rusthorizon[.]net

rusthorizon.net was observed hosting a Steam brand impersonation campaign. The site resolved to 185.178.208.158, an address owned by AS57724 DDOS‑GUARD LTD in Russia. Registration was performed through Web Commerce Communications Limited and the domain was created on 21 December 2025. Nameservers ns1.ddos-guard.net and ns2.ddos-guard.net point to the same provider, confirming the hosting relationship.

No TLS certificate was presented, indicating the site operated over HTTP only. The page title returned by the server was “RustHorizon – The Rust Creation Hub”, which does not reference the targeted brand and suggests a generic content placeholder. Threat intelligence feeds have listed the domain on one security blocklist and it is actively blocked by PhishDestroy. AlienVault OTX includes the domain in eight independent pulses, and VirusTotal recorded 18 detections out of 93 scanning engines.

Gridinsoft assigned a trust score of 0 / 100, reflecting a high confidence in malicious intent. The current status is offline, but historical activity indicates that the infrastructure was used to lure Steam users to disclose credentials or install malicious payloads. Defenders should continue to deny network communications to 185.178.208.158, add rusthorizon.net to URL filtering and host‑based blocklists, and monitor for any resurgence of the domain or related sub‑domains. Given the low trust score, multiple vendor detections, and confirmed brand impersonation, the indicator should be treated as high‑confidence malicious.