myrpc[.]app

The domain myrpc.app was observed resolving to the IPv4 address 185.255.122.10, which is allocated to Virtual Systems LLC (AS30860) in Ukraine. The registration record lists Gransy, s.r.o. as the registrar and shows a creation date of 21 February 2026. No TLS certificate is presented for the host, indicating that HTTPS connections are not supported. DNS resolution is provided by the freednsdedi.com pair of authoritative nameservers mars1.freednsdedi.com and mars2.freednsdedi.com.

The site’s HTTP response, captured before the domain was taken offline, returned the page title “RPC Browser – Loading…”, a generic label that does not disclose functional details. The page is classified as a wallet/seed phishing portal that impersonates the 1inch brand, targeting users who may enter private keys or seed phrases. Reputation scoring from Gridinsoft assigns a trust score of 0 out of 100, and the domain appears on four independent security blocklists, including PhishDestroy, Polkadot, Enkrypt, and Codeesura, all of which have already blocked the host. VirusTotal analysis recorded four positive detections out of ninety‑three scanning engines, reinforcing the malicious intent. Because the site is currently offline, further content inspection is not possible, and the precise phishing workflow, such as form fields or redirection logic, remains uncertain.

Defenders should immediately block the IP address 185.255.122.10 and the domain name myrpc.app at network perimeters and DNS resolvers. Continuous monitoring of the associated AS30860 range is advised to detect potential re‑deployment of similar infrastructure. Adding the domain to internal threat intel feeds and sharing the indicator set with industry‑wide blocklist providers will help mitigate reuse. Organizations that rely on the 1inch platform should educate users about unsolicited requests for private keys and enforce the use of hardware wallets or trusted applications for any RPC interactions.