Report - flikcover.com/index/index

Report Overview

Submitted URL
flikcover.com/index/index
IP
104.21.13.123
ASN
#13335 CLOUDFLARENET
Submitted
2024-04-25 06:06:23
Access
public
Website Title
Amazon
Final URL
flikcover.com/index/login/index.html
Tags
amazon phishing
urlquery detections
Phishing - Amazon

Detections

urlquery
12
Network Intrusion Detection
0
Threat Detection Systems
42

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
flikcover.com	unknown	2024-02-18	2024-02-18	2024-03-26	5.7 kB	1.4 MB	104.21.13.123
cdn.dcloud.net.cn	116868	2013-07-17	2018-09-15	2024-04-24	432 B	0 B	0.0.0.0

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

Scan Date	Severity	Indicator	Alert
2024-04-24	medium	flikcover.com/	Amazon.com Inc.
2024-04-24	medium	flikcover.com/	Amazon.com Inc.
2024-04-24	medium	flikcover.com/	Amazon.com Inc.
2024-04-24	medium	flikcover.com/	Amazon.com Inc.
2024-04-24	medium	flikcover.com/	Amazon.com Inc.
2024-04-24	medium	flikcover.com/	Amazon.com Inc.
2024-04-24	medium	flikcover.com/	Amazon.com Inc.
2024-04-24	medium	flikcover.com/	Amazon.com Inc.
2024-04-24	medium	flikcover.com/	Amazon.com Inc.
2024-04-24	medium	flikcover.com/index/index	Amazon.com Inc.

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

Scan Date	Severity	Indicator	Alert
2024-04-24	medium	flikcover.com	Sinkholed
2024-04-24	medium	flikcover.com	Sinkholed
2024-04-24	medium	flikcover.com	Sinkholed
2024-04-24	medium	flikcover.com	Sinkholed
2024-04-24	medium	flikcover.com	Sinkholed
2024-04-24	medium	flikcover.com	Sinkholed
2024-04-24	medium	flikcover.com	Sinkholed
2024-04-24	medium	flikcover.com	Sinkholed
2024-04-24	medium	flikcover.com	Sinkholed
2024-04-24	medium	flikcover.com	Sinkholed
2024-04-24	medium	flikcover.com	Sinkholed

ThreatFox

No alerts detected

JavaScript (4)

	URL	Size	First Seen	Last Seen
	flikcover.com/static/jquery-3.5.0.min.js	90 kB	2023-03-07	2024-05-04
Pretty URL flikcover.com/static/jquery-3.5.0.min.js IP 104.21.13.123 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:03:07 Last Seen2024-05-04 08:18:00 Times Seen56662 Hash 12108007906290015100837a6a61e9f4 1d6ae46f2ffa213dede37a521b011ec1cd8d1ad3 c4dccdd9ae25b64078e0c73f273de94f8894d5c99e4741645ece29aeefc9c5a4 Loading...

	flikcover.com/static/layer/layer.js	22 kB	2023-04-05	2024-05-04
Pretty URL flikcover.com/static/layer/layer.js IP 104.21.13.123 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML false Observations First Seen2023-04-05 06:05:22 Last Seen2024-05-04 08:22:54 Times Seen1008 Hash d0c975e34297f3e44e99c9d83555ffc1 7e465bd79e65428cf07e5991196cff512ce44a4b 691aad750624d84b17f2fbb73a4982860edd18837f3000c5b660ac82bf408e82 Loading...

	flikcover.com/index/login/index.html	0 B	2023-03-07	2024-05-04
Pretty URL flikcover.com/index/login/index.html IP 104.21.13.123 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML true Observations First Seen2023-03-07 01:01:59 Last Seen2024-05-04 09:01:24 Times Seen37331214 Hash d41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Loading...

	flikcover.com/index/login/index.html	0 B	2023-03-07	2024-05-04
Pretty URL flikcover.com/index/login/index.html IP 104.21.13.123 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML true Observations First Seen2023-03-07 01:01:59 Last Seen2024-05-04 09:01:24 Times Seen37331214 Hash d41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Loading...

HTTP Transactions (12)

URL IP Response Size

flikcover.com/static/layer/layer.js

104.21.13.123

200 OK

18 kB

URL GET HTTP/3
flikcover.com/static/layer/layer.js
IP
104.21.13.123:443
ASN
#13335 CLOUDFLARENET

Requested by
https://flikcover.com/index/login/index.html
Certificate
IssuerLet's Encrypt
Subjectflikcover.com
FingerprintE1:5C:CF:64:D9:E9:F1:4A:E7:E0:AB:7C:D8:FF:A4:51:4D:38:4A:AE
ValidityWed, 17 Apr 2024 07:14:50 GMT - Tue, 16 Jul 2024 07:14:49 GMT

File type
JavaScript source, Unicode text, UTF-8 text, with very long lines (22032)
Size
18 kB (17603 bytes)
Hash
6e80f0cff749c82653b9cdde9eeab937
7034e797787919a6742525a69723bf9dfda13790
1ce6649d82d2db0f8e4823f701ddfcfd9c7f107cb446c907e46ec7e57171a2a3

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Amazon
OpenPhish	phishing	Amazon.com Inc.
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /static/layer/layer.js HTTP/1.1
Host: flikcover.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://flikcover.com/index/login/index.html
Cookie: sa0c19f20=ga5mgmrfr88elq82gu917vqvr4
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Thu, 25 Apr 2024 06:05:58 GMT
content-type: application/javascript
last-modified: Tue, 05 Dec 2017 03:57:26 GMT
vary: Accept-Encoding
etag: W/"5a261926-5664"
expires: Thu, 25 Apr 2024 06:19:33 GMT
cache-control: max-age=43200
strict-transport-security: max-age=31536000
cf-cache-status: HIT
age: 42384
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Be3IfLmxsYNf1Me6BWt9KcnUlGe6ZjYKxFpyAzQwgZyZ6gxZ5CX2JjoTCyMLfRa9%2FM6IlBIwsRg1GsqJG00WxCJp4bBWEX1QmaioqXSGamzY%2Fig3Wg8tjqLECSFLKs46"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 879c24f95994569a-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400

flikcover.com/static/index/css/main.css

104.21.13.123

200 OK

220 kB

URL GET HTTP/3
flikcover.com/static/index/css/main.css
IP
104.21.13.123:443
ASN
#13335 CLOUDFLARENET

Requested by
https://flikcover.com/index/login/index.html
Certificate
IssuerLet's Encrypt
Subjectflikcover.com
FingerprintE1:5C:CF:64:D9:E9:F1:4A:E7:E0:AB:7C:D8:FF:A4:51:4D:38:4A:AE
ValidityWed, 17 Apr 2024 07:14:50 GMT - Tue, 16 Jul 2024 07:14:49 GMT

File type
ASCII text, with very long lines (65536), with no line terminators
Size
220 kB (220491 bytes)
Hash
62ff28c55f8159cc084f1c82f84c3b12
d0eb11a30cf87270f2d92401cf426ea3d805182a
cfe0e13115bf23dae63f17031ea3102c4efa5ceb7902f3dd7a4a5923f20fa05e

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Amazon
OpenPhish	phishing	Amazon.com Inc.
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /static/index/css/main.css HTTP/1.1
Host: flikcover.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://flikcover.com/index/login/index.html
Cookie: sa0c19f20=ga5mgmrfr88elq82gu917vqvr4
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Thu, 25 Apr 2024 06:05:58 GMT
content-type: text/css
last-modified: Thu, 19 Aug 2021 13:40:00 GMT
vary: Accept-Encoding
etag: W/"611e5f30-172b0"
expires: Thu, 25 Apr 2024 12:13:21 GMT
cache-control: max-age=43200
strict-transport-security: max-age=31536000
cf-cache-status: HIT
age: 21157
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=B%2B3X6SL0BDgYtSGiK50LdAB0s7QFbMc6Wz%2BhuoH72%2BXQaqPIMp6bW%2F47ooRgSTRSIXcdGAQmk5zijwYe1jN4G45B5ovlVMhSkLPIr1SBeIc2rwLSDkI5lUVy%2BRcOdk4U"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 879c24f9498b569a-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400

flikcover.com/static/index/css/common.css

104.21.13.123

200 OK

230 kB

URL GET HTTP/3
flikcover.com/static/index/css/common.css
IP
104.21.13.123:443
ASN
#13335 CLOUDFLARENET

Requested by
https://flikcover.com/index/login/index.html
Certificate
IssuerLet's Encrypt
Subjectflikcover.com
FingerprintE1:5C:CF:64:D9:E9:F1:4A:E7:E0:AB:7C:D8:FF:A4:51:4D:38:4A:AE
ValidityWed, 17 Apr 2024 07:14:50 GMT - Tue, 16 Jul 2024 07:14:49 GMT

File type
Unicode text, UTF-8 text, with very long lines (7033), with CRLF line terminators
Size
230 kB (230342 bytes)
Hash
81fde7918c34685880063fdd83b8de2d
7c7c9d1172c1016f6bcc5de3474d224ce832d752
44cfadf841e99b39ac309e388291436dd2750d29634901eb9e749a7e99ec7299

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Amazon
OpenPhish	phishing	Amazon.com Inc.
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /static/index/css/common.css HTTP/1.1
Host: flikcover.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://flikcover.com/index/login/index.html
Cookie: sa0c19f20=ga5mgmrfr88elq82gu917vqvr4
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Thu, 25 Apr 2024 06:05:58 GMT
content-type: text/css
last-modified: Thu, 19 Aug 2021 14:00:20 GMT
vary: Accept-Encoding
etag: W/"611e63f4-4a04"
expires: Thu, 25 Apr 2024 06:19:33 GMT
cache-control: max-age=43200
strict-transport-security: max-age=31536000
cf-cache-status: HIT
age: 42384
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1559n2AltI8iYL3psetQUtUaRCjHkjwp85WTG0hBOb%2BlNoBP5DDGhFMxanH66FIrBZOhbYrMbn%2BWRF%2F5QPWNwc2dcgDIvhYMsOm1UNU8jW%2BzvvdYfkUuYY1S5BMZRm67"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 879c24f9498d569a-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400

flikcover.com/static/jquery-3.5.0.min.js

104.21.13.123

200 OK

248 kB

URL GET HTTP/3
flikcover.com/static/jquery-3.5.0.min.js
IP
104.21.13.123:443
ASN
#13335 CLOUDFLARENET

Requested by
https://flikcover.com/index/login/index.html
Certificate
IssuerLet's Encrypt
Subjectflikcover.com
FingerprintE1:5C:CF:64:D9:E9:F1:4A:E7:E0:AB:7C:D8:FF:A4:51:4D:38:4A:AE
ValidityWed, 17 Apr 2024 07:14:50 GMT - Tue, 16 Jul 2024 07:14:49 GMT

File type
JavaScript source, ASCII text, with very long lines (65451)
Size
248 kB (248209 bytes)
Hash
12108007906290015100837a6a61e9f4
1d6ae46f2ffa213dede37a521b011ec1cd8d1ad3
c4dccdd9ae25b64078e0c73f273de94f8894d5c99e4741645ece29aeefc9c5a4

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Amazon
OpenPhish	phishing	Amazon.com Inc.
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /static/jquery-3.5.0.min.js HTTP/1.1
Host: flikcover.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://flikcover.com/index/login/index.html
Cookie: sa0c19f20=ga5mgmrfr88elq82gu917vqvr4
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Thu, 25 Apr 2024 06:05:58 GMT
content-type: application/javascript
last-modified: Mon, 27 Apr 2020 14:07:18 GMT
vary: Accept-Encoding
etag: W/"5ea6e716-15d95"
expires: Thu, 25 Apr 2024 06:19:33 GMT
cache-control: max-age=43200
strict-transport-security: max-age=31536000
cf-cache-status: HIT
age: 42384
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Ju6nyxROfH7UEUXRlJyaMBQLfMWfRc6W7EXVLtXsWyU5czBWMpVDFcd%2F3dnlJP9YtfCuDFBB%2Fpf0kMdXk3XQ7NEpiMJUDIEh8S%2BZNPDshjH2vQwCWjMj%2FinB16tX8nP1"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 879c24f95991569a-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400

flikcover.com/static/index/fonts/Rubik-Regular.35af6dbe.ttf

104.21.13.123

200 OK

221 kB

URL GET HTTP/3
flikcover.com/static/index/fonts/Rubik-Regular.35af6dbe.ttf
IP
104.21.13.123:443
ASN
#13335 CLOUDFLARENET

Requested by
https://flikcover.com/index/login/index.html
Certificate
IssuerLet's Encrypt
Subjectflikcover.com
FingerprintE1:5C:CF:64:D9:E9:F1:4A:E7:E0:AB:7C:D8:FF:A4:51:4D:38:4A:AE
ValidityWed, 17 Apr 2024 07:14:50 GMT - Tue, 16 Jul 2024 07:14:49 GMT

File type
TrueType Font data, 20 tables, 1st "GPOS", 13 names, Microsoft, language 0x409, Copyright (c) 2015 by Hubert & Fischer. All rights reserved.RubikRegularHubert&Fischer: Rubik Re
Size
221 kB (220600 bytes)
Hash
35af6dbe749b9704f03282e5a5949253
f0711cdc35046a54d1b887fafbd12de0a5b82549
c17737eba7fa3f4854f4cd50226e75a9e954b4fc460d805b22e5c31a04b0261d

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Amazon
OpenPhish	phishing	Amazon.com Inc.
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /static/index/fonts/Rubik-Regular.35af6dbe.ttf HTTP/1.1
Host: flikcover.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://flikcover.com/static/index/css/common.css
Cookie: sa0c19f20=ga5mgmrfr88elq82gu917vqvr4
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Thu, 25 Apr 2024 06:05:59 GMT
content-type: application/octet-stream
content-length: 220600
last-modified: Tue, 17 Aug 2021 08:24:34 GMT
etag: "611b7242-35db8"
strict-transport-security: max-age=31536000
cache-control: max-age=14400
cf-cache-status: REVALIDATED
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Se0Z1yCcyyBwZaICXKDGddoPYHkB24TcbYtPasCLNR5nEkm6oxzdPTBpipzk2uZuhrJTufjpWbtIiwdx%2B%2FmzRv9zZ%2B4mnFy7ioi53LgEnCngKtOaakkEjKMbHPczggC%2B"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 879c24fa1a51569a-OSL
alt-svc: h3=":443"; ma=86400

flikcover.com/static/index/fonts/Rubik-Medium.4dff84c2.ttf

104.21.13.123

200 OK

216 kB

URL GET HTTP/3
flikcover.com/static/index/fonts/Rubik-Medium.4dff84c2.ttf
IP
104.21.13.123:443
ASN
#13335 CLOUDFLARENET

Requested by
https://flikcover.com/index/login/index.html
Certificate
IssuerLet's Encrypt
Subjectflikcover.com
FingerprintE1:5C:CF:64:D9:E9:F1:4A:E7:E0:AB:7C:D8:FF:A4:51:4D:38:4A:AE
ValidityWed, 17 Apr 2024 07:14:50 GMT - Tue, 16 Jul 2024 07:14:49 GMT

File type
TrueType Font data, 20 tables, 1st "GPOS", 15 names, Microsoft, language 0x409, Copyright (c) 2015 by Hubert & Fischer. All rights reserved.Rubik MediumRegularHubert&Fischer: R
Size
216 kB (216244 bytes)
Hash
4dff84c26bc906823e344e1eb76fe7a7
5da5f96c57060e54a922ea0df12b4c29797593b9
82a8c818aab7ca3157c49795b2fc47a08a1fa490dd5aa7acb7a079615c3dda51

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Amazon
OpenPhish	phishing	Amazon.com Inc.
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /static/index/fonts/Rubik-Medium.4dff84c2.ttf HTTP/1.1
Host: flikcover.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://flikcover.com/static/index/css/common.css
Cookie: sa0c19f20=ga5mgmrfr88elq82gu917vqvr4
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Thu, 25 Apr 2024 06:05:59 GMT
content-type: application/octet-stream
content-length: 216244
last-modified: Tue, 17 Aug 2021 08:24:08 GMT
etag: "611b7228-34cb4"
strict-transport-security: max-age=31536000
cache-control: max-age=14400
cf-cache-status: REVALIDATED
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=YyfAkIVudRS9MV%2BHSh6JGYv5xWu3YxgSuy9yJuvQGfLMBX9IAvqthHOSV%2FEfD4ngnhIjkoxdmb5Ti3L%2FMlCWlZkXSHzKZTymsXatqTkIryKbsWGoPzD3MQWSkYQhm%2BLc"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 879c24fa2a5a569a-OSL
alt-svc: h3=":443"; ma=86400

cdn.dcloud.net.cn/img/shadow-grey.png

0.0.0.0

0 B

URL GET
cdn.dcloud.net.cn/img/shadow-grey.png
IP
0.0.0.0:0
ASN
#0

Requested by
https://flikcover.com/index/login/index.html

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /img/shadow-grey.png HTTP/1.1
Host: cdn.dcloud.net.cn
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://flikcover.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

flikcover.com/index/login/index.html

104.21.13.123

200 OK

5.7 kB

URL User Request GET HTTP/2
flikcover.com/index/login/index.html
IP
104.21.13.123:443
ASN
#13335 CLOUDFLARENET

Certificate
IssuerLet's Encrypt
Subjectflikcover.com
FingerprintE1:5C:CF:64:D9:E9:F1:4A:E7:E0:AB:7C:D8:FF:A4:51:4D:38:4A:AE
ValidityWed, 17 Apr 2024 07:14:50 GMT - Tue, 16 Jul 2024 07:14:49 GMT

File type
JavaScript source, Unicode text, UTF-8 text, with very long lines (5827), with no line terminators
Size
5.7 kB (5690 bytes)
Hash
3553de0e77749cb0f05f44fcd9733622
7cef9bf8ec773ae60384362361e12563bb9d6f62
caccc3e3d6580aada7a55d498c852cd446afeeb7fc566ddad19d4f7da7bfbb1c

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Amazon
OpenPhish	phishing	Amazon.com Inc.
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /index/login/index.html HTTP/1.1
Host: flikcover.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Cookie: sa0c19f20=ga5mgmrfr88elq82gu917vqvr4
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Thu, 25 Apr 2024 06:05:58 GMT
content-type: text/html; charset=utf-8
vary: Accept-Encoding
expires: Thu, 19 Nov 1981 08:52:00 GMT
cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
pragma: no-cache
strict-transport-security: max-age=31536000
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=oYt5%2FhGwnSWniJKuyMVLzhQK1KALmqujI1WN8ftM0fe0RaNkfFtuXXonefxH34duAic5FUZ%2FTawDldby%2FkSXt4x4yWmnncmF%2BsNMTbRbSAyx5I6Pt5IM%2BjZXQ%2Flws10y"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 879c24f5d9747129-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

flikcover.com/static/layer/theme/default/layer.css?v=3.1.1

104.21.13.123

200 OK

14 kB

URL GET HTTP/3
flikcover.com/static/layer/theme/default/layer.css?v=3.1.1
IP
104.21.13.123:443
ASN
#13335 CLOUDFLARENET

Requested by
https://flikcover.com/index/login/index.html
Certificate
IssuerLet's Encrypt
Subjectflikcover.com
FingerprintE1:5C:CF:64:D9:E9:F1:4A:E7:E0:AB:7C:D8:FF:A4:51:4D:38:4A:AE
ValidityWed, 17 Apr 2024 07:14:50 GMT - Tue, 16 Jul 2024 07:14:49 GMT

File type
ASCII text, with very long lines (14367), with no line terminators
Size
14 kB (14367 bytes)
Hash
3d2e0d91c5c0b96abb8dbdc2234aba77
9d55e153b30fd7414fada5718e20918e9c7f65e7
e3144d018a6a24f733c6fc2a2ee603fb583f0030585e9d4b71bec471b78e31fc

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Amazon
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /static/layer/theme/default/layer.css?v=3.1.1 HTTP/1.1
Host: flikcover.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://flikcover.com/index/login/index.html
Cookie: sa0c19f20=ga5mgmrfr88elq82gu917vqvr4
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Thu, 25 Apr 2024 06:05:58 GMT
content-type: text/css
last-modified: Tue, 05 Dec 2017 03:57:26 GMT
vary: Accept-Encoding
etag: W/"5a261926-381f"
expires: Thu, 25 Apr 2024 06:19:35 GMT
cache-control: max-age=43200
strict-transport-security: max-age=31536000
cf-cache-status: HIT
age: 42383
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=thwLQPrwMDXOgY%2FZjI7xZtwU5Jz4ww8s2ikDEd5JUP64bNk24XT6DBi3o3cd77gozp4hn%2F4%2BfTHYwCvPQ5RLeTBPVMAsyOMSoGyO8ZtUxj%2FHVbB0wvhwnk9s7wJOzACA"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 879c24f9ea32569a-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400

flikcover.com/static/index/fonts/Rubik-BlackItalic.77c7f123.ttf

104.21.13.123

200 OK

192 kB

URL GET HTTP/3
flikcover.com/static/index/fonts/Rubik-BlackItalic.77c7f123.ttf
IP
104.21.13.123:443
ASN
#13335 CLOUDFLARENET

Requested by
https://flikcover.com/index/login/index.html
Certificate
IssuerLet's Encrypt
Subjectflikcover.com
FingerprintE1:5C:CF:64:D9:E9:F1:4A:E7:E0:AB:7C:D8:FF:A4:51:4D:38:4A:AE
ValidityWed, 17 Apr 2024 07:14:50 GMT - Tue, 16 Jul 2024 07:14:49 GMT

File type
TrueType Font data, 18 tables, 1st "GPOS", 15 names, Microsoft, language 0x409, Copyright (c) 2015 by Hubert & Fischer. All rights reserved.Rubik BlackItalicHubert&Fischer: Rub
Size
192 kB (192004 bytes)
Hash
77c7f123391595707a1d0690dddaa11e
3f77b9d3d8155511d94d72a410c80b3d18001cde
ce0e6de088497437824e571c7a0c38974f205a0bbb8b20ae5b309e419662f063

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Amazon
OpenPhish	phishing	Amazon.com Inc.
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /static/index/fonts/Rubik-BlackItalic.77c7f123.ttf HTTP/1.1
Host: flikcover.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://flikcover.com/static/index/css/common.css
Cookie: sa0c19f20=ga5mgmrfr88elq82gu917vqvr4
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Thu, 25 Apr 2024 06:05:59 GMT
content-type: application/octet-stream
content-length: 192004
last-modified: Thu, 19 Aug 2021 13:45:30 GMT
etag: "611e607a-2ee04"
strict-transport-security: max-age=31536000
cache-control: max-age=14400
cf-cache-status: REVALIDATED
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=NQgNBq6uHE9T%2FXhEMpTEsE2wRiiaYABGsJ2A9XCbLxgj9airMZMtLCA3XO8x92VegRMDJ2OsUioT0qvyTLuUIi%2BJCp9tJWhN8G%2BCUur2vIZW1rIupVG%2B9MzCzjkAyVA%2F"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 879c24fa1a50569a-OSL
alt-svc: h3=":443"; ma=86400

flikcover.com/favicon.ico

104.21.13.123

200 OK

4.3 kB

URL GET HTTP/3
flikcover.com/favicon.ico
IP
104.21.13.123:443
ASN
#13335 CLOUDFLARENET

Requested by
https://flikcover.com/index/login/index.html
Certificate
IssuerLet's Encrypt
Subjectflikcover.com
FingerprintE1:5C:CF:64:D9:E9:F1:4A:E7:E0:AB:7C:D8:FF:A4:51:4D:38:4A:AE
ValidityWed, 17 Apr 2024 07:14:50 GMT - Tue, 16 Jul 2024 07:14:49 GMT

File type
MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Size
4.3 kB (4286 bytes)
Hash
ea344923d7e68380c811191e36e04020
f23f0ec8c29df2a1b31b0e0cb46e54e22420bca1
97a8aa4a501654a28f1fe60e1fce3f9070c80d698790beb60b2d714f78bd786f

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Amazon
OpenPhish	phishing	Amazon.com Inc.
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /favicon.ico HTTP/1.1
Host: flikcover.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://flikcover.com/index/login/index.html
Cookie: sa0c19f20=ga5mgmrfr88elq82gu917vqvr4
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Thu, 25 Apr 2024 06:05:59 GMT
content-type: image/x-icon
last-modified: Fri, 13 Nov 2020 15:05:22 GMT
etag: W/"5faea0b2-10be"
strict-transport-security: max-age=31536000
cache-control: max-age=14400
cf-cache-status: REVALIDATED
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=yKOkqcqtm5t3fJjDwen%2FwicrDSqJheeBD6Z3NEijIgsBekYy5LCKFl50XIKLORuJewOiyXlcqYYbsSzdK7ja0OlU81%2FJoSmw7tJmbo2nA9ZAOOW256MBLkaBelfXxw38"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 879c24fc0be0569a-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400

flikcover.com/index/index

104.21.13.123

302 Found

5.7 kB

URL User Request GET HTTP/2
flikcover.com/index/index
IP
104.21.13.123:443
ASN
#13335 CLOUDFLARENET

Certificate
IssuerLet's Encrypt
Subjectflikcover.com
FingerprintE1:5C:CF:64:D9:E9:F1:4A:E7:E0:AB:7C:D8:FF:A4:51:4D:38:4A:AE
ValidityWed, 17 Apr 2024 07:14:50 GMT - Tue, 16 Jul 2024 07:14:49 GMT

File type

Size
5.7 kB (5690 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Amazon
OpenPhish	phishing	Amazon.com Inc.
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /index/index HTTP/1.1
Host: flikcover.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 302 Found
date: Thu, 25 Apr 2024 06:05:58 GMT
content-type: text/html; charset=utf-8
set-cookie: sa0c19f20=ga5mgmrfr88elq82gu917vqvr4; path=/; HttpOnly
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
cache-control: no-cache,must-revalidate
location: /index/login/index.html
strict-transport-security: max-age=31536000
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=oBkb1tTwAVUMtU8yEg2Lh3unEwSHSgTazeTMCiGLlu8r1PS6JfwMy81PRLhGZOBGipZKL%2Flf5SWTtCk5U%2FPSEn004mDNfUg3Je%2FkB7wjcU5IktOqi56pVHu0kGfTN0WO"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 879c24f11d5f7129-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (4)

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

HTTP Transactions (12)

URL GET HTTP/3

IP

ASN

Requested by

Certificate

File type

Size

Hash

Detections

HTTP Headers

URL GET HTTP/3

IP

ASN

Requested by

Certificate

File type

Size

Hash

Detections

HTTP Headers

URL GET HTTP/3

IP

ASN

Requested by

Certificate