rpcnodesupdate[.]com

This domain was registered on June 30, 2025 through Hostinger Operations UAB and resolves to 104.21.91.222, an address owned by Cloudflare, Inc. (AS13335) located in the United States. The site presented the page title “Update RPC” and was classified as a crypto‑scam that impersonates the Avalanche brand. Gridinsoft assigned a trust score of 0 out of 100, indicating a lack of legitimacy. VirusTotal recorded two detections out of ninety‑five scanning engines, confirming that at least two security vendors have identified malicious behavior.

The domain appears on five public blocklists, including PhishDestroy, ScamSniffer, Polkadot, Enkrypt and Codeesura, further evidencing its abusive nature. The SSL certificate is identified as “WE1”, a low‑trust certificate commonly used in fraudulent deployments. The overall risk level is elevated, and the domain’s current HTTP status is offline, suggesting that the operator has withdrawn the site after exposure. However, the infrastructure—particularly the Cloudflare IP address—remains reusable for future campaigns.

Defenders should add rpcnodesupdate.com to DNS and proxy block policies, monitor the associated IP address for any re‑activation, and consider the related blocklist entries as indicators of compromise. Continuous observation of the Cloudflare‑hosted IP is recommended, as the attacker may repurpose the same address for new malicious domains. Organizations that interact with Avalanche services should treat any contact from this domain as untrusted and disregard any requests to update RPC endpoints.