authg[.]rustlumen[.]net

The domain authg.rustlumen.net is a phishing site engaged in brand impersonation, specifically targeting users of the Steam platform. It presents itself as a legitimate Steam login page to deceive victims into entering their credentials, posing an elevated risk of account compromise. As of the latest verification, authg.rustlumen.net has been taken offline, though prior activity confirms its malicious intent.

Technical indicators for authg.rustlumen.net include detection by 2 of 95 VirusTotal security vendors, including CRDF and SOCRadar. The domain is registered through Web Commerce Communications Limited, with a creation date of 2025-11-15 20:51:59, and resolves to the IP address 185.178.208.158, hosted by AS57724 (DDOS-GUARD LTD) in Russia. It appears on 1 security blocklist (PhishDestroy) and lacks an SSL certificate, with the observed page title 'Log på'. The domain uses nameservers ns1.ddos-guard.net and ns2.ddos-guard.net, and currently returns an HTTP 429 status. Gridinsoft assigns it a trust score of 0/100.

Victims of authg.rustlumen.net should immediately change their Steam account password and enable two-factor authentication (2FA) to prevent unauthorized access. Monitor the account for suspicious activity, such as unauthorized purchases or logins, and report the incident to Steam’s support team. Additionally, the domain can be reported to Google Safe Browsing, PhishTank, or other anti-phishing initiatives to aid in broader takedown efforts.