raolgun[.]org

This domain, raolgun.org, is identified as a brand impersonation threat targeting the Across Protocol, a cross-chain bridging platform. Analysis indicates the domain mimics the RAILGUN on-chain zero-knowledge privacy ecosystem, likely to deceive users into interacting with fraudulent smart contracts or draining wallets. The threat type aligns with cryptocurrency theft, where attackers exploit trust in legitimate privacy-focused projects to execute unauthorized transactions or phishing attacks. Infrastructure analysis reveals multiple technical indicators of compromise. The domain was registered through NiceNIC International Group Co., Limited on February 21, 2026, an unusually future-dated creation that may indicate bulk registration for malicious purposes. It resolves to IP address 172.67.181.126, a Cloudflare-associated endpoint often used to obfuscate hosting origins. Security vendor detections on VirusTotal report 7/95 flags, while Gridinsoft assigns a trust score of 0/100. The domain appears on three security blocklists and is actively blocked by wallet security tools, including MetaMask and SEAL. AlienVault OTX records the domain in one threat intelligence pulse, further corroborating its malicious classification. Currently, raolgun.org has been taken offline, reducing immediate exposure to end users. However, residual risks persist due to the domain's registration remaining active and its infrastructure potentially repurposed for future campaigns. Response actions should include continuous monitoring of the IP and registrar for re-emergence, as well as dissemination of indicators to wallet providers and blockchain security platforms. Users are advised to verify domain authenticity through official project channels and employ transaction simulation tools to inspect contract interactions before execution.