rpcnodeconnection[.]xyz

This domain is flagged as an elevated-risk credential harvesting site specializing in brand impersonation of WalletConnect, a protocol for connecting decentralized applications to cryptocurrency wallets. Analysis indicates the domain was designed to intercept wallet connection requests and harvest authentication credentials or private keys from unsuspecting users. Infrastructure analysis reveals the domain rpcnodeconnection.xyz was registered on December 06, 2025, through Global Domain Group LLC. It resolves to Cloudflare IP 2a06:98c1:3120::3 (AS13335) located in the United States. The site lacks SSL encryption and displays a page title of 'WalletConnect,' directly mimicking the legitimate service. Security vendor detection on VirusTotal shows 17/95 engines flagging the domain as malicious. The domain appears on two security blocklists: PhishDestroy and PhishingDB. At the time of assessment, the site has been taken offline, though historical DNS records confirm its previous operational status. Mitigation requires immediate action from security teams and end users. Network administrators should implement DNS-level blocking for rpcnodeconnection.xyz and monitor for connections to 2a06:98c1:3120::3. Cryptocurrency wallet users should verify all connection prompts by checking domain names in their browser address bar and avoiding any site not served over HTTPS. Organizations should educate users about the risks of wallet connection phishing, particularly the prevalence of fake RPC node domains. Security teams are advised to review logs for any historical connections to this domain and investigate potential credential exposure or unauthorized wallet access.