6.lands.ninja Open in urlscan Pro
162.210.198.167 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://x1cloud.net/click.php?key=nd7oaox9eu8x7catm5u0&click_id=v2-1669800054788-4-10824-1192969-f6c81fae-6724-5915-...
Effective URL:
https://6.lands.ninja/?q=6b7f2bz5215g66o841&s=direct-link&var=edab040575df78ddae6dd30198827672&geo=GB
Submission: On March 16 via manual (March 16th 2023, 6:17:00 am UTC) from RO — Scanned from DE

Summary HTTP 9 Redirects Behaviour Indicators

Summary

This website contacted 2 IPs in 1 countries across 4 domains to perform 9 HTTP transactions. The main IP is 162.210.198.167, located in Elkridge, United States and belongs to LEASEWEB-USA-WDC, US. The main domain is 6.lands.ninja.
TLS certificate: Issued by R3 on February 8th 2023. Valid for: 3 months.

This is the only time 6.lands.ninja was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 1	34.192.29.125 34.192.29.125	14618 (AMAZON-AES) (AMAZON-AES)
5	162.210.198.167 162.210.198.167	30633 (LEASEWEB-...) (LEASEWEB-USA-WDC)
4	2001:550:2:1:... 2001:550:2:1::194:10	174 (COGENT-174) (COGENT-174)
9	2

1 34.192.29.125 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-34-192-29-125.compute-1.amazonaws.com

x1cloud.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 162.210.198.167 (Elkridge, United States)

ASN30633 (LEASEWEB-USA-WDC, US)
PTR: hosted-by.leaseweb.com

6.lands.ninja	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2001:550:2:1::194:10 (United States)

ASN174 (COGENT-174, US)

us.z11.best	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
us.wenga.xyz	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
5	lands.ninja 6.lands.ninja	36 KB
2	wenga.xyz us.wenga.xyz	254 B
2	z11.best us.z11.best	254 B
1	x1cloud.net 1 redirects x1cloud.net	606 B
9	4

	Domain	Requested by
5	6.lands.ninja	6.lands.ninja
2	us.wenga.xyz	6.lands.ninja
2	us.z11.best	6.lands.ninja
1	x1cloud.net	1 redirects
9	4

This site contains no links.

Subject Issuer	Validity	Valid
1.lands.ninja R3	`2023-02-08` - `2023-05-09`	3 months	crt.sh
*.z11.best R3	`2023-01-28` - `2023-04-28`	3 months	crt.sh
*.wenga.xyz R3	`2023-01-28` - `2023-04-28`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://6.lands.ninja/?q=6b7f2bz5215g66o841&s=direct-link&var=edab040575df78ddae6dd30198827672&geo=GB
Frame ID: C98C8609777FFF440A357005C7884A8B
Requests: 9 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Bot check

Page URL History Show full URLs

https://x1cloud.net/click.php?key=nd7oaox9eu8x7catm5u0&click_id=v2-1669800054788-4-10824-1192969... HTTP 302
https://6.lands.ninja/?q=6b7f2bz5215g66o841&s=direct-link&var=edab040575df78ddae6dd30198827672&geo=GB Page URL

Page Statistics

9
Requests

100 %
HTTPS

33 %
IPv6

4
Domains

4
Subdomains

2
IPs

1
Countries

36 kB
Transfer

50 kB
Size

2
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://x1cloud.net/click.php?key=nd7oaox9eu8x7catm5u0&click_id=v2-1669800054788-4-10824-1192969-f6c81fae-6724-5915-c622-4589c0bcbd68&pub_id=775186&source_id=direct-link&pub_id_hash=edab040575df78ddae6dd30198827672 HTTP 302
https://6.lands.ninja/?q=6b7f2bz5215g66o841&s=direct-link&var=edab040575df78ddae6dd30198827672&geo=GB Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

9 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response 6.lands.ninja/ Redirect Chain https://x1cloud.net/click.php?key=nd7oaox9eu8x7catm5u0&click_id=v2-1669800054788-4-10824-1192969-f6c81fae-6724-5915-c622-4589c0bcbd68&pub_id=775186&source_id=direct-link&pub_id_hash=edab040575df78d... https://6.lands.ninja/?q=6b7f2bz5215g66o841&s=direct-link&var=edab040575df78ddae6dd30198827672&geo=GB	13 KB 7 KB	328ms 99ms	Document text/html	162.210.198.167 LEASEWEB-USA-WDC
General Check archive.org Show headers Download Go to Full URL https://6.lands.ninja/?q=6b7f2bz5215g66o841&s=direct-link&var=edab040575df78ddae6dd30198827672&geo=GB Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 162.210.198.167 Elkridge, United States, ASN30633 (LEASEWEB-USA-WDC, US), Reverse DNS hosted-by.leaseweb.com Software nginx/1.20.1 / Resource Hash `878f02475c307854cc5ffd7e212b09f67f26e22c4446bb1e556f712f96de6ba1` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36 accept-language de-DE,de;q=0.9 referer https://us.acedirect.net/bad-click-redirect-link?pubid=775186 Response headers content-encoding gzip content-type text/html; charset=UTF-8 date Thu, 16 Mar 2023 06:16:55 GMT etag W/"34b3-5f525c3cc91db" last-modified Mon, 20 Feb 2023 18:23:51 GMT server nginx/1.20.1 vary Accept-Encoding Redirect headers Connection keep-alive Content-Type text/html; charset=UTF-8 Date Thu, 16 Mar 2023 06:16:55 GMT Location https://6.lands.ninja?q=6b7f2bz5215g66o841&s=direct-link&var=edab040575df78ddae6dd30198827672&geo=GB Server nginx/1.20.2 Strict-Transport-Security max-age=31536000 Transfer-Encoding chunked
GET H2	200	rp-cl-rd-ob.js Show response 6.lands.ninja/	14 KB 6 KB	107ms 106ms	Script application/javascript	162.210.198.167 LEASEWEB-USA-WDC
General Check archive.org Show headers Download Go to Full URL https://6.lands.ninja/rp-cl-rd-ob.js?pubid=775186&siteid=312014&niche=33 Requested by Host: 6.lands.ninja URL: https://6.lands.ninja/?q=6b7f2bz5215g66o841&s=direct-link&var=edab040575df78ddae6dd30198827672&geo=GB Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 162.210.198.167 Elkridge, United States, ASN30633 (LEASEWEB-USA-WDC, US), Reverse DNS hosted-by.leaseweb.com Software nginx/1.20.1 / Resource Hash `a5d43d7214a29ae16f5bbefc716c73d76760cdd93d30e8170fc842bdf3be2734` Request headers accept-language de-DE,de;q=0.9 Referer https://us.acedirect.net/bad-click-redirect-link?pubid=775186 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36 Response headers date Thu, 16 Mar 2023 06:16:55 GMT content-encoding gzip last-modified Mon, 27 Feb 2023 13:57:14 GMT server nginx/1.20.1 etag W/"386a-5f5aedb3a5d3e;5f0cb07c1a49c" vary Accept-Encoding content-type application/javascript
GET H2	200	man.png 6.lands.ninja/img/	10 KB 11 KB	135ms 135ms	Image image/png	162.210.198.167 LEASEWEB-USA-WDC
General Check archive.org Show headers Download Go to Show image Full URL https://6.lands.ninja/img/man.png Requested by Host: 6.lands.ninja URL: https://6.lands.ninja/?q=6b7f2bz5215g66o841&s=direct-link&var=edab040575df78ddae6dd30198827672&geo=GB Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 162.210.198.167 Elkridge, United States, ASN30633 (LEASEWEB-USA-WDC, US), Reverse DNS hosted-by.leaseweb.com Software nginx/1.20.1 / Resource Hash `967b8859fedb2c63afc8ae6ae2839fdd40f0e26af85adc6605a629f3c0ed0837` Request headers accept-language de-DE,de;q=0.9 Referer https://us.acedirect.net/bad-click-redirect-link?pubid=775186 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36 Response headers date Thu, 16 Mar 2023 06:16:55 GMT last-modified Fri, 19 Aug 2022 17:54:25 GMT server nginx/1.20.1 accept-ranges bytes etag "295f-5e69bc9efa59f;5f0cb07c1a49c" content-length 10591 content-type image/png
GET H2	200	logo.png 6.lands.ninja/img/	1 KB 1 KB	99ms 98ms	Image image/png	162.210.198.167 LEASEWEB-USA-WDC
General Check archive.org Show headers Download Go to Show image Full URL https://6.lands.ninja/img/logo.png Requested by Host: 6.lands.ninja URL: https://6.lands.ninja/?q=6b7f2bz5215g66o841&s=direct-link&var=edab040575df78ddae6dd30198827672&geo=GB Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 162.210.198.167 Elkridge, United States, ASN30633 (LEASEWEB-USA-WDC, US), Reverse DNS hosted-by.leaseweb.com Software nginx/1.20.1 / Resource Hash `09d12e3c0e65fda26b9073e70e02fb24fa6941a4a3b1b81211b6470f00769ea5` Request headers accept-language de-DE,de;q=0.9 Referer https://us.acedirect.net/bad-click-redirect-link?pubid=775186 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36 Response headers date Thu, 16 Mar 2023 06:16:56 GMT last-modified Fri, 19 Aug 2022 17:54:24 GMT server nginx/1.20.1 accept-ranges bytes etag "425-5e69bc9e23c07;5f0cb07c1a49c" content-length 1061 content-type image/png
GET H2	200	bot.png 6.lands.ninja/img/	11 KB 11 KB	124ms 123ms	Image image/png	162.210.198.167 LEASEWEB-USA-WDC
General Check archive.org Show headers Download Go to Show image Full URL https://6.lands.ninja/img/bot.png Requested by Host: 6.lands.ninja URL: https://6.lands.ninja/?q=6b7f2bz5215g66o841&s=direct-link&var=edab040575df78ddae6dd30198827672&geo=GB Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 162.210.198.167 Elkridge, United States, ASN30633 (LEASEWEB-USA-WDC, US), Reverse DNS hosted-by.leaseweb.com Software nginx/1.20.1 / Resource Hash `f0434a1fc8ffba3a47bbb9f1fa5a2f789651a020e7b86e507ff300b7c367057f` Request headers accept-language de-DE,de;q=0.9 Referer https://us.acedirect.net/bad-click-redirect-link?pubid=775186 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36 Response headers date Thu, 16 Mar 2023 06:16:56 GMT last-modified Fri, 19 Aug 2022 17:54:24 GMT server nginx/1.20.1 accept-ranges bytes etag "2b23-5e69bc9e22497;5f0cb07c1a49c" content-length 11043 content-type image/png
GET H2	200	st Show response us.z11.best/pb/	34 B 182 B	818ms 101ms	Fetch text/html	2001:550:2:1::194:10 COGENT-174
General Check archive.org Show headers Download Go to Full URL https://us.z11.best/pb/st Requested by Host: 6.lands.ninja URL: https://6.lands.ninja/rp-cl-rd-ob.js?pubid=775186&siteid=312014&niche=33 Protocol H2 Security TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305 Server 2001:550:2:1::194:10 , United States, ASN174 (COGENT-174, US), Reverse DNS Software openresty/1.15.8.3 / Resource Hash `6f9d4356870080ec8ace58f54cc9b6d006577cf9d192f5075d715db16a3f767a` Request headers accept-language de-DE,de;q=0.9 Referer https://us.acedirect.net/bad-click-redirect-link?pubid=775186 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36 Response headers access-control-allow-origin https://6.lands.ninja date Thu, 16 Mar 2023 06:16:57 GMT access-control-allow-credentials true server openresty/1.15.8.3 content-length 34 content-type text/html;charset=UTF-8
GET H2	200	st Show response us.wenga.xyz/pb/	34 B 182 B	517ms 106ms	Fetch text/html	2001:550:2:1::194:10 COGENT-174
General Check archive.org Show headers Download Go to Full URL https://us.wenga.xyz/pb/st Requested by Host: 6.lands.ninja URL: https://6.lands.ninja/rp-cl-rd-ob.js?pubid=775186&siteid=312014&niche=33 Protocol H2 Security TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305 Server 2001:550:2:1::194:10 , United States, ASN174 (COGENT-174, US), Reverse DNS Software openresty/1.15.8.3 / Resource Hash `6f9d4356870080ec8ace58f54cc9b6d006577cf9d192f5075d715db16a3f767a` Request headers accept-language de-DE,de;q=0.9 Referer https://us.acedirect.net/bad-click-redirect-link?pubid=775186 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36 Response headers access-control-allow-origin https://6.lands.ninja date Thu, 16 Mar 2023 06:16:57 GMT access-control-allow-credentials true server openresty/1.15.8.3 content-length 34 content-type text/html;charset=UTF-8
GET H2	200	st us.z11.best/pb/	0 72 B	305ms 103ms	Image text/html	2001:550:2:1::194:10 COGENT-174
General Check archive.org Show headers Download Go to Show image Full URL https://us.z11.best/pb/st?sctp=content-locker&m=ht&pid=775186&sid=312014&dm=6.lands.ninja&c1=https&c2=1&c3=https://us.z11.best/pb/st Protocol H2 Security TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305 Server 2001:550:2:1::194:10 , United States, ASN174 (COGENT-174, US), Reverse DNS Software openresty/1.15.8.3 / Resource Hash `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` Request headers accept-language de-DE,de;q=0.9 Referer https://us.acedirect.net/bad-click-redirect-link?pubid=775186 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36 Response headers date Thu, 16 Mar 2023 06:16:57 GMT server openresty/1.15.8.3 content-length 0 content-type text/html;charset=UTF-8
GET H2	200	st us.wenga.xyz/pb/	0 72 B	304ms 101ms	Image text/html	2001:550:2:1::194:10 COGENT-174
General Check archive.org Show headers Download Go to Show image Full URL https://us.wenga.xyz/pb/st?sctp=content-locker&m=si&pid=775186&sid=312014&dm=6.lands.ninja&c1=https&c2=1&c3=https://us.wenga.xyz/pb/st Protocol H2 Security TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305 Server 2001:550:2:1::194:10 , United States, ASN174 (COGENT-174, US), Reverse DNS Software openresty/1.15.8.3 / Resource Hash `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` Request headers accept-language de-DE,de;q=0.9 Referer https://us.acedirect.net/bad-click-redirect-link?pubid=775186 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36 Response headers date Thu, 16 Mar 2023 06:16:57 GMT server openresty/1.15.8.3 content-length 0 content-type text/html;charset=UTF-8

Verdicts & Comments Add Verdict or Comment

8 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

2 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			x1cloud.net/	1970-01-20 10:23:53	Name: uclick Value: bz5215g66o
			x1cloud.net/	1970-01-20 10:23:53	Name: uclickhash Value: bz5215g66o-bz5215g66o-ho8n-0-fy3y-1617-16gx-107deb

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

6.lands.ninja
us.wenga.xyz
us.z11.best
x1cloud.net
162.210.198.167
2001:550:2:1::194:10
34.192.29.125
09d12e3c0e65fda26b9073e70e02fb24fa6941a4a3b1b81211b6470f00769ea5
6f9d4356870080ec8ace58f54cc9b6d006577cf9d192f5075d715db16a3f767a
878f02475c307854cc5ffd7e212b09f67f26e22c4446bb1e556f712f96de6ba1
967b8859fedb2c63afc8ae6ae2839fdd40f0e26af85adc6605a629f3c0ed0837
a5d43d7214a29ae16f5bbefc716c73d76760cdd93d30e8170fc842bdf3be2734
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
f0434a1fc8ffba3a47bbb9f1fa5a2f789651a020e7b86e507ff300b7c367057f

6.lands.ninja Open in urlscan Pro 162.210.198.167 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Page Statistics

9 Requests

100 %HTTPS

33 %IPv6

4 Domains

4 Subdomains

2 IPs

1 Countries

36 kBTransfer

50 kBSize

2 Cookies

0 Outgoing links

Page URL History

Redirected requests

9 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

8 JavaScript Global Variables

2 Cookies

Indicators

6.lands.ninja Open in urlscan Pro
162.210.198.167 Public Scan

Screenshot
Live screenshot

Full Image

9
Requests

100 %
HTTPS

33 %
IPv6

4
Domains

4
Subdomains

2
IPs

1
Countries

36 kB
Transfer

50 kB
Size

2
Cookies

9 HTTP transactions
0 data transactions