rkgen-claim[.]app

The domain rkgen-claim.app was a crypto drainer phishing site designed to steal cryptocurrency from victims by tricking them into connecting their wallets. Unlike typical brand impersonation schemes, this site did not mimic a known brand or use a recognized drainer kit. As of the latest verification, rkgen-claim.app has been taken offline, but its prior activity poses a continued risk to users who may have interacted with it.

Technical analysis shows that rkgen-claim.app was flagged by 2 of 95 security vendors on VirusTotal, including G-Data and Seclookup. It appeared on 2 security blocklists, specifically PhishDestroy and ScamSniffer, and was included in 1 AlienVault OTX threat intelligence pulse. The domain was registered through Web Commerce Communications Limited on February 21, 2026, with Cloudflare nameservers (rudy.ns.cloudflare.com and suzanne.ns.cloudflare.com). No IP address or SSL issuer details were available, and the site did not display a page title. MX records pointed to rkgen-claim.app with a priority of 10.

Users who connected a wallet to rkgen-claim.app should immediately revoke any token approvals granted to the site and transfer remaining funds to a new, secure wallet. To revoke approvals, use tools like Etherscan's Token Approval Checker or similar services for other blockchains. Report the domain to platforms such as Google Safe Browsing, PhishTank, or local cybercrime authorities to aid in broader mitigation efforts. Monitor wallet activity for unauthorized transactions and enable transaction signing confirmation for future interactions.