restore-dapps-rpc[.]xyz

This domain, restore-dapps-rpc.xyz, is identified as a high-risk brand impersonation threat targeting WalletConnect, a widely used protocol for connecting decentralized applications to crypto wallets. The site presents itself as a legitimate RPC restoration service under the title 'RPC Restore - Optimize Your Wallet Connection,' likely designed to trick users into exposing wallet credentials or executing malicious transactions. Given its focus on crypto wallet interactions, the domain poses a direct risk of credential theft or crypto asset drainage, particularly for users of decentralized finance platforms or Web3 applications. Analysis of the domain reveals multiple technical indicators supporting its malicious classification. The domain was registered on December 18, 2025, through Web Commerce Communications Limited, a registrar frequently associated with suspicious registrations. It currently resolves to the IP address 104.21.7.213, hosted on Cloudflare's infrastructure (AS13335), which is commonly used to obfuscate the true origin of malicious sites. The domain appears on 5 security blocklists and is flagged by 17 out of 95 security vendors on VirusTotal. Additionally, it lacks an SSL certificate, a red flag for any site handling sensitive user data, particularly in the crypto space. Users who have visited restore-dapps-rpc.xyz or interacted with its content should take immediate action to mitigate potential compromise. First, revoke any wallet connections or permissions granted to the domain via WalletConnect or associated dApps. Second, scan the device used for access with updated security tools to detect any installed malware or unauthorized extensions. Third, monitor connected wallets for unauthorized transactions and consider transferring assets to a new wallet if suspicious activity is detected. Finally, report the domain to relevant security communities to aid in broader threat intelligence efforts.