rpc-secured[.]app

The domain rpc-secured.app has been identified as a credential theft site designed to harvest login credentials from users under the guise of an RPC (Remote Procedure Call) service interface. Analysis indicates the site presents a deceptive loading page titled 'RPC Browser - Loading...' to create a false sense of legitimacy. As of the latest verification, the domain has been taken offline, though prior activity suggests it was actively targeting unsuspecting users seeking RPC-related tools or services. Infrastructure analysis reveals the domain was registered on May 11, 2026, through Gransy s.r.o. d/b/a subreg.cz, a registrar frequently associated with domains exhibiting suspicious behavior. The domain resolved to the IP address 185.255.122.10, an address previously linked to other low-reputation hosting environments. Despite its malicious functionality, the domain remained undetected by security vendors, with zero flags out of 95 engines on VirusTotal. The SSL certificate was issued by Let's Encrypt, a common tactic to lend an appearance of legitimacy to phishing infrastructure. No additional blocklist entries or trust scores were recorded at the time of analysis, though the domain's creation date and registrar choice raise significant red flags. Current status confirms rpc-secured.app is offline, but the infrastructure and tactics observed warrant continued monitoring. Organizations and individuals are advised to block the domain and its associated IP address (185.255.122.10) at the network perimeter. Users who may have interacted with the site should immediately reset credentials for any accounts accessed during the potential exposure window. Security teams are encouraged to review logs for connections to the IP or domain and to monitor for similar patterns, such as domains impersonating RPC services with Let's Encrypt certificates and recent creation dates. Proactive threat hunting for related infrastructure is recommended, given the domain's undetected status on public scanning platforms.