rustcontain[.]net

Analysis of rustcontain.net indicates confirmed phishing infrastructure targeting Steam users, currently offline as of July 24, 2026. The domain was registered on November 17, 2025, through Web Commerce Communications Limited and resolves to IP 185.178.208.158, hosted on AS57724 (DDOS-GUARD LTD) in Russia. Nameservers ns1.ddos-guard.net and ns2.ddos-guard.net further link the domain to DDoS-Guard's network, a provider frequently associated with malicious infrastructure. The page title 'RustContain - The Rust Creation Hub' suggests an attempt to impersonate Steam's gaming ecosystem, specifically leveraging the Rust game brand, though no direct evidence of a phishing kit or specific attack vector is present in available data. Security vendor detections are notable: 11 of 95 engines on VirusTotal flagged the domain as malicious, and it appears on at least one security blocklist.

Gridinsoft assigns a trust score of 0/100, reinforcing its high-risk classification. The domain lacks an SSL certificate, a common red flag for phishing sites, though this alone is not conclusive. PhishDestroy has blocked the domain, indicating prior confirmation of its fraudulent nature. Defenders should treat this domain as confirmed malicious infrastructure. While the site is currently offline, the registration details, hosting provider, and detection history suggest it may resurface or be repurposed.

Network-level blocking of the IP 185.178.208.158 and monitoring of DDoS-Guard's nameservers for related domains is recommended. Endpoint protection and email filtering rules should prioritize blocking rustcontain.net and any subdomains. Given the Steam brand impersonation, user education targeting gaming communities may help mitigate future risks. No evidence of active credential harvesting or payload delivery is available, but historical patterns of similar domains indicate likely intent to steal Steam credentials or distribute malware.