URL: https://rust.celaris.net/
Submission Tags: phishingrod
Submission: On September 29 via api from DE — Scanned from AU

Summary

This website contacted 3 IPs in 2 countries across 3 domains to perform 5 HTTP transactions. The main IP is 122.150.120.79, located in Notting Hill, Australia and belongs to VOCUS-RETAIL-AU Vocus Retail, AU. The main domain is rust.celaris.net.
TLS certificate: Issued by R3 on July 31st 2023. Valid for: 3 months.
This is the only time rust.celaris.net was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
3 122.150.120.79 9443 (VOCUS-RET...)
1 142.251.175.95 15169 (GOOGLE)
1 142.251.175.94 15169 (GOOGLE)
5 3
Apex Domain
Subdomains
Transfer
3 celaris.net
rust.celaris.net
3 MB
1 gstatic.com
fonts.gstatic.com
15 KB
1 googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 113
9 KB
5 3
Domain Requested by
3 rust.celaris.net rust.celaris.net
1 fonts.gstatic.com fonts.googleapis.com
1 fonts.googleapis.com rust.celaris.net
5 3

This site contains links to these domains. Also see Links.

Domain
discord.gg
youtu.be
Subject Issuer Validity Valid
rust.celaris.net
R3
2023-07-31 -
2023-10-29
3 months crt.sh
upload.video.google.com
GTS CA 1C3
2023-09-04 -
2023-11-27
3 months crt.sh
*.gstatic.com
GTS CA 1C3
2023-09-04 -
2023-11-27
3 months crt.sh

This page contains 1 frames:

Primary Page: https://rust.celaris.net/
Frame ID: 778822CDC09FC7AE099B5AD474B135F1
Requests: 5 HTTP requests in this frame

Screenshot

Page Title

CelarisRust

Detected technologies

Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

Page Statistics

5
Requests

100 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

2854 kB
Transfer

2876 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

5 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
rust.celaris.net/
1 KB
774 B
Document
General
Full URL
https://rust.celaris.net/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
122.150.120.79 Notting Hill, Australia, ASN9443 (VOCUS-RETAIL-AU Vocus Retail, AU),
Reverse DNS
122-150-120-79.dyn.ip.vocus.au
Software
openresty /
Resource Hash
b10b761ca465aefac60385b3004f4677809eb42aadb2abe61d0ec6a2d6321117
Security Headers
Name Value
Strict-Transport-Security max-age=63072000;includeSubDomains; preload

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36
accept-language
en-AU,en;q=0.9

Response headers

content-encoding
gzip
content-type
text/html
date
Fri, 29 Sep 2023 06:02:20 GMT
etag
W/"647b3c4a-443"
last-modified
Sat, 03 Jun 2023 13:12:42 GMT
server
openresty
strict-transport-security
max-age=63072000;includeSubDomains; preload
x-served-by
rust.celaris.net
styles.css
rust.celaris.net/
882 B
1 KB
Stylesheet
General
Full URL
https://rust.celaris.net/styles.css
Requested by
Host: rust.celaris.net
URL: https://rust.celaris.net/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
122.150.120.79 Notting Hill, Australia, ASN9443 (VOCUS-RETAIL-AU Vocus Retail, AU),
Reverse DNS
122-150-120-79.dyn.ip.vocus.au
Software
openresty /
Resource Hash
b721bfcb9670da1abd8137b96ef4d575cf91bf77d7090549c2d4d242da2e7281

Request headers

accept-language
en-AU,en;q=0.9
Referer
https://rust.celaris.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

expires
Fri, 29 Sep 2023 14:30:00 GMT
date
Fri, 29 Sep 2023 06:02:20 GMT
server
openresty
etag
"647b3c5a-372"
content-type
text/css
cache-control
max-age=30460
accept-ranges
bytes
content-length
882
x-served-by
rust.celaris.net
css
fonts.googleapis.com/
34 KB
9 KB
Stylesheet
General
Full URL
https://fonts.googleapis.com/css?family=Aoboshi%20One
Requested by
Host: rust.celaris.net
URL: https://rust.celaris.net/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.251.175.95 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
sh-in-f95.1e100.net
Software
ESF /
Resource Hash
41ef0e6d675bf712065f7ffc810be6b21f18d18287242b08fb5f9a097c23ae8d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
en-AU,en;q=0.9
Referer
https://rust.celaris.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
date
Fri, 29 Sep 2023 06:02:20 GMT
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection
0
last-modified
Fri, 29 Sep 2023 06:02:20 GMT
server
ESF
cross-origin-opener-policy
same-origin-allow-popups
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Fri, 29 Sep 2023 06:02:20 GMT
bg.mp4
rust.celaris.net/
3 MB
3 MB
Media
General
Full URL
https://rust.celaris.net/bg.mp4
Requested by
Host: rust.celaris.net
URL: https://rust.celaris.net/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
122.150.120.79 Notting Hill, Australia, ASN9443 (VOCUS-RETAIL-AU Vocus Retail, AU),
Reverse DNS
122-150-120-79.dyn.ip.vocus.au
Software
openresty /
Resource Hash
c4c4bede9d0adce3edf4137f5c9ec48c8a0dacb45b409b7e37a7a12cc0e986e8
Security Headers
Name Value
Strict-Transport-Security max-age=63072000;includeSubDomains; preload

Request headers

Referer
https://rust.celaris.net/
Accept-Encoding
identity;q=1, *;q=0
accept-language
en-AU,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36
Range
bytes=0-

Response headers

date
Fri, 29 Sep 2023 06:02:20 GMT
strict-transport-security
max-age=63072000;includeSubDomains; preload
last-modified
Thu, 19 Jan 2023 08:08:21 GMT
server
openresty
etag
"63c8fa75-2c24d6"
content-type
video/mp4
Content-Range
bytes 0-2893013/2893014
Content-Length
2893014
x-served-by
rust.celaris.net
Gg8xN5kXaAXtHQrFxwl10ysObnZV7DNA_qdVHOXLt8-O4-J4emaoBw.118.woff2
fonts.gstatic.com/s/aoboshione/v10/
15 KB
15 KB
Font
General
Full URL
https://fonts.gstatic.com/s/aoboshione/v10/Gg8xN5kXaAXtHQrFxwl10ysObnZV7DNA_qdVHOXLt8-O4-J4emaoBw.118.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Aoboshi%20One
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.251.175.94 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
sh-in-f94.1e100.net
Software
sffe /
Resource Hash
b6343fc2c7f7143f45166adc2fe74b01dc42996496d5293572dd2da35c7e7d2f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://rust.celaris.net
accept-language
en-AU,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date
Fri, 29 Sep 2023 01:13:03 GMT
x-content-type-options
nosniff
age
17358
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
15048
x-xss-protection
0
last-modified
Tue, 23 May 2023 16:52:14 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Sat, 28 Sep 2024 01:13:03 GMT

Verdicts & Comments Add Verdict or Comment

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| documentPictureInPicture

0 Cookies

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=63072000;includeSubDomains; preload