authg[.]rustbastion[.]net

The domain authg.rustbastion.net was registered on 16 November 2025 through Web Commerce Communications Limited and is currently hosted on a DDOS‑Guard network (ASN 57724) in Russia, resolving to IP 185.178.208.158. No TLS certificate is present, indicating the site operated without encryption. Reputation services uniformly rate the domain as malicious: Gridinsoft assigns a trust score of 0 / 100, Scamadviser a score of 1 / 100, and Google Safe Browsing flags the host for social‑engineering content.

The domain appears on one public security blocklist and is listed by PhishDestroy as taken offline. VirusTotal reports that fifteen of ninety‑five scanned scanners flag the domain, confirming detection by multiple independent engines. The nameserver configuration (ns1.ddos-guard.net, ns2.ddos-guard.net) further ties the infrastructure to the DDOS‑Guard hosting provider, a known avenue for abuse.

While the available data definitively demonstrate that the domain has been used for generic phishing, the specific payload, targeted brand, or victim interaction details remain unknown because no page content or HTTP response data have been published. Defenders should continue to block the domain at perimeter filters, update local threat‑intel feeds with the observed indicators (domain, IP, ASN, nameservers), and monitor for any resurrection attempts that might use the same hosting footprint. Ongoing vigilance is recommended, especially for users who may have previously received credential‑stealing emails referencing the sub‑domain, as the offline status does not preclude future re‑deployment on a different server.