d/b/a subreg.cz and is hosted on the IPv4 address 185.255.122.102, which belongs to AS30860 Virtual Systems LLC in Ukraine. The domain resolves to a single A record and uses the authoritative nameservers lunar1.freednsdedi.com and lunar2.freednsdedi.com. An MX record is present pointing to rpcnow.app, indicating that the domain is capable of receiving email. The TLS certificate presented is issued by Let’s Encrypt (R12), confirming that HTTPS connections are encrypted but offering no assurance of legitimacy.

The site currently returns an offline status, yet the page title retrieved during the last crawl reads “RPC Browser – Loading…”, suggesting that the original content was intended to emulate a cryptocurrency interface. The threat classification is a crypto‑related phishing campaign, and the observed phishing kit matches the “Seed Phrase Phishing” template, which typically harvests private seed phrases from victims. Detection telemetry shows that two of ninety‑five VirusTotal scanners flagged the domain, and the domain appears on three external blocklists. It is explicitly blocked by PhishDestroy, MetaMask, and SEAL, indicating that multiple anti‑phishing services have identified it as malicious.

The combination of a recent registration date, a virtual‑system hosting provider, and the use of a reputable SSL certificate is consistent with fast‑flux or throwaway infrastructure often employed by cryptocurrency scammers. While the offline response limits direct observation of malicious payloads, the convergence of the seed‑phrase phishing kit, the crypto‑scam label, and the blocklist inclusions provides strong evidence of abusive intent. Defenders should add rpcnow.app and its associated IP address to network‑level deny lists, monitor DNS queries for the lunar1.freednsdedi.com and lunar2.freednsdedi.com nameservers, and enforce email filtering for any messages originating from the domain’s MX record.