URL: https://redditauth.elatemc.xyz/
Submission Tags: @phishunt_io
Submission: On November 03 via api from ES

Summary

This website contacted 4 IPs in 2 countries across 4 domains to perform 9 HTTP transactions. The main IP is 149.56.107.134, located in Montreal, Canada and belongs to OVH, FR. The main domain is redditauth.elatemc.xyz.
TLS certificate: Issued by Let's Encrypt Authority X3 on November 3rd 2020. Valid for: 3 months.
This is the only time redditauth.elatemc.xyz was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
2 149.56.107.134 16276 (OVH)
2 2606:4700::68... 13335 (CLOUDFLAR...)
1 185.199.108.153 54113 (FASTLY)
4 199.232.53.140 54113 (FASTLY)
9 4
Domain Requested by
2 oauth.reddit.com not-an-aardvark.github.io
2 www.reddit.com redditauth.elatemc.xyz
2 unpkg.com redditauth.elatemc.xyz
2 redditauth.elatemc.xyz redditauth.elatemc.xyz
1 not-an-aardvark.github.io redditauth.elatemc.xyz
9 5

This site contains no links.

Subject Issuer Validity Valid
redditauth.elatemc.xyz
Let's Encrypt Authority X3
2020-11-03 -
2021-02-01
3 months crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3
2020-08-02 -
2021-08-02
a year crt.sh
www.github.com
DigiCert SHA2 High Assurance Server CA
2020-05-06 -
2022-04-14
2 years crt.sh
*.reddit.com
DigiCert SHA2 Secure Server CA
2020-08-26 -
2021-02-22
6 months crt.sh

This page contains 1 frames:

Primary Page: https://redditauth.elatemc.xyz/
Frame ID: 9566F77791CE951533E0897EB8DC6870
Requests: 7 HTTP requests in this frame

Screenshot


Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /Ubuntu/i

Overall confidence: 100%
Detected patterns
  • headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i

Overall confidence: 100%
Detected patterns
  • html /<[^>]+data-react/i

Page Statistics

9
Requests

100 %
HTTPS

25 %
IPv6

4
Domains

5
Subdomains

4
IPs

2
Countries

248 kB
Transfer

1078 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

9 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
redditauth.elatemc.xyz/
1004 B
886 B
Document
General
Full URL
https://redditauth.elatemc.xyz/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
149.56.107.134 Montreal, Canada, ASN16276 (OVH, FR),
Reverse DNS
ns530584.ip-149-56-107.net
Software
Apache/2.4.29 (Ubuntu) /
Resource Hash
9edb79be9ae1cdc0424c0da88f166027cc56c84e77c163df96b48c944e408b98

Request headers

Host
redditauth.elatemc.xyz
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
none
Sec-Fetch-Mode
navigate
Sec-Fetch-User
?1
Sec-Fetch-Dest
document
Accept-Encoding
gzip, deflate, br
Accept-Language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Tue, 03 Nov 2020 11:35:43 GMT
Server
Apache/2.4.29 (Ubuntu)
Last-Modified
Mon, 09 Sep 2019 03:29:21 GMT
ETag
"3ec-5921664cdfd7e-gzip"
Accept-Ranges
bytes
Vary
Accept-Encoding
Content-Encoding
gzip
Content-Length
549
Keep-Alive
timeout=5, max=100
Connection
Keep-Alive
Content-Type
text/html
react.js
unpkg.com/react@15.6.1/dist/
142 KB
31 KB
Script
General
Full URL
https://unpkg.com/react@15.6.1/dist/react.js
Requested by
Host: redditauth.elatemc.xyz
URL: https://redditauth.elatemc.xyz/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:7aaf , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d6e93f01789858325042058bd743f7573e6a848b320719f0a387709b0e1c6077
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Origin
https://redditauth.elatemc.xyz
Referer
https://redditauth.elatemc.xyz/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 03 Nov 2020 11:35:44 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
age
10711
status
200
vary
Accept-Encoding
cf-request-id
062f7d4a9e000005c8ee8e4000000001
last-modified
Thu, 15 Jun 2017 00:00:25 GMT
server
cloudflare
etag
W/"23688-Nek3UqOP0hkUH1q+qRJxvE5/dnA"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
x-cloud-trace-context
96b02bb6ffd1f39775a49663f0551561
cache-control
public, max-age=31536000
cf-ray
5ec5cb242be505c8-FRA
react-dom.js
unpkg.com/react-dom@15.6.1/dist/
638 KB
132 KB
Script
General
Full URL
https://unpkg.com/react-dom@15.6.1/dist/react-dom.js
Requested by
Host: redditauth.elatemc.xyz
URL: https://redditauth.elatemc.xyz/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:7aaf , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0e07aea15ce86b6497c54f3999f15254af055f797b1710a8067e6e3b7bf58d82
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Origin
https://redditauth.elatemc.xyz
Referer
https://redditauth.elatemc.xyz/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 03 Nov 2020 11:35:44 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
age
23339511
status
200
vary
Accept-Encoding
cf-request-id
062f7d4a9f000005c8ec2eb000000001
last-modified
Thu, 15 Jun 2017 00:00:27 GMT
server
cloudflare
etag
W/"9f70a-t2i0yDuQUYWmEFKZryjjkoahVGk"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
x-cloud-trace-context
24f065fc3cc05328de4cfc333823006d
cache-control
public, max-age=31536000
cf-ray
5ec5cb242be805c8-FRA
snoowrap-v1.14.0.min.js
not-an-aardvark.github.io/snoowrap/
283 KB
79 KB
Script
General
Full URL
https://not-an-aardvark.github.io/snoowrap/snoowrap-v1.14.0.min.js
Requested by
Host: redditauth.elatemc.xyz
URL: https://redditauth.elatemc.xyz/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.199.108.153 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
GitHub.com /
Resource Hash
f268102c80552153861c91a429be9dc46309913834558a7be7dbb194e8679e12

Request headers

Origin
https://redditauth.elatemc.xyz
Referer
https://redditauth.elatemc.xyz/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-fastly-request-id
cc23fe7c20b863f75e3940929234ade17f294e35
date
Tue, 03 Nov 2020 11:35:44 GMT
content-encoding
gzip
age
0
x-cache
MISS
status
200
content-length
80599
x-served-by
cache-hhn4028-HHN
access-control-allow-origin
*
last-modified
Thu, 14 Nov 2019 09:37:12 GMT
server
GitHub.com
x-github-request-id
BDF8:DFB3:232854B:24AF365:5FA1408F
x-timer
S1604403344.122117,VS0,VE96
etag
W/"5dcd2048-46a90"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
via
1.1 varnish
expires
Tue, 03 Nov 2020 11:45:44 GMT
cache-control
max-age=600
accept-ranges
bytes
x-proxy-cache
MISS
x-cache-hits
0
browser.js
redditauth.elatemc.xyz/
11 KB
3 KB
Script
General
Full URL
https://redditauth.elatemc.xyz/browser.js
Requested by
Host: redditauth.elatemc.xyz
URL: https://redditauth.elatemc.xyz/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
149.56.107.134 Montreal, Canada, ASN16276 (OVH, FR),
Reverse DNS
ns530584.ip-149-56-107.net
Software
Apache/2.4.29 (Ubuntu) /
Resource Hash
7d98c66cb5c4509634f1ca36339741590882ef7de2e4cced9c95e51d57bc0f1c

Request headers

Referer
https://redditauth.elatemc.xyz/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Tue, 03 Nov 2020 11:35:44 GMT
Content-Encoding
gzip
Last-Modified
Mon, 09 Sep 2019 03:29:21 GMT
Server
Apache/2.4.29 (Ubuntu)
ETag
"2cac-5921664cdedde-gzip"
Vary
Accept-Encoding
Content-Type
application/javascript
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=99
Content-Length
2963
access_token
www.reddit.com/api/v1/
0
0
Other
General
Full URL
https://www.reddit.com/api/v1/access_token
Protocol
H2
Server
199.232.53.140 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
snooserv /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept
*/*
Access-Control-Request-Method
POST
Access-Control-Request-Headers
authorization
Origin
https://redditauth.elatemc.xyz
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Sec-Fetch-Mode
cors

Response headers

status
200
content-type
application/json; charset=UTF-8
access-control-allow-origin
*
access-control-allow-methods
POST
access-control-allow-headers
Authorization,
access-control-allow-credentials
false
access-control-expose-headers
X-Ratelimit-Used, X-Ratelimit-Remaining, X-Ratelimit-Reset, X-Moose
x-frame-options
SAMEORIGIN
x-content-type-options
nosniff
x-xss-protection
1; mode=block
cache-control
max-age=0, must-revalidate
x-moose
majestic
accept-ranges
bytes
date
Tue, 03 Nov 2020 11:35:44 GMT
via
1.1 varnish
strict-transport-security
max-age=15552000; includeSubDomains; preload
server
snooserv
content-length
0
access_token
www.reddit.com/api/v1/
150 B
446 B
Fetch
General
Full URL
https://www.reddit.com/api/v1/access_token
Requested by
Host: redditauth.elatemc.xyz
URL: https://redditauth.elatemc.xyz/browser.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
199.232.53.140 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
snooserv /
Resource Hash
2284f654f3ef0c7e917ecad519f891a2dc854fbf613225110c84b2ea6c572ecd
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://redditauth.elatemc.xyz/
authorization
Basic MFJ5MVRhS0dGTHRQNVE6
Content-Type
multipart/form-data; boundary=----WebKitFormBoundaryEdyKsB8BnxPJiVVc

Response headers

date
Tue, 03 Nov 2020 11:35:44 GMT
via
1.1 varnish
x-content-type-options
nosniff
status
200
content-length
150
x-xss-protection
1; mode=block
x-moose
majestic
server
snooserv
x-frame-options
SAMEORIGIN
x-reddit-loid
00000000008qk4k4uq.2.1604403344671.Z0FBQUFBQmZvVUNRRzhqaFlBWklYNjNvM0FhV29zZXo5bERDekJ2am9MSVVlWU8yZnNrcVQ1QzRxMHhEQ0ZDb1RlV3NMUVgtUDA4YW1YMzNNQWdGY3E2MU5tZG5wa29nNWRNemxKaHhnbXU1VHNmTnpJLXZnWTc3dWhnenBrdFo0Qnp0RXEtd0w1QWQ
strict-transport-security
max-age=15552000; includeSubDomains; preload
access-control-allow-methods
POST
content-type
application/json; charset=UTF-8
access-control-allow-origin
*
access-control-expose-headers
X-Ratelimit-Used, X-Ratelimit-Remaining, X-Ratelimit-Reset, X-Moose
cache-control
max-age=0, must-revalidate
access-control-allow-credentials
false
accept-ranges
bytes
access-control-allow-headers
Authorization,
scopes
oauth.reddit.com/api/v1/
0
0
Other
General
Full URL
https://oauth.reddit.com/api/v1/scopes?raw_json=1
Protocol
H2
Server
199.232.53.140 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
snooserv /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept
*/*
Access-Control-Request-Method
GET
Access-Control-Request-Headers
authorization,content-type
Origin
https://redditauth.elatemc.xyz
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Sec-Fetch-Mode
cors

Response headers

status
200
content-type
text/html; charset=UTF-8
access-control-allow-origin
*
access-control-allow-methods
GET, POST, PUT, PATCH, DELETE
access-control-allow-headers
Authorization, Content-Type, X-Reddit-Web-Client,
access-control-allow-credentials
false
access-control-expose-headers
X-Ratelimit-Used, X-Ratelimit-Remaining, X-Ratelimit-Reset, X-Moose
x-ua-compatible
IE=edge
x-frame-options
SAMEORIGIN
x-content-type-options
nosniff
x-xss-protection
1; mode=block
expires
-1
cache-control
private, s-maxage=0, max-age=0, must-revalidate, no-store, max-age=0, must-revalidate
x-moose
majestic
accept-ranges
bytes
date
Tue, 03 Nov 2020 11:35:44 GMT
via
1.1 varnish
strict-transport-security
max-age=15552000; includeSubDomains; preload
server
snooserv
content-length
0
scopes
oauth.reddit.com/api/v1/
4 KB
2 KB
XHR
General
Full URL
https://oauth.reddit.com/api/v1/scopes?raw_json=1
Requested by
Host: not-an-aardvark.github.io
URL: https://not-an-aardvark.github.io/snoowrap/snoowrap-v1.14.0.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
199.232.53.140 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
snooserv /
Resource Hash
1a9b367498a84b2f8ceab710d3526b979b8f24c6e972823e9af9b2213e24d0cc
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://redditauth.elatemc.xyz/
Authorization
bearer -utd6U3jfCt8T_IpNrx7WRRsxoe6K4A
Content-Type
application/json

Response headers

date
Tue, 03 Nov 2020 11:35:45 GMT
content-encoding
gzip
x-content-type-options
nosniff
access-control-allow-origin
*
status
200
vary
accept-encoding
content-length
1218
x-xss-protection
1; mode=block
x-ua-compatible
IE=edge
x-moose
majestic
server
snooserv
x-frame-options
SAMEORIGIN
strict-transport-security
max-age=15552000; includeSubDomains; preload
access-control-allow-methods
GET, POST, PUT, PATCH, DELETE
content-type
application/json; charset=UTF-8
via
1.1 varnish
access-control-expose-headers
X-Ratelimit-Used, X-Ratelimit-Remaining, X-Ratelimit-Reset, X-Moose
cache-control
private, s-maxage=0, max-age=0, must-revalidate, no-store, max-age=0, must-revalidate
access-control-allow-credentials
false
accept-ranges
bytes
access-control-allow-headers
Authorization, Content-Type, X-Reddit-Web-Client,
expires
-1

Verdicts & Comments Add Verdict or Comment

14 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes object| React object| ReactDOM function| P function| snoowrap function| _extends function| AnonymousTokenDisplay function| ClientInfoInput function| ScopeSelection function| GenerateButton function| UserTokenDisplay

0 Cookies

3 Console Messages

Source Level URL
Text
console-api debug URL: https://unpkg.com/react-dom@15.6.1/dist/react-dom.js(Line 5435)
Message:
Download the React DevTools for a better development experience: https://fb.me/react-devtools
console-api error URL: https://unpkg.com/react-dom@15.6.1/dist/react-dom.js(Line 18371)
Message:
Warning: Unknown DOM property readonly. Did you mean readOnly? in input (created by AnonymousTokenDisplay) in span (created by AnonymousTokenDisplay) in div (created by AnonymousTokenDisplay) in AnonymousTokenDisplay (created by RedditOauthHelper) in div (created by RedditOauthHelper) in RedditOauthHelper
console-api error URL: https://unpkg.com/react-dom@15.6.1/dist/react-dom.js(Line 18371)
Message:
Warning: Failed form propType: You provided a `value` prop to a form field without an `onChange` handler. This will render a read-only field. If the field should be mutable use `defaultValue`. Otherwise, set either `onChange` or `readOnly`. Check the render method of `AnonymousTokenDisplay`.