rpcrefresh[.]app

This domain, rpcrefresh.app, is identified as a high-risk phishing site targeting cryptocurrency wallet users. Analysis indicates the site impersonates legitimate wallet support services, presenting a fraudulent interface titled 'Crypto Wallet Issues? You're Covered!' to deceive victims into disclosing private keys, recovery phrases, or login credentials. The intent is to facilitate unauthorized access to digital assets, leading to potential financial theft and account compromise. Infrastructure analysis reveals the domain was registered on January 07, 2026, through Gransy, s.r.o., and resolves to IP address 185.255.122.10, hosted on Autonomous System AS30860 (Virtual Systems LLC, UA). Security vendor detections on VirusTotal report 17 out of 95 engines flagging the domain as malicious. The site appears on three security blocklists, including entries from domain reputation and cryptocurrency-specific threat feeds. The SSL certificate is issued by Let's Encrypt (R13), a common tactic to lend superficial legitimacy to phishing infrastructure. Users who visited rpcrefresh.app should immediately revoke any permissions granted to the site via wallet browser extensions or dApps. All credentials, recovery phrases, or private keys entered on the site must be considered compromised and should be migrated to new, secure wallets. Monitor connected accounts for unauthorized transactions and report the incident to relevant cryptocurrency platforms. Block the domain and associated IP in network security controls to prevent further exposure. Review browser extensions and connected applications for signs of compromise, as phishing sites often deploy secondary payloads or request persistent access.