rustomega[.]net

Analysis of rustomega.net indicates a confirmed brand impersonation campaign targeting Steam, with elevated risk due to its infrastructure and detection history. The domain, registered on November 16, 2025, through Web Commerce Communications Limited, resolves to IP 185.178.208.158, hosted on AS57724 (DDOS-GUARD LTD) in Russia. Nameservers ns1.ddos-guard.net and ns2.ddos-guard.net further link it to DDoS-Guard’s network, a provider frequently associated with malicious infrastructure.

The domain was flagged by 9 of 95 security vendors on VirusTotal and appears on at least one security blocklist, including PhishDestroy, which has since taken the site offline. The page title, 'RustOmega - The Rust Creation Hub,' suggests an attempt to mimic Steam’s gaming-related services, though the exact content and tactics remain unconfirmed due to the domain’s current offline status. No SSL certificate was detected, increasing the likelihood of unencrypted credential harvesting.

Gridinsoft’s trust score of 0/100 reinforces the domain’s high-risk classification. While the domain is no longer active, defenders should monitor for re-emergence under the same or similar infrastructure, particularly within DDoS-Guard’s IP ranges or using identical nameserver configurations. Historical detection data and blocklist inclusion provide concrete indicators for retrospective hunting or proactive blocking in enterprise environments.