rpcreload[.]com

The domain rpcreload.com is currently active and classified as a high‑risk generic phishing site. It was registered on March 24 2026 through Gransy, s.r.o. and resolves to the IPv4 address 185.255.122.10, which is announced by AS30860 (Virtual Systems LLC) in Ukraine. The infrastructure uses the public nameservers mars1.freednsdedi.com and mars2.freednsdedi.com, and the web service presents a valid Let’s Encrypt certificate (R12) despite the malicious intent.

The landing page carries the title “Crypto Wallet Issues? You’re Covered!” and immediately issues an HTTP 302 redirect, a pattern commonly used to funnel victims toward credential‑stealing forms. The combination of a cryptocurrency‑focused lure and the redirect behavior aligns with the generic phishing categorisation. No additional content beyond the title and redirect has been observed, leaving the exact payload or credential capture mechanism uncertain.

Detection data shows the domain is blocked by PhishDestroy and appears on a single security blocklist. VirusTotal reports a single positive out of 95 scanned vendors, indicating limited but existent detection. The Gridinsoft trust score of 1 out of 100 further underscores the low confidence in the domain’s legitimacy. While the low number of VT detections suggests limited exposure, the presence on a dedicated phishing blocklist and the extremely low trust score confirm malicious intent.

Defenders should add rpcreload.com to network and DNS blocklists, monitor for any outbound connections to 185.255.122.10, and inspect TLS traffic for the Let’s Encrypt certificate fingerprint to catch potential bypass attempts. Continuous threat‑intel feeds should be consulted for any emerging indicators, and incident response teams should be prepared to investigate any user reports of cryptocurrency‑related credential requests that reference this domain.