ailgun[.]org

Analysis of the domain ailgun.org indicates it was actively used in a wallet seed-phishing campaign targeting users of the Across protocol, with additional branding impersonation of the RAILGUN privacy ecosystem. The domain was registered on September 13, 2025, through NiceNIC International Group Co., Limited, and resolved to the IP address 172.67.141.58, hosted on Cloudflare's infrastructure (AS13335). Infrastructure analysis reveals the use of Cloudflare nameservers (chance.ns.cloudflare.com and jean.ns.cloudflare.com), a common practice among phishing operators to obscure hosting origins and leverage Cloudflare's DDoS protection and caching services. No SSL certificate was detected, increasing the likelihood of interception or tampering of user-submitted data.

At the time of reporting, the domain is offline, though its prior activity was flagged by 12 of 95 security vendors on VirusTotal, with one confirmed blocklist entry (PhishDestroy). The page title, 'RAILGUN - On-chain ZK Privacy Ecosystem,' explicitly aligns with the impersonation of RAILGUN, while the known scam type—wallet/seed phishing—confirms the intended attack vector. Gridinsoft assigned a trust score of 0/100, further corroborating malicious intent. Defenders should treat this domain as high-risk for seed-phrase harvesting, particularly in contexts involving Across or RAILGUN branding.

Given the domain's current offline status, immediate containment measures (e.g., DNS sinkholing, firewall blocking of the resolved IP) may be less critical, but retrospective analysis of logs for connections to 172.67.141.58 or ailgun.org is recommended. The registrar, NiceNIC, has been associated with other phishing domains, though no direct evidence links this registration to broader abuse patterns. No further HTTP response codes or Safe Browsing statuses are available for additional context. Organizations should monitor for reactivation attempts under the same registrar or IP range.