raligun[.]org

This domain, raligun.org, presents itself as an on-chain ZK privacy ecosystem associated with RAILGUN but is actually a brand impersonation attempt targeting users of the Across protocol. The site mimics legitimate privacy-focused blockchain services to deceive visitors into disclosing sensitive information such as wallet credentials, private keys, or other authentication details. Given the increasing sophistication of blockchain-related scams, this domain leverages the growing interest in zero-knowledge privacy solutions to exploit unsuspecting users seeking anonymity or secure transactions. Analysis indicates this domain is malicious based on multiple technical indicators. It was registered on September 13, 2025, through Key-Systems GmbH and is flagged by 15 out of 95 security vendors on VirusTotal. Additionally, it appears on one security blocklist and has been included in one threat intelligence pulse on AlienVault OTX. The domain resolved to the IP address 188.114.97.3 and was assigned a trust score of 0/100 by Gridinsoft. The page title, 'RAILGUN - On-chain ZK Privacy Ecosystem,' directly mirrors legitimate branding, further confirming its intent to impersonate. If you have visited raligun.org or interacted with its content, immediate action is required. First, disconnect any wallets or accounts linked to the site and revoke any pending transactions or smart contract approvals. Scan your device for malware using updated security tools, as some impersonation sites deploy additional payloads. Monitor your financial accounts and blockchain transactions for unauthorized activity, particularly those involving the Across protocol or RAILGUN-related services. Report the domain to relevant security teams or blockchain communities to help prevent further exploitation. Given the elevated risk level, assume any credentials or data shared with this domain have been compromised.