rustcommand[.]com

This domain, rustcommand.com, is identified as a brand impersonation threat targeting Base, a cryptocurrency platform. The site masqueraded as a hub for Rust skin creators, a common social engineering tactic to lure users into interacting with malicious content. Analysis indicates no direct evidence of a crypto drainer kit, but the domain’s intent aligns with credential harvesting or fraudulent asset transfers under the guise of a legitimate gaming community service. Infrastructure analysis reveals rustcommand.com was registered through Web Commerce Communications Limited (WebNic.cc) on December 24, 2025, and resolved to the IP address 185.178.208.158, associated with AS57724 (DDOS-GUARD LTD) in Russia. The domain is flagged by 17 out of 95 security vendors on VirusTotal and appears on two blocklists: PhishDestroy and PhishingDB. The SSL certificate (R12) is non-extended validation, further reducing trust indicators. No Google Safe Browsing (GSB) hits were recorded at the time of analysis, though this may reflect detection latency rather than absence of malicious activity. Current status indicates the domain has been taken offline, likely due to enforcement actions or hosting provider intervention. However, the elevated risk level persists due to the domain’s recent creation, association with a high-risk registrar, and historical blocklist presence. Users who interacted with rustcommand.com are advised to revoke any connected wallet permissions, rotate credentials, and monitor for unauthorized transactions. Organizations should update blocklists to include the domain and its resolved IP, while security teams should investigate potential lateral movement from compromised endpoints.