URL: https://wanglaoji.st/sasuke/amp1.html?bagus=BLACKTOGEL
Submission Tags: @phish_report
Submission: On August 31 via api from FI — Scanned from FI

Summary

This website contacted 4 IPs in 2 countries across 2 domains to perform 6 HTTP transactions. The main IP is 204.12.203.57, located in United States and belongs to WII, US. The main domain is wanglaoji.st.
TLS certificate: Issued by wanglaoji.st on August 26th 2024. Valid for: 10 years.
This is the only time wanglaoji.st was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 204.12.203.57 32097 (WII)
3 8.211.36.181 45102 (ALIBABA-C...)
1 ()
6 4
Apex Domain
Subdomains
Transfer
3 chaitin.com
waf.chaitin.com
143 KB
2 wanglaoji.st
wanglaoji.st
1001 B
6 2
Domain Requested by
3 waf.chaitin.com wanglaoji.st
waf.chaitin.com
2 wanglaoji.st waf.chaitin.com
6 2

This site contains links to these domains. Also see Links.

Domain
waf.chaitin.com
Subject Issuer Validity Valid
wanglaoji.st
wanglaoji.st
2024-08-26 -
2034-08-24
10 years crt.sh
waf.chaitin.com
E5
2024-08-22 -
2024-11-20
3 months crt.sh

This page contains 3 frames:

Primary Page: https://wanglaoji.st/sasuke/amp1.html?bagus=BLACKTOGEL
Frame ID: 2A48D260F5E54824484EA1FBA8DC4D3A
Requests: 7 HTTP requests in this frame

Frame: blob://https://wanglaoji.st/429d7ab7-dd58-4edd-bee9-53b866d07c6b
Frame ID: BEAE19678CF6A1CA5A0D70CB5BD09671
Requests: 1 HTTP requests in this frame

Frame: data://truncated
Frame ID: 09473FBC55CB53F27F63817580B05003
Requests: 1 HTTP requests in this frame

Screenshot

Page Title

Just a moment...

Page Statistics

6
Requests

67 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

4
IPs

2
Countries

144 kB
Transfer

192 kB
Size

1
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

6 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request amp1.html
wanglaoji.st/sasuke/
776 B
1001 B
Document
General
Full URL
https://wanglaoji.st/sasuke/amp1.html?bagus=BLACKTOGEL
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
204.12.203.57 , United States, ASN32097 (WII, US),
Reverse DNS
Software
/
Resource Hash
74720346a88b8d4784fe4897e03c6d868d129d31fca6940e4dfe4ded38be393f

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Connection
close
Content-Length
776
Content-Type
text/html
Date
Sat, 31 Aug 2024 06:59:53 GMT
index.html
waf.chaitin.com/captcha/api/
656 B
678 B
XHR
General
Full URL
https://waf.chaitin.com/captcha/api/index.html?0.3745116341702466
Requested by
Host: wanglaoji.st
URL: https://wanglaoji.st/sasuke/amp1.html?bagus=BLACKTOGEL
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
8.211.36.181 Frankfurt am Main, Germany, ASN45102 (ALIBABA-CN-NET Alibaba US Technology Co., Ltd., CN),
Reverse DNS
Software
nginx/1.27.0 /
Resource Hash
45018709835a62d94f35eea92b43c8c3554ed823a484a7ceacde1b352c63d315
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Referer
https://wanglaoji.st/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Date
Sat, 31 Aug 2024 06:59:55 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Content-Encoding
gzip
Server
nginx/1.27.0
Transfer-Encoding
chunked
Content-Type
text/html; charset=utf-8
Access-Control-Allow-Origin
*
Connection
keep-alive
sdk.js
waf.chaitin.com/captcha/api/
142 KB
142 KB
Script
General
Full URL
https://waf.chaitin.com/captcha/api/sdk.js
Requested by
Host: wanglaoji.st
URL: https://wanglaoji.st/sasuke/amp1.html?bagus=BLACKTOGEL
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
8.211.36.181 Frankfurt am Main, Germany, ASN45102 (ALIBABA-CN-NET Alibaba US Technology Co., Ltd., CN),
Reverse DNS
Software
nginx/1.27.0 /
Resource Hash
a424a7d0fbe16c3e51d7553101400be1e38593dd1fe277e8ec4cc49cb65ae60d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Referer
https://wanglaoji.st/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Date
Sat, 31 Aug 2024 06:59:55 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Last-Modified
Mon, 29 Jul 2024 13:46:12 GMT
Server
nginx/1.27.0
ETag
"66a79d24-2370e"
Content-Type
application/javascript
Cache-Control
no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
145166
truncated
/
8 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
80db373721f61d03942c5b6857cfd0bf41f1b23c2192a88e12a602492513996c

Request headers

Referer
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/
38 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
4a663c6bf2e22d68f2836b8d3684420ff1b8c087fdf4b09e84eaf4ff777932f0

Request headers

Referer
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Content-Type
image/png
seed
waf.chaitin.com/captcha/api/
48 B
322 B
XHR
General
Full URL
https://waf.chaitin.com/captcha/api/seed?once_id=21b1ecfa46594835b8f151e22f9aa9b2_4&v=1.0.0&hints=languages,headless,webdriver,webDriverValue,permHook,vendor,globalThis
Requested by
Host: waf.chaitin.com
URL: https://waf.chaitin.com/captcha/api/sdk.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
8.211.36.181 Frankfurt am Main, Germany, ASN45102 (ALIBABA-CN-NET Alibaba US Technology Co., Ltd., CN),
Reverse DNS
Software
nginx/1.27.0 /
Resource Hash
7fa33639ba8de51f8395e201952af7a22a9e15ded09656f3e7792a2ad0701391
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Referer
https://wanglaoji.st/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Access-Control-Allow-Origin
*
Date
Sat, 31 Aug 2024 06:59:56 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Server
nginx/1.27.0
Connection
keep-alive
Content-Length
48
Content-Type
application/json; charset=utf-8
429d7ab7-dd58-4edd-bee9-53b866d07c6b
https://wanglaoji.st/ Frame BEAE
2 KB
0
Document
General
Full URL
blob:https://wanglaoji.st/429d7ab7-dd58-4edd-bee9-53b866d07c6b
Requested by
Host: waf.chaitin.com
URL: https://waf.chaitin.com/captcha/api/sdk.js
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
83e3416117cb409825258f3ec2e3d7ef4ebc0cee84419279042fb792775381d7

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Content-Length
1601
Content-Type
text/html
truncated
/ Frame 0947
158 B
158 B
Document
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
1d6f921b6fc1f7ec2d5c4d366bcc5a4cc21af3ec253d0e2db5e298ad77b2772b

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Content-Type
text/html
inspect
waf.chaitin.com/captcha/api/
0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
waf.chaitin.com
URL
https://waf.chaitin.com/captcha/api/inspect?seed=5gTOys7L

Verdicts & Comments Add Verdict or Comment

3 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| captcha function| run object| $Recap

1 Cookies

Domain/Path Name / Value
wanglaoji.st/ Name: sl-session
Value: AKgPJekQ1GbIC7GTK9Lx4g==

1 Console Messages

Source Level URL
Text
network error URL: https://wanglaoji.st/sasuke/amp1.html?bagus=BLACKTOGEL
Message:
Failed to load resource: the server responded with a status of 468 ()