rilgun[.]org

Analysis of the domain rilgun.org indicates it was actively used for wallet seed phrase phishing targeting users of the RAILGUN privacy ecosystem. The domain was registered on September 13, 2025, through NiceNIC International Group Co., Limited and resolved to the IP address 188.114.96.3, hosted on Cloudflare's network (AS13335). No SSL certificate was detected, increasing the risk of interception during user interaction. The page title, 'RAILGUN - On-chain ZK Privacy Ecosystem,' directly impersonates the legitimate RAILGUN brand, aligning with the identified scam type of wallet and seed phrase theft. Detection data shows rilgun.org was flagged by 15 of 95 security vendors on VirusTotal and appears on at least one security blocklist, including PhishDestroy.

Gridinsoft assigned a trust score of 0 out of 100, further supporting its malicious classification. AlienVault OTX includes the domain in one threat intelligence pulse, suggesting it was part of a broader phishing campaign. The domain's nameservers (chance.ns.cloudflare.com and jean.ns.cloudflare.com) and Cloudflare hosting are consistent with common phishing infrastructure patterns, though not inherently malicious on their own. As of July 23, 2026, rilgun.org is offline, reducing immediate risk to users.

However, the domain remains registered and could be reactivated. Defenders should monitor for re-emergence, block the domain and associated IP at network and endpoint levels, and alert users who may have interacted with it prior to takedown. The use of a seed phrase phishing kit suggests the goal was to harvest private keys for cryptocurrency theft. No evidence currently links this domain to other ongoing campaigns, but historical data should be preserved for forensic and threat-hunting purposes.