rustshard[.]net

The domain rustshard.net was registered on November 01, 2025 through Web Commerce Communications Limited and resolves to IP address 185.178.208.158, which belongs to ASN 57724 (DDOS‑GUARD LTD) in Russia. The authoritative nameservers are ns1.ddos-guard.net and ns2.ddos-guard.net, indicating the hosting infrastructure is operated by the same provider. No SSL certificate is presented for the site, meaning traffic is delivered over plain HTTP. The page title returned from the live host, "RustShard | Community for RUST Skin Designers," does not reference the targeted brand, yet the domain is explicitly classified as a brand‑impersonation campaign targeting Steam. The site is currently offline, but historical evidence shows it was actively serving content before takedown.

Detection signals include a listing on the PhishDestroy blocklist, where the domain is flagged for brand‑impersonation. AlienVault OTX references the domain in three separate threat‑intel pulses, reinforcing its malicious reputation. VirusTotal analysis recorded nine detections out of ninety‑five security vendors, providing additional confirmation of malicious activity. Gridinsoft assigned a trust score of 0 out of 100, reflecting a high level of risk. No other security‑related certificates or reputation services were noted.

Uncertainties remain regarding the exact phishing kit or credential‑collection mechanisms employed, as no visual or form analysis is available. The absence of an SSL certificate suggests any credential capture would occur over unencrypted channels, but the specific payload cannot be confirmed without deeper site inspection.

Defenders should block rustshard.net at perimeter firewalls and DNS filters, monitor outbound connections to its IP address, and add the domain to internal blocklists. Security teams should also flag any user‑reported attempts to access the site, especially those involving Steam account credentials, as potential compromise attempts.