rajlgun[.]org

The domain rajlgun.org was registered on February 21, 2026 through NiceNIC International Group Co., Limited and resolves to the Cloudflare‑owned address 188.114.96.3 (AS13335, United States). The site is currently taken offline, but historical evidence indicates it was used for wallet or seed phishing, targeting users of the Across platform. The page title returned from the now‑inactive host was “RAILGUN – On‑chain ZK Privacy Ecosystem,” a title that does not reference Across but suggests an attempt to masquerade as a blockchain privacy service. No TLS certificate was present at the time of analysis, and the domain relied on Cloudflare nameservers matt.ns.cloudflare.com and venus.ns.cloudflare.com.

Reputation scoring from Gridinsoft assigned a zero‑point trust rating (0/100). Threat‑intel aggregators have listed the domain on three security blocklists, and it is explicitly blocked by PhishDestroy, MetaMask, and SEAL. VirusTotal scans show that five of ninety‑three security vendors flagged the domain, reinforcing the suspicion of malicious intent. The combination of a recent creation date, low trust score, absence of encryption, and multiple blocklist entries aligns with the observed wallet/seed phishing pattern.

Uncertainty remains regarding the exact phishing payload, as the site content was not captured before takedown and the page title does not directly reference Across. Analysts should therefore treat the domain as a high‑confidence indicator of a credential‑stealing campaign aimed at Across users and potentially other blockchain wallets. Defensive actions include adding the domain and its resolving IP to deny‑list rules, monitoring for DNS queries to the Cloudflare nameservers, and ensuring that endpoint security solutions are updated to reflect the five vendor detections reported by VirusTotal.