rpcrestore[.]org

This report details the threat posed by the domain rpcrestore.org. The site presented a page titled "WalletConnect" and was specifically designed to impersonate the legitimate WalletConnect brand. The identified scam type is Wallet Connect Phishing, indicating the site's purpose was to deceive users into providing sensitive credentials, such as recovery phrases or private keys, by mimicking a legitimate wallet connection service. This poses a direct threat of cryptocurrency theft.

Technical evidence confirms the malicious nature of the site. VirusTotal flagged the domain with 12 detections out of 95 vendors. It was flagged by security vendors including ADMINUSLabs, alphaMountain.ai, BitDefender, CyRadar, and ESET. The domain is listed on 2 blocklists. It was hosted on the IP address 185.255.122.89, located in Ukraine (UA) and belonging to AS30860 Virtual Systems LLC. The domain was registered through Gransy, s.r.o. and created on 2025-10-02. The site lacked an SSL certificate, and its nameservers were rocket1.freednsdedi.com and rocket2.freednsdedi.com.

As of the analysis, the domain status is DOWN/OFFLINE, meaning the phishing page is currently inaccessible. The risk level is considered high due to the specific impersonation of a widely-used service and the confirmed detections by multiple security vendors, though the immediate threat is mitigated by the site being offline. Users should remain vigilant against similar future threats.