Warden Stealer: command-and-control servers of the Rust infostealer sold as a service

Exact hostnames only. The published list holds about 256 servers, more than one hunt can carry, so this hunt keeps the ones live in October 2026: the newest published servers (rogaldorn1[.]website, web05-cloudupdate[.]com, web03-azureupdate[.]com, skibidistealer[.]team, konradkertc6[.]website, kertc3[.]website, aksdaodsaodsaodsadoasdasod[.]best) and the verification-themed ones that a lure page is the most likely to contact (recap-check[.]org, cap-recheck[.]org, verifytrtr[.]vip, erifytrtr1[.]vip, luqiuid91[.]com, errakgrwenmjibedi[.]cc; public threat lists also tie some of these to ClearFake / ClickFix chains). The operators register servers in numbered batches named after Warhammer 40,000 primarchs and other jokes (redlable, kertc, konradkertc and rogaldorn on .website, each numbered 1 to 6). Seven hosts here are not in the published list and are included as an assessment from that pattern, not from a sample: lemanruss[.]website and lemanruss1 to lemanruss4[.]website (registered 2026-10-09), kertc4[.]website and tony-soprano[.]club (twin of the published tony-sopranos[.]club). Each behaves like the published servers. Before the 2026-10-08 attribution, public threat lists labelled many of these servers 'unknown stealer' or 'ACR Stealer'. Two published servers, macfilecloud8[.]com and websreamyard[.]com, are also listed publicly as macOS Atomic Stealer infrastructure, so at least one customer appears to run both. The builds avoid systems in CIS and Baltic countries.