rustoutpost[.]net

rustoutpost.net was registered on 10 November 2025 through Web Commerce Communications Limited and resolves to the IP address 185.178.208.158, which belongs to AS57724 DDOS‑GUARD LTD located in Russia. The domain is served by the nameservers ns1.ddos‑guard.net and ns2.ddos‑guard.net and does not present an SSL certificate, indicating that any traffic would be unencrypted. Passive monitoring shows the site is currently taken offline, and the domain appears on a single security blocklist; it is also listed as blocked by PhishDestroy. Reputation scoring from Gridinsoft assigns a trust score of 0 / 100, reflecting a lack of legitimacy.

Content analysis from the page title “RustOutpost | Community for RUST Skin Designers” suggests the site was positioned as a community hub for Rust skin designers, but the threat profile lists the campaign as a brand‑impersonation operation targeting Steam. No further page content has been captured, so the exact method of impersonation (e.g., login prompt, credential harvesting) remains unknown. VirusTotal reports that 13 of 93 scanning engines flag the domain, providing additional corroboration of malicious intent. The domain also appears in one AlienVault OTX pulse, further linking it to threat‑intel activity.

The combination of a low trust score, multiple vendor detections, association with a known blocklist, and attribution to a Steam brand‑impersonation campaign suggests a high likelihood that the infrastructure was used to harvest Steam credentials or to distribute malware masquerading as Steam‑related content. Defenders should continue to block rustoutpost.net at perimeter filters, add the associated IP address 185.178.208.158 to deny lists, and monitor for any future DNS resolution changes. Given the Russian hosting and the use of DDOS‑GUARD name servers, threat actors may shift to alternative IPs while retaining the same domain registration, so continuous DNS and passive DNS monitoring is recommended.