rpcselects[.]net

Analysis of rpcselects.net, created on 21 February 2026 and registered through NameCheap, Inc., shows a clear pattern of brand impersonation targeting WalletConnect. The domain resolves to IP 198.187.29.28, which belongs to AS22612 (Namecheap, Inc.) and is geolocated in the United States. DNS resolution uses the Namecheap hosting name servers dns1.namecheaphosting.com and dns2.namecheaphosting.com. No TLS certificate was observed, indicating that the site was served over plain HTTP or was unavailable at the time of testing. The HTML title returned by the server was “WalletConnect”, matching the declared brand target.

VirusTotal reports that ten of ninety‑five scanning engines flagged the domain as malicious, providing independent confirmation of its illicit nature. The domain is currently listed on four public security blocklists and has been explicitly blocked by multiple anti‑phishing services, including PhishDestroy, MetaMask, ScamSniffer, and SEAL. These blocklist entries corroborate the high‑risk assessment applied by analysts. As of the report date, 24 July 2026, the site is offline, preventing direct observation of its content or payload. Consequently, details such as the exact phishing kit, credential‑capture form, or redirection behavior remain unknown.

The absence of an SSL certificate further reduces confidence in any potential user interaction, but the combination of brand‑specific title, registrar profile, IP ownership, and multiple vendor detections strongly indicates a deliberate attempt to lure WalletConnect users. Defenders should immediately add rpcselects.net to network‑level deny lists, enforce DNS sink‑hole policies, and monitor the associated IP address for any resurgence of activity. Continuous re‑scanning of the domain is advised, as threat actors may reactivate the site or migrate the campaign to a new domain.