rpc-update[.]app

This domain is flagged as an elevated-risk credential phishing endpoint designed to harvest user authentication credentials. Analysis indicates the infrastructure was specifically engineered to mimic legitimate remote procedure call (RPC) update mechanisms, a common tactic to deceive enterprise and cloud service users into divulging sensitive login details. Infrastructure analysis reveals the domain rpc-update.app was registered through Gransy s.r.o. d/b/a subreg.cz and resolved to the IP address 185.255.122.89. The domain was created on April 13, 2026, and has been flagged by 2 out of 95 security vendors on VirusTotal. Current status indicates the domain has been taken offline, though historical resolution data and registrar information remain critical for tracking related threat actor activity. No additional blocklist or trust score data is available at this time, but the low detection rate suggests either evasion techniques or recent deployment. Mitigation steps for credential phishing threats include immediate blocking of the domain and associated IP address across all network security controls. Organizations should conduct retrospective log analysis to identify any prior connections to 185.255.122.89 or rpc-update.app, particularly focusing on authentication logs. Users who may have interacted with the domain should be prompted to reset credentials via secure, out-of-band methods. Security teams are advised to monitor for similar domains registered through the same registrar or resolving to the same IP range, as these may indicate related phishing campaigns.