rustrelay[.]net

Analysis of rustrelay.net indicates that the domain is currently offline but retains infrastructure consistent with a brand‑impersonation campaign targeting Steam users. The domain was registered on 13 November 2025 through Web Commerce Communications Limited and resolves to the IP address 185.178.208.158, which belongs to AS57724 (DDOS‑GUARD LTD) located in Russia. Both authoritative nameservers, ns1.ddos-guard.net and ns2.ddos-guard.net, are hosted by the same provider, reinforcing the link between the domain and the DDOS‑GUARD network. No TLS certificate is presented for the site, meaning any HTTP connection would be unencrypted and susceptible to interception.

The page title returned from the server is “Rustrelay – The Rust Creation Hub”, which does not reference the impersonated brand and suggests a generic landing page rather than a credential‑harvesting interface. The domain is flagged in fifteen AlienVault OTX pulses and appears on one public security blocklist, where it is specifically listed by PhishDestroy as a malicious URL. VirusTotal reports that seventeen of ninety‑five scanning engines have marked the domain as malicious, providing additional independent confirmation of its abusive nature. Gridinsoft assigns the domain a trust score of 1 out of 100, reflecting an extreme lack of reputation.

Given the confirmed association with a Steam brand‑impersonation scheme, defenders should add rustrelay.net and its associated IP address to network‑level blocklists, enforce DNS sink‑hole policies, and monitor for any future resolution to the same nameservers or IP range. Continuous observation of the DDOS‑GUARD hosting infrastructure is advised, as the attacker may redeploy the campaign using new subdomains or similar naming patterns. Organizations that rely on Steam authentication services should alert users to the possibility of spoofed communications originating from this domain and encourage verification of any unsolicited Steam‑related requests.