rallgun[.]org

Analysis of rallgun.org shows that the domain was registered on February 21, 2026 through NiceNIC International Group Co., Limited and is hosted on Cloudflare infrastructure (AS13335) with the IP address 104.21.2.67 located in the United States. The domain resolves to Cloudflare nameservers matt.ns.cloudflare.com and venus.ns.cloudflare.com, and it does not present an SSL certificate, indicating that HTTPS connections are not available. The page title returned from the live host reads “RAILGUN – On-chain ZK Privacy Ecosystem,” which appears unrelated to the advertised scam type. VirusTotal records indicate that seven of ninety‑three scanning engines have flagged the domain, and three independent blocklists currently list it as malicious.

The domain is classified as a wallet/seed phishing operation and is blocked by PhishDestroy, MetaMask, and SEAL, confirming active mitigation by major anti‑phishing tools. Gridinsoft assigns a trust score of zero out of one hundred, reinforcing the low credibility assessment. The brand target is listed as “across,” suggesting that the campaign may be attempting to harvest credentials for multiple services rather than a single brand. The domain’s current status is offline, which may be a temporary takedown or a deliberate shutdown after detection.

Uncertainty remains regarding the exact content served to victims, as the page title does not match typical credential‑harvesting pages and no SSL certificate limits the ability to capture encrypted traffic. No additional intelligence such as malware hashes, phishing kit identifiers, or victim reports have been released. Defenders should continue to block the domain at network perimeter and DNS layers, monitor for any re‑registration attempts, and add the associated IP address and nameserver pairs to threat‑intel feeds. Given the low trust score and multiple blocklist entries, organizations should treat any inbound traffic from rallgun.