Report - www.flikcover.com/index/index/index/login/index.html/index/login/index.html

Report Overview

Submitted URL
www.flikcover.com/index/index/index/login/index.html/index/login/index.html
IP
188.114.97.1
ASN
#13335 CLOUDFLARENET
Submitted
2024-04-25 06:19:37
Access
public
Website Title
Amazon
Final URL
www.flikcover.com/index/login/index.html
Tags
amazon phishing
urlquery detections
Phishing - Amazon

Detections

urlquery
12
Network Intrusion Detection
0
Threat Detection Systems
24

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
www.flikcover.com	unknown	2024-02-18	2024-02-19	2024-03-24	5.9 kB	1.4 MB	188.114.97.1
cdn.dcloud.net.cn	116868	2013-07-17	2018-09-15	2024-04-24	434 B	577 B	118.25.42.241

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

Scan Date	Severity	Indicator	Alert
2024-04-24	medium	www.flikcover.com/index/index/index/login/index.html/index/login/index.html	Amazon.com Inc.

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

Scan Date	Severity	Indicator	Alert
2024-04-24	medium	flikcover.com	Sinkholed
2024-04-24	medium	flikcover.com	Sinkholed
2024-04-24	medium	flikcover.com	Sinkholed
2024-04-24	medium	flikcover.com	Sinkholed
2024-04-24	medium	flikcover.com	Sinkholed
2024-04-24	medium	flikcover.com	Sinkholed
2024-04-24	medium	flikcover.com	Sinkholed
2024-04-24	medium	flikcover.com	Sinkholed
2024-04-24	medium	flikcover.com	Sinkholed
2024-04-24	medium	flikcover.com	Sinkholed
2024-04-24	medium	flikcover.com	Sinkholed

ThreatFox

No alerts detected

JavaScript (4)

	URL	Size	First Seen	Last Seen
	www.flikcover.com/static/layer/layer.js	22 kB	2023-04-05	2024-05-04
Pretty URL www.flikcover.com/static/layer/layer.js IP 188.114.97.1 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML false Observations First Seen2023-04-05 06:05:22 Last Seen2024-05-04 09:04:54 Times Seen1009 Hash d0c975e34297f3e44e99c9d83555ffc1 7e465bd79e65428cf07e5991196cff512ce44a4b 691aad750624d84b17f2fbb73a4982860edd18837f3000c5b660ac82bf408e82 Loading...

	www.flikcover.com/index/login/index.html	0 B	2023-03-07	2024-05-04
Pretty URL www.flikcover.com/index/login/index.html IP 188.114.97.1 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML true Observations First Seen2023-03-07 01:01:59 Last Seen2024-05-04 11:04:28 Times Seen37334697 Hash d41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Loading...

	www.flikcover.com/index/login/index.html	0 B	2023-03-07	2024-05-04
Pretty URL www.flikcover.com/index/login/index.html IP 188.114.97.1 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML true Observations First Seen2023-03-07 01:01:59 Last Seen2024-05-04 11:04:28 Times Seen37334697 Hash d41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Loading...

	www.flikcover.com/static/jquery-3.5.0.min.js	90 kB	2023-03-07	2024-05-04
Pretty URL www.flikcover.com/static/jquery-3.5.0.min.js IP 188.114.97.1 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:03:07 Last Seen2024-05-04 08:18:00 Times Seen56662 Hash 12108007906290015100837a6a61e9f4 1d6ae46f2ffa213dede37a521b011ec1cd8d1ad3 c4dccdd9ae25b64078e0c73f273de94f8894d5c99e4741645ece29aeefc9c5a4 Loading...

HTTP Transactions (12)

URL IP Response Size

www.flikcover.com/static/layer/layer.js

188.114.97.1

200 OK

11 kB

URL GET HTTP/3
www.flikcover.com/static/layer/layer.js
IP
188.114.97.1:443
ASN
#13335 CLOUDFLARENET

Requested by
https://www.flikcover.com/index/login/index.html
Certificate
IssuerLet's Encrypt
Subjectflikcover.com
FingerprintE1:5C:CF:64:D9:E9:F1:4A:E7:E0:AB:7C:D8:FF:A4:51:4D:38:4A:AE
ValidityWed, 17 Apr 2024 07:14:50 GMT - Tue, 16 Jul 2024 07:14:49 GMT

File type
JavaScript source, Unicode text, UTF-8 text, with very long lines (22032)
Size
11 kB (11439 bytes)
Hash
6e80f0cff749c82653b9cdde9eeab937
7034e797787919a6742525a69723bf9dfda13790
1ce6649d82d2db0f8e4823f701ddfcfd9c7f107cb446c907e46ec7e57171a2a3

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Amazon
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /static/layer/layer.js HTTP/1.1
Host: www.flikcover.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.flikcover.com/index/login/index.html
Cookie: sa0c19f20=tp38nas0utb7b0rb5dimvu99p1
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Thu, 25 Apr 2024 06:19:13 GMT
content-type: application/javascript
last-modified: Tue, 05 Dec 2017 03:57:26 GMT
vary: Accept-Encoding
etag: W/"5a261926-5664"
expires: Thu, 25 Apr 2024 12:23:00 GMT
cache-control: max-age=43200
strict-transport-security: max-age=31536000
cf-cache-status: HIT
age: 21372
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=mN5nXRWp2bWIQX1d%2FJePxGpgxxYPJe5LvqAMXbeUEX7p%2FQL3gSzOQvV3vDoXKAgvdKYY%2BUau0%2FPTwy2j%2BVYuSHKUrZ3gzKhBr%2BnC8ER7%2BVR91cQ4gfJulGaFCDMADuoRK3NRSw%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 879c385fe8eb1c12-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400

www.flikcover.com/static/index/css/main.css

188.114.97.1

200 OK

220 kB

URL GET HTTP/3
www.flikcover.com/static/index/css/main.css
IP
188.114.97.1:443
ASN
#13335 CLOUDFLARENET

Requested by
https://www.flikcover.com/index/login/index.html
Certificate
IssuerLet's Encrypt
Subjectflikcover.com
FingerprintE1:5C:CF:64:D9:E9:F1:4A:E7:E0:AB:7C:D8:FF:A4:51:4D:38:4A:AE
ValidityWed, 17 Apr 2024 07:14:50 GMT - Tue, 16 Jul 2024 07:14:49 GMT

File type
ASCII text, with very long lines (65536), with no line terminators
Size
220 kB (220491 bytes)
Hash
62ff28c55f8159cc084f1c82f84c3b12
d0eb11a30cf87270f2d92401cf426ea3d805182a
cfe0e13115bf23dae63f17031ea3102c4efa5ceb7902f3dd7a4a5923f20fa05e

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Amazon
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /static/index/css/main.css HTTP/1.1
Host: www.flikcover.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.flikcover.com/index/login/index.html
Cookie: sa0c19f20=tp38nas0utb7b0rb5dimvu99p1
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Thu, 25 Apr 2024 06:19:13 GMT
content-type: text/css
last-modified: Thu, 19 Aug 2021 13:40:00 GMT
vary: Accept-Encoding
etag: W/"611e5f30-172b0"
expires: Thu, 25 Apr 2024 12:23:00 GMT
cache-control: max-age=43200
strict-transport-security: max-age=31536000
cf-cache-status: HIT
age: 21372
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=5wPogiog5MXuPMnSyCgG0iXExtVl%2FUnsyk1LvVmrjfOYezVj2sygJm72VNPwbbNsG3sRjIoq%2FARms85qcZiv%2F0aj0Bgf01a593Oyyu8yCbI18efO8%2BKL3ZDDqCcDZJQSSAz5jg%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 879c385fe8e51c12-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400

www.flikcover.com/static/index/css/common.css

188.114.97.1

200 OK

230 kB

URL GET HTTP/3
www.flikcover.com/static/index/css/common.css
IP
188.114.97.1:443
ASN
#13335 CLOUDFLARENET

Requested by
https://www.flikcover.com/index/login/index.html
Certificate
IssuerLet's Encrypt
Subjectflikcover.com
FingerprintE1:5C:CF:64:D9:E9:F1:4A:E7:E0:AB:7C:D8:FF:A4:51:4D:38:4A:AE
ValidityWed, 17 Apr 2024 07:14:50 GMT - Tue, 16 Jul 2024 07:14:49 GMT

File type
Unicode text, UTF-8 text, with very long lines (7033), with CRLF line terminators
Size
230 kB (230342 bytes)
Hash
81fde7918c34685880063fdd83b8de2d
7c7c9d1172c1016f6bcc5de3474d224ce832d752
44cfadf841e99b39ac309e388291436dd2750d29634901eb9e749a7e99ec7299

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Amazon
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /static/index/css/common.css HTTP/1.1
Host: www.flikcover.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.flikcover.com/index/login/index.html
Cookie: sa0c19f20=tp38nas0utb7b0rb5dimvu99p1
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Thu, 25 Apr 2024 06:19:13 GMT
content-type: text/css
last-modified: Thu, 19 Aug 2021 14:00:20 GMT
vary: Accept-Encoding
etag: W/"611e63f4-4a04"
expires: Thu, 25 Apr 2024 12:23:00 GMT
cache-control: max-age=43200
strict-transport-security: max-age=31536000
cf-cache-status: HIT
age: 21372
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=eb2eTb2TlrqO5NfI1naAOpsMD4QW9nLXHHUvVDWcmKOIWyRw8sLHYhL11AOwoVGgFMRGJbWYkR82LggKxger%2Bzr0%2BFlmpIPUvBX7kDsO7dACh2%2FRmg9v%2FLIzs2jzvvK2dWpbzw%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 879c385fe8e81c12-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400

www.flikcover.com/static/jquery-3.5.0.min.js

188.114.97.1

200 OK

248 kB

URL GET HTTP/3
www.flikcover.com/static/jquery-3.5.0.min.js
IP
188.114.97.1:443
ASN
#13335 CLOUDFLARENET

Requested by
https://www.flikcover.com/index/login/index.html
Certificate
IssuerLet's Encrypt
Subjectflikcover.com
FingerprintE1:5C:CF:64:D9:E9:F1:4A:E7:E0:AB:7C:D8:FF:A4:51:4D:38:4A:AE
ValidityWed, 17 Apr 2024 07:14:50 GMT - Tue, 16 Jul 2024 07:14:49 GMT

File type
JavaScript source, ASCII text, with very long lines (65451)
Size
248 kB (248209 bytes)
Hash
12108007906290015100837a6a61e9f4
1d6ae46f2ffa213dede37a521b011ec1cd8d1ad3
c4dccdd9ae25b64078e0c73f273de94f8894d5c99e4741645ece29aeefc9c5a4

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Amazon
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /static/jquery-3.5.0.min.js HTTP/1.1
Host: www.flikcover.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.flikcover.com/index/login/index.html
Cookie: sa0c19f20=tp38nas0utb7b0rb5dimvu99p1
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Thu, 25 Apr 2024 06:19:13 GMT
content-type: application/javascript
last-modified: Mon, 27 Apr 2020 14:07:18 GMT
vary: Accept-Encoding
etag: W/"5ea6e716-15d95"
expires: Thu, 25 Apr 2024 12:23:00 GMT
cache-control: max-age=43200
strict-transport-security: max-age=31536000
cf-cache-status: HIT
age: 21372
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=E3o6RdTD4peajJyT%2Ba2Bya9NQImAbgrmOHPbTRmUruDib0Kt1zRhtvIpKZfdG3jgZ0BB1KCh7yYMgOxsRq2wbYROJcKus8en%2FivFB9GNfiOp1%2BJ61nwgeSR%2FKxQ6L15pTrd5jA%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 879c385fe8e91c12-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400

cdn.dcloud.net.cn/img/shadow-grey.png

118.25.42.241

200 OK

136 B

URL GET HTTP/1.1
cdn.dcloud.net.cn/img/shadow-grey.png
IP
118.25.42.241:443
ASN
#45090 Shenzhen Tencent Computer Systems Company Limited

Requested by
https://www.flikcover.com/index/login/index.html
Certificate
IssuerUnizeto Technologies S.A.
Subject*.dcloud.net.cn
FingerprintAE:46:5C:A4:9B:D3:F7:AC:7D:5E:C7:27:E1:5F:C3:7C:DA:CE:F2:AC
ValiditySat, 05 Aug 2023 03:00:05 GMT - Tue, 03 Sep 2024 03:00:04 GMT

File type
PNG image data, 1 x 6, 4-bit colormap, non-interlaced
Size
136 B (136 bytes)
Hash
5a962adf74d92ae702467b3f47976547
36f74049375584e3fa69b5ef87e9572336ff9e7a
ad4ebea1c3496dd2924789ee009174a2c6289d1200e9811f458fd46f172d1d6f

HTTP Headers

GET /img/shadow-grey.png HTTP/1.1
Host: cdn.dcloud.net.cn
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.flikcover.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Date: Thu, 25 Apr 2024 06:19:17 GMT
Content-Type: image/png
Content-Length: 136
Last-Modified: Thu, 06 Jun 2019 06:42:07 GMT
Connection: close
ETag: "5cf8b5bf-88"
Expires: Thu, 25 Apr 2024 08:19:17 GMT
Cache-Control: max-age=7200
Set-Cookie: __uni__uid=rBEQMWYp9eVlbQyqWEK2Ag==; expires=Thu, 31-Dec-37 23:55:55 GMT; domain=dcloud.net.cn; path=/; secure; httponly; samesite=none
Accept-Ranges: bytes

www.flikcover.com/index/login/index.html

188.114.97.1

200 OK

5.7 kB

URL User Request GET HTTP/2
www.flikcover.com/index/login/index.html
IP
188.114.97.1:443
ASN
#13335 CLOUDFLARENET

Certificate
IssuerLet's Encrypt
Subjectflikcover.com
FingerprintE1:5C:CF:64:D9:E9:F1:4A:E7:E0:AB:7C:D8:FF:A4:51:4D:38:4A:AE
ValidityWed, 17 Apr 2024 07:14:50 GMT - Tue, 16 Jul 2024 07:14:49 GMT

File type
JavaScript source, Unicode text, UTF-8 text, with very long lines (5827), with no line terminators
Size
5.7 kB (5690 bytes)
Hash
3553de0e77749cb0f05f44fcd9733622
7cef9bf8ec773ae60384362361e12563bb9d6f62
caccc3e3d6580aada7a55d498c852cd446afeeb7fc566ddad19d4f7da7bfbb1c

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Amazon
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /index/login/index.html HTTP/1.1
Host: www.flikcover.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Cookie: sa0c19f20=tp38nas0utb7b0rb5dimvu99p1
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Thu, 25 Apr 2024 06:19:13 GMT
content-type: text/html; charset=utf-8
vary: Accept-Encoding
expires: Thu, 19 Nov 1981 08:52:00 GMT
cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
pragma: no-cache
strict-transport-security: max-age=31536000
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=CVeT0%2FjbXoe4kzwJG2nIOlnCCohaxKgnATioxAeJUsAqClEJ3riwhI2HTPQclWD0BHSlgdyyZXtJIJnOH7%2FibimFHRPpjgGV7l6%2B2xbJR8fnA%2F27WD3jiq0yXlmIzUUqvmS8%2Bw%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 879c385d2a1b0b3d-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

www.flikcover.com/index/index/index/login/index.html/index/login/index.html

188.114.97.1

302 Found

5.7 kB

URL User Request GET HTTP/2
www.flikcover.com/index/index/index/login/index.html/index/login/index.html
IP
188.114.97.1:443
ASN
#13335 CLOUDFLARENET

Certificate
IssuerLet's Encrypt
Subjectflikcover.com
FingerprintE1:5C:CF:64:D9:E9:F1:4A:E7:E0:AB:7C:D8:FF:A4:51:4D:38:4A:AE
ValidityWed, 17 Apr 2024 07:14:50 GMT - Tue, 16 Jul 2024 07:14:49 GMT

File type

Size
5.7 kB (5690 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Amazon
OpenPhish	phishing	Amazon.com Inc.
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /index/index/index/login/index.html/index/login/index.html HTTP/1.1
Host: www.flikcover.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 302 Found
date: Thu, 25 Apr 2024 06:19:12 GMT
content-type: text/html; charset=utf-8
set-cookie: sa0c19f20=tp38nas0utb7b0rb5dimvu99p1; path=/; HttpOnly
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
cache-control: no-cache,must-revalidate
location: /index/login/index.html
strict-transport-security: max-age=31536000
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=eIRMHdMNMUnIe8phpN1ShxG2X7jfXXY4oRxwmJjIjLKf8pbdE%2BHfy%2FSFBpMfcmV8psuK6eWiAr3X3v1CFBataRNnGyzZcxoK6qzaBrjkFmUYe4lJxKmkUhIa5rDRBVfUbRF1CA%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 879c38585e710b3d-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

www.flikcover.com/static/layer/theme/default/layer.css?v=3.1.1

188.114.97.1

200 OK

14 kB

URL GET HTTP/3
www.flikcover.com/static/layer/theme/default/layer.css?v=3.1.1
IP
188.114.97.1:443
ASN
#13335 CLOUDFLARENET

Requested by
https://www.flikcover.com/index/login/index.html
Certificate
IssuerLet's Encrypt
Subjectflikcover.com
FingerprintE1:5C:CF:64:D9:E9:F1:4A:E7:E0:AB:7C:D8:FF:A4:51:4D:38:4A:AE
ValidityWed, 17 Apr 2024 07:14:50 GMT - Tue, 16 Jul 2024 07:14:49 GMT

File type
ASCII text, with very long lines (14367), with no line terminators
Size
14 kB (14367 bytes)
Hash
3d2e0d91c5c0b96abb8dbdc2234aba77
9d55e153b30fd7414fada5718e20918e9c7f65e7
e3144d018a6a24f733c6fc2a2ee603fb583f0030585e9d4b71bec471b78e31fc

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Amazon
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /static/layer/theme/default/layer.css?v=3.1.1 HTTP/1.1
Host: www.flikcover.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.flikcover.com/index/login/index.html
Cookie: sa0c19f20=tp38nas0utb7b0rb5dimvu99p1
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Thu, 25 Apr 2024 06:19:13 GMT
content-type: text/css
last-modified: Tue, 05 Dec 2017 03:57:26 GMT
vary: Accept-Encoding
etag: W/"5a261926-381f"
expires: Thu, 25 Apr 2024 12:23:01 GMT
cache-control: max-age=43200
strict-transport-security: max-age=31536000
cf-cache-status: HIT
age: 21371
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=03tZngx6Vy92%2Fk9GXZOFTg7PdxgyuZ2oo9xEtLtfRNoOZKeLDAwyc6%2BkevedOA2d7yA8fmcIZeIw3zgOkE2Ch99BSsTugAbCMr8vdKJlf%2FAk5FKH5ufPJ6rl3%2BtXqH6zl3f2EA%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 879c3860491b1c12-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400

www.flikcover.com/static/index/fonts/Rubik-BlackItalic.77c7f123.ttf

188.114.97.1

200 OK

192 kB

URL GET HTTP/3
www.flikcover.com/static/index/fonts/Rubik-BlackItalic.77c7f123.ttf
IP
188.114.97.1:443
ASN
#13335 CLOUDFLARENET

Requested by
https://www.flikcover.com/index/login/index.html
Certificate
IssuerLet's Encrypt
Subjectflikcover.com
FingerprintE1:5C:CF:64:D9:E9:F1:4A:E7:E0:AB:7C:D8:FF:A4:51:4D:38:4A:AE
ValidityWed, 17 Apr 2024 07:14:50 GMT - Tue, 16 Jul 2024 07:14:49 GMT

File type
TrueType Font data, 18 tables, 1st "GPOS", 15 names, Microsoft, language 0x409, Copyright (c) 2015 by Hubert & Fischer. All rights reserved.Rubik BlackItalicHubert&Fischer: Rub
Size
192 kB (192004 bytes)
Hash
77c7f123391595707a1d0690dddaa11e
3f77b9d3d8155511d94d72a410c80b3d18001cde
ce0e6de088497437824e571c7a0c38974f205a0bbb8b20ae5b309e419662f063

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Amazon
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /static/index/fonts/Rubik-BlackItalic.77c7f123.ttf HTTP/1.1
Host: www.flikcover.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.flikcover.com/static/index/css/common.css
Cookie: sa0c19f20=tp38nas0utb7b0rb5dimvu99p1
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Thu, 25 Apr 2024 06:19:14 GMT
content-type: application/octet-stream
content-length: 192004
last-modified: Thu, 19 Aug 2021 13:45:30 GMT
etag: "611e607a-2ee04"
strict-transport-security: max-age=31536000
cache-control: max-age=14400
cf-cache-status: MISS
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=rQYuSdHL5aK%2FzL8tqR27s5edr0C8SSf%2B06RMYx5ojLAPswTzz3YNB8A9oDv42%2FAqkYytdnACEuUysuFwdXsJ1cyq32UVE0k%2FEMuyXnj9ofv0YqMCmgVhKRjfpBPycrc5zq45tw%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 879c3860894b1c12-OSL
alt-svc: h3=":443"; ma=86400

www.flikcover.com/static/index/fonts/Rubik-Regular.35af6dbe.ttf

188.114.97.1

200 OK

221 kB

URL GET HTTP/3
www.flikcover.com/static/index/fonts/Rubik-Regular.35af6dbe.ttf
IP
188.114.97.1:443
ASN
#13335 CLOUDFLARENET

Requested by
https://www.flikcover.com/index/login/index.html
Certificate
IssuerLet's Encrypt
Subjectflikcover.com
FingerprintE1:5C:CF:64:D9:E9:F1:4A:E7:E0:AB:7C:D8:FF:A4:51:4D:38:4A:AE
ValidityWed, 17 Apr 2024 07:14:50 GMT - Tue, 16 Jul 2024 07:14:49 GMT

File type
TrueType Font data, 20 tables, 1st "GPOS", 13 names, Microsoft, language 0x409, Copyright (c) 2015 by Hubert & Fischer. All rights reserved.RubikRegularHubert&Fischer: Rubik Re
Size
221 kB (220600 bytes)
Hash
35af6dbe749b9704f03282e5a5949253
f0711cdc35046a54d1b887fafbd12de0a5b82549
c17737eba7fa3f4854f4cd50226e75a9e954b4fc460d805b22e5c31a04b0261d

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Amazon
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /static/index/fonts/Rubik-Regular.35af6dbe.ttf HTTP/1.1
Host: www.flikcover.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.flikcover.com/static/index/css/common.css
Cookie: sa0c19f20=tp38nas0utb7b0rb5dimvu99p1
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Thu, 25 Apr 2024 06:19:14 GMT
content-type: application/octet-stream
content-length: 220600
last-modified: Tue, 17 Aug 2021 08:24:34 GMT
etag: "611b7242-35db8"
strict-transport-security: max-age=31536000
cache-control: max-age=14400
cf-cache-status: MISS
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=T8jUh9wy4vEE4M6feZ1oGn9GBQwka%2FbM9eQYInSaCw%2Bm9sbwliXQ3sY0AdQLv016Bu9knVD3abBn13ZZ1Z226qGdWkdYyNiuvqu9zUz6yk8Fyb5Slyc1YC8Va77fhFk6zK9tLg%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 879c386089501c12-OSL
alt-svc: h3=":443"; ma=86400

www.flikcover.com/static/index/fonts/Rubik-Medium.4dff84c2.ttf

188.114.97.1

200 OK

216 kB

URL GET HTTP/3
www.flikcover.com/static/index/fonts/Rubik-Medium.4dff84c2.ttf
IP
188.114.97.1:443
ASN
#13335 CLOUDFLARENET

Requested by
https://www.flikcover.com/index/login/index.html
Certificate
IssuerLet's Encrypt
Subjectflikcover.com
FingerprintE1:5C:CF:64:D9:E9:F1:4A:E7:E0:AB:7C:D8:FF:A4:51:4D:38:4A:AE
ValidityWed, 17 Apr 2024 07:14:50 GMT - Tue, 16 Jul 2024 07:14:49 GMT

File type
TrueType Font data, 20 tables, 1st "GPOS", 15 names, Microsoft, language 0x409, Copyright (c) 2015 by Hubert & Fischer. All rights reserved.Rubik MediumRegularHubert&Fischer: R
Size
216 kB (216244 bytes)
Hash
4dff84c26bc906823e344e1eb76fe7a7
5da5f96c57060e54a922ea0df12b4c29797593b9
82a8c818aab7ca3157c49795b2fc47a08a1fa490dd5aa7acb7a079615c3dda51

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Amazon
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /static/index/fonts/Rubik-Medium.4dff84c2.ttf HTTP/1.1
Host: www.flikcover.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.flikcover.com/static/index/css/common.css
Cookie: sa0c19f20=tp38nas0utb7b0rb5dimvu99p1
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Thu, 25 Apr 2024 06:19:14 GMT
content-type: application/octet-stream
content-length: 216244
last-modified: Tue, 17 Aug 2021 08:24:08 GMT
etag: "611b7228-34cb4"
strict-transport-security: max-age=31536000
cache-control: max-age=14400
cf-cache-status: MISS
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=NDF958wpWFn89lHeF0NZXionPPJhRvLSMG%2F7mvyrehtlI%2BI5LQstmAj1VFNLkTjwD4bIZfYs9H8mCgRRr%2BRkwMKiXuOdPhCAzgeQLxX%2FkgYWsVjN2czkCUeHaSditPRgQTHDHA%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 879c386089581c12-OSL
alt-svc: h3=":443"; ma=86400

www.flikcover.com/favicon.ico

188.114.97.1

200 OK

4.3 kB

URL GET HTTP/3
www.flikcover.com/favicon.ico
IP
188.114.97.1:443
ASN
#13335 CLOUDFLARENET

Requested by
https://www.flikcover.com/index/login/index.html
Certificate
IssuerLet's Encrypt
Subjectflikcover.com
FingerprintE1:5C:CF:64:D9:E9:F1:4A:E7:E0:AB:7C:D8:FF:A4:51:4D:38:4A:AE
ValidityWed, 17 Apr 2024 07:14:50 GMT - Tue, 16 Jul 2024 07:14:49 GMT

File type
MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Size
4.3 kB (4286 bytes)
Hash
ea344923d7e68380c811191e36e04020
f23f0ec8c29df2a1b31b0e0cb46e54e22420bca1
97a8aa4a501654a28f1fe60e1fce3f9070c80d698790beb60b2d714f78bd786f

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Amazon
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /favicon.ico HTTP/1.1
Host: www.flikcover.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.flikcover.com/index/login/index.html
Cookie: sa0c19f20=tp38nas0utb7b0rb5dimvu99p1
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Thu, 25 Apr 2024 06:19:14 GMT
content-type: image/x-icon
last-modified: Fri, 13 Nov 2020 15:05:22 GMT
etag: W/"5faea0b2-10be"
strict-transport-security: max-age=31536000
cache-control: max-age=14400
cf-cache-status: REVALIDATED
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=JlqG6BpRqsMpRLc9y5qs%2BNUpvBEVvScxyeJXIAK9Rs01TuPC2V63u5T2z27pfEUU0%2F8l%2BnjVA18ujrZDZq5e0zh37v0CK8fT05RNQxywa8oqOm1kq%2FejUo5Z%2FofMfZs0NzL%2Bug%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 879c38626a471c12-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (4)

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

HTTP Transactions (12)

URL GET HTTP/3

IP

ASN

Requested by

Certificate

File type

Size

Hash

Detections

HTTP Headers

URL GET HTTP/3

IP

ASN

Requested by

Certificate

File type

Size

Hash

Detections

HTTP Headers

URL GET HTTP/3

IP

ASN

Requested by

Certificate