rpc-fixers[.]app

This domain, rpc-fixers.app, is actively targeting cryptocurrency users by impersonating RPC Browser, a legitimate remote procedure call interface for blockchain interactions. Analysis indicates the site is designed to function as a crypto wallet drainer, tricking users into connecting their wallets under the guise of troubleshooting or optimization. Once connected, the site may execute unauthorized transactions, siphoning funds to attacker-controlled addresses without the user's consent. Infrastructure analysis reveals the domain was registered on April 30, 2026, through Gransy s.r.o. d/b/a subreg.cz, a registrar frequently associated with high-risk domains. The site resolves to the IP address 185.255.122.102 and uses a Let's Encrypt SSL certificate, which provides HTTPS encryption but does not guarantee legitimacy. As of the latest scan, only 2 out of 95 security vendors on VirusTotal flag this domain as malicious, suggesting it may evade detection by some security tools. The page title, 'RPC Browser - Loading...,' mimics the loading state of legitimate RPC interfaces to appear authentic. Users who have visited rpc-fixers.app or interacted with its content should immediately disconnect any connected wallets and revoke permissions for the domain via their wallet settings. Scan the affected device using updated security tools to detect potential malware or unauthorized scripts. Monitor wallet transactions for unauthorized activity and consider transferring funds to a new wallet if suspicious transactions are detected. Report the domain to relevant security communities and wallet providers to aid in broader mitigation efforts. Avoid re-engaging with the site or any associated links, as the infrastructure may persist even if the current domain is taken down.