Submitted URL: https://hypixel-light.ouralioth.com/
Effective URL: https://api.hypixel.net/
Submission Tags: phishingrod
Submission: On November 22 via api from DE — Scanned from DE

Summary

This website contacted 5 IPs in 3 countries across 5 domains to perform 11 HTTP transactions. The main IP is 2606:4700::6812:8811, located in United States and belongs to CLOUDFLARENET, US. The main domain is api.hypixel.net. The Cisco Umbrella rank of the primary domain is 258158.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on April 5th 2023. Valid for: a year.
This is the only time api.hypixel.net was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 1 2404:a140:b:1::4 138915 (KAOPU-HK ...)
5 2606:4700::68... 13335 (CLOUDFLAR...)
1 2a00:1450:400... 15169 (GOOGLE)
3 2a00:1450:400... 15169 (GOOGLE)
1 2606:4700::68... 13335 (CLOUDFLAR...)
11 5
Apex Domain
Subdomains
Transfer
5 hypixel.net
api.hypixel.net — Cisco Umbrella Rank: 258158
402 KB
3 gstatic.com
fonts.gstatic.com
64 KB
1 cloudflareinsights.com
static.cloudflareinsights.com — Cisco Umbrella Rank: 899
7 KB
1 googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 31
1 KB
1 ouralioth.com
hypixel-light.ouralioth.com
452 B
11 5
Domain Requested by
5 api.hypixel.net api.hypixel.net
static.cloudflareinsights.com
3 fonts.gstatic.com fonts.googleapis.com
1 static.cloudflareinsights.com api.hypixel.net
1 fonts.googleapis.com api.hypixel.net
1 hypixel-light.ouralioth.com 1 redirects
11 5

This site contains links to these domains. Also see Links.

Domain
github.com
developer.hypixel.net
hypixel.net
i.imgur.com
Subject Issuer Validity Valid
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3
2023-04-05 -
2024-04-04
a year crt.sh
upload.video.google.com
GTS CA 1C3
2023-10-23 -
2024-01-15
3 months crt.sh
*.gstatic.com
GTS CA 1C3
2023-10-23 -
2024-01-15
3 months crt.sh

This page contains 1 frames:

Primary Page: https://api.hypixel.net/
Frame ID: 245DEBF9A332A4516FE97B25EBBD6F58
Requests: 13 HTTP requests in this frame

Screenshot

Page Title

Hypixel Public API

Page URL History Show full URLs

  1. https://hypixel-light.ouralioth.com/ HTTP 301
    https://api.hypixel.net/ Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • static\.cloudflareinsights\.com/beacon(?:\.min)?\.js

Page Statistics

11
Requests

91 %
HTTPS

100 %
IPv6

5
Domains

5
Subdomains

5
IPs

3
Countries

474 kB
Transfer

1540 kB
Size

1
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://hypixel-light.ouralioth.com/ HTTP 301
    https://api.hypixel.net/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

11 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
api.hypixel.net/
Redirect Chain
  • https://hypixel-light.ouralioth.com/
  • https://api.hypixel.net/
1 MB
332 KB
Document
General
Full URL
https://api.hypixel.net/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:8811 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
a2a2d8c280ddc2f1ceddc132c64fe8d54c9321b10a91f4d86af675fd8bb2c0c0

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=86400
cf-cache-status
HIT
cf-ray
829fa89a9bb018cb-FRA
content-encoding
br
content-type
text/html
date
Wed, 22 Nov 2023 08:03:55 GMT
last-modified
Tue, 14 Nov 2023 01:08:18 GMT
server
cloudflare
vary
Accept-Encoding

Redirect headers

alt-svc
h3=":443"; ma=86400
cache-control
max-age=3600
cf-ray
829fa89a0fcc690b-IAD
content-type
text/plain
date
Wed, 22 Nov 2023 08:03:54 GMT
expires
Wed, 22 Nov 2023 09:03:54 GMT
location
https://api.hypixel.net/
server
nginx
x-cache
MISS
x-edge-ip
2404:a140:b:1::4
x-edge-location
Washington, US
x-storage
331162274:8003
rsjQeg9CKMkfLDB8kU7GG-F1JRE.js
api.hypixel.net/cdn-cgi/apps/head/
5 KB
2 KB
Script
General
Full URL
https://api.hypixel.net/cdn-cgi/apps/head/rsjQeg9CKMkfLDB8kU7GG-F1JRE.js
Requested by
Host: api.hypixel.net
URL: https://api.hypixel.net/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:8811 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
81262c49ee5b3d2d046b4a7bcf142aabbf56d26782c4b5e7110e765629ca9ef9

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://api.hypixel.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Wed, 22 Nov 2023 08:03:55 GMT
x-amz-version-id
5DL50h25rlbrzbIvWJItqBRO9mnSyX5L
content-encoding
br
cf-cache-status
HIT
last-modified
Tue, 24 Apr 2018 08:48:06 GMT
server
cloudflare
x-amz-request-id
GK6NFV1FBM8RVQRV
age
1088551
etag
W/"d5be0f43dde39cdd8bb41cf62a966df2"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
cache-control
public, max-age=31536000
cf-ray
829fa89d9e9c18cb-FRA
alt-svc
h3=":443"; ma=86400
x-amz-id-2
cgnOmb2fZpuBC6zvig3KCE01ZBFYhNlE2ngDcw+sWeT3qukZdAAwZzhtRV9tO255P1SSyuPKbQY=
css
fonts.googleapis.com/
11 KB
1 KB
Stylesheet
General
Full URL
https://fonts.googleapis.com/css?family=Montserrat:300,400,700|Roboto:300,400,700
Requested by
Host: api.hypixel.net
URL: https://api.hypixel.net/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:829::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
32e5ed25f401c2ac5f27343d9decdde8896f907e048d06f925600423a6b1e58c
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://api.hypixel.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
date
Wed, 22 Nov 2023 08:03:55 GMT
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection
0
last-modified
Wed, 22 Nov 2023 08:02:02 GMT
server
ESF
cross-origin-opener-policy
same-origin-allow-popups
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Wed, 22 Nov 2023 08:03:55 GMT
logo.png
api.hypixel.net/assets/images/
64 KB
64 KB
Image
General
Full URL
https://api.hypixel.net/assets/images/logo.png
Requested by
Host: api.hypixel.net
URL: https://api.hypixel.net/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700::6812:8811 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
a7664f99d7c3fa2d427a6a9f0452ff333dafb57f5dd0780483ab339227775eb2

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://api.hypixel.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Wed, 22 Nov 2023 08:03:55 GMT
cf-cache-status
HIT
cf-bgj
imgq:100,h2pri
last-modified
Sat, 05 Jan 2019 04:22:25 GMT
server
cloudflare
cf-polished
origSize=65777
etag
"5c303101-100f1"
vary
Accept-Encoding
content-type
image/png
accept-ranges
bytes
cf-ray
829fa89dc81a6939-FRA
alt-svc
h3=":443"; ma=86400
content-length
65419
vJaWmhZVG_Lsn0jrx_Y8EAkEhr4.js
api.hypixel.net/cdn-cgi/apps/body/
8 KB
3 KB
Script
General
Full URL
https://api.hypixel.net/cdn-cgi/apps/body/vJaWmhZVG_Lsn0jrx_Y8EAkEhr4.js
Requested by
Host: api.hypixel.net
URL: https://api.hypixel.net/cdn-cgi/apps/head/rsjQeg9CKMkfLDB8kU7GG-F1JRE.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700::6812:8811 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
5c195074672f697656ad0a0fae9699e98790e1f9d187dca7f5e1fcae891a0255

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://api.hypixel.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Wed, 22 Nov 2023 08:03:55 GMT
x-amz-version-id
ns98sKbOnPZ3DCk3fwhVsO6n.Y0nbowv
content-encoding
br
cf-cache-status
HIT
last-modified
Tue, 24 Apr 2018 08:48:05 GMT
server
cloudflare
x-amz-request-id
R0TQA34TKC229SHY
age
36321
etag
W/"f8fa8872337d07451d29fe65524a1535"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
cache-control
public, max-age=31536000
cf-ray
829fa89eb8e26939-FRA
alt-svc
h3=":443"; ma=86400
x-amz-id-2
GhbttyGNN2bVAgVdku8WUSNE31au74PjTBLl363XfSIRQH4iDW8a+BKlCJPWvouhTokC7L5/uss=
KFOlCnqEu92Fr1MmWUlfBBc4.woff2
fonts.gstatic.com/s/roboto/v30/
15 KB
16 KB
Font
General
Full URL
https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfBBc4.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Montserrat:300,400,700|Roboto:300,400,700
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
f5aebdfea35d1e7656ef4acc5db1f243209755ae3300943ef8fc6280f363c860
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://api.hypixel.net
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Fri, 17 Nov 2023 16:39:21 GMT
x-content-type-options
nosniff
age
401074
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
15860
x-xss-protection
0
last-modified
Wed, 11 May 2022 19:24:42 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Sat, 16 Nov 2024 16:39:21 GMT
truncated
/
820 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
b0d9ca673f58e5969697f964ca0e8a5cb61404afa431bad25c0db8f47475d5a2

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Content-Type
image/svg+xml
JTUSjIg1_i6t8kCHKm459Wlhyw.woff2
fonts.gstatic.com/s/montserrat/v26/
32 KB
32 KB
Font
General
Full URL
https://fonts.gstatic.com/s/montserrat/v26/JTUSjIg1_i6t8kCHKm459Wlhyw.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Montserrat:300,400,700|Roboto:300,400,700
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
bb2f90081933c0f2475883ca2c5cfee94e96d7314a09433fffc42e37f4cffd3b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://api.hypixel.net
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Sat, 18 Nov 2023 07:18:49 GMT
x-content-type-options
nosniff
age
348306
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
33092
x-xss-protection
0
last-modified
Wed, 13 Sep 2023 22:51:58 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Sun, 17 Nov 2024 07:18:49 GMT
KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v30/
15 KB
15 KB
Font
General
Full URL
https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Montserrat:300,400,700|Roboto:300,400,700
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://api.hypixel.net
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Sat, 18 Nov 2023 13:37:09 GMT
x-content-type-options
nosniff
age
325606
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
15744
x-xss-protection
0
last-modified
Wed, 11 May 2022 19:24:48 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Sun, 17 Nov 2024 13:37:09 GMT
d24d030b-e585-4350-a94d-2223399ad853
https://api.hypixel.net/
67 KB
0
Other
General
Full URL
blob:https://api.hypixel.net/d24d030b-e585-4350-a94d-2223399ad853
Requested by
Host: api.hypixel.net
URL: https://api.hypixel.net/
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
072c879cd704c762f06e2c6e706e464dc96887d9fcb767e372c188188dd1be6e

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Content-Length
68718
Content-Type
v84a3a4012de94ce1a686ba8c167c359c1696973893317
static.cloudflareinsights.com/beacon.min.js/
20 KB
7 KB
Script
General
Full URL
https://static.cloudflareinsights.com/beacon.min.js/v84a3a4012de94ce1a686ba8c167c359c1696973893317
Requested by
Host: api.hypixel.net
URL: https://api.hypixel.net/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:3865 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
6153d13804862b0fc1c016cf1129f34cb7c6185f2cf4bf1a3a862eecdab50101

Request headers

Referer
https://api.hypixel.net/
Origin
https://api.hypixel.net
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Wed, 22 Nov 2023 08:03:55 GMT
content-encoding
gzip
last-modified
Tue, 10 Oct 2023 21:38:13 GMT
server
cloudflare
etag
W/"2023.10.0"
vary
Accept-Encoding
content-type
text/javascript;charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=86400
cross-origin-resource-policy
cross-origin
cf-ray
829fa8a139d639c1-FRA
truncated
/
3 KB
0
Stylesheet
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
ead9d662556a3bcfddaccb89f85f4877a8c2cd7b8aabc4400aa69fc839ddf2f0

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Content-Type
text/css;charset=utf-8
rum
api.hypixel.net/cdn-cgi/
0
141 B
XHR
General
Full URL
https://api.hypixel.net/cdn-cgi/rum?
Requested by
Host: static.cloudflareinsights.com
URL: https://static.cloudflareinsights.com/beacon.min.js/v84a3a4012de94ce1a686ba8c167c359c1696973893317
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700::6812:8811 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

Referer
https://api.hypixel.net/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
content-type
application/json

Response headers

date
Wed, 22 Nov 2023 08:03:55 GMT
x-content-type-options
nosniff
server
cloudflare
vary
Origin
access-control-max-age
86400
access-control-allow-methods
POST,OPTIONS
access-control-allow-origin
https://api.hypixel.net
x-frame-options
DENY
access-control-allow-credentials
true
cf-ray
829fa8a19b486939-FRA

Verdicts & Comments Add Verdict or Comment

10 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| documentPictureInPicture object| Eager object| CloudflareApps number| __mobxInstanceCount object| __mobxGlobals object| regeneratorRuntime object| Prism object| Redoc object| container object| __cfBeacon

1 Cookies

Domain/Path Name / Value
.hypixel.net/ Name: __cf_bm
Value: MVpLwobV4qkLBB4GSKKDsQYcEmJjtdkQuWKxMDNaGI8-1700640235-0-AfzHoPt5y/N7KUDXl5XnxmwzZdrDQabjYe9pjL0+wqdFZuDFxxxB0YNOcHVRdDwpG9jabpxsVy3v+S5p7uY2vUk=