# PhishDestroy domain threat record: app.linkila.com Content language: English Canonical HTML report: https://phishdestroy.io/domain/app.linkila.com/ Machine-readable companion: https://phishdestroy.io/domain/app.linkila.com/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: observed active - First observed by PhishDestroy: 2026-10-21 20:54:05 UTC - Last availability or vendor check: 2026-10-22 10:49:31 UTC - Stored record updated: 2026-10-22 16:07:29 UTC - VirusTotal detections in the stored snapshot: 6/92 - Independent public blocklist matches in the stored snapshot: 0 - Google Safe Browsing stored result: no stored flag ## Stored infrastructure - Observed IP address: 188.114.96.3 - Registrar in stored WHOIS data: TUCOWS.COM, CO. - Registrar country in stored WHOIS data: CA - Last stored HTTP status: 200 - Registration date (registry RDAP, linkila.com): 2020-09-17 05:03:02 UTC ## Evidence links - URLScan report: https://urlscan.io/result/01a1603d-ab91-73cc-85c2-64caea8e73ec/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/app.linkila.com - Certificate Transparency search: https://crt.sh/?q=%25.app.linkila.com - Web Archive lookup: https://web.archive.org/web/*/https://app.linkila.com/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview The recorded page title is “Linkila”. PhishDestroy added the domain to its blocklist on 2026-10-21 after an intake check flagged it because six VirusTotal vendors reported it as malicious or phishing. The site responded with HTTP 200 on the same date. No external blocklist or OTX pulse listed the domain at that time. How the scam works The detections suggest the site could be used for phishing – a typical approach where a page imitates a legitimate service to capture login credentials or personal data. No specific credential‑harvesting form or wallet‑draining behavior was observed on the page, so the exact mechanism remains unconfirmed. The classification therefore reflects a general phishing risk rather than a proven exploit. Evidence VirusTotal (analysis on 2026-10-21) reported 6 malicious detections out of 92 engines, with vendors alphaMountain.ai, Chong Lua Dao, Gridinsoft, Seclookup, VIPRE and Webroot labeling it malicious or phishing. Google Safe Browsing (checked 2026-10-21) did not flag the URL. OTX (checked 2026-10-21) showed zero pulses. PhishDestroy’s internal blocklist marked the domain as malicious, while external blocklists returned zero hits on the same date. urlscan.io (captured 2026-10-21) gave an overall non‑malicious verdict, engine score –6, and tags urlscan‑ml, urlscan‑ml‑60c5e22. Infrastructure The recorded IPs for the domain were 188.114.96.3 (from PhishDestroy intake) and 188.114.97.3 (observed by urlscan), both associated with Cloudflare and listed in GB. TLS was issued by Google Trust Services (valid 2026-09-27 to 2026-12-26) for linkila.com and *.linkila.com. The domain is approximately 2200 days old, uses Cloudflare nameservers, and DNSSEC is not enabled. What to do If you entered any credentials on app.linkila.com, change those passwords immediately and enable multi‑factor authentication where possible. Monitor associated accounts for unauthorized activity. Network defenders should block traffic to app.linkila.com and log any attempts to contact the recorded IPs, but should not block the entire Cloudflare range. Continue to watch for updates from PhishDestroy or other threat feeds. Useful links urlscan.io scan and screenshot: https://urlscan.io/result/01a1603d-ab91-73cc-85c2-64caea8e73ec/ Cloudflare Radar report: https://radar.cloudflare.com/scan/1e049816-39cc-4ef9-bb08-1cdd787bab99 URLQuery report: https://urlquery.net/report/90906491-e3d1-4821-af2c-a18816ba7e12 Stored capture screenshot: https://i.ibb.co/0pxNmFV5/76046fa47446.png Cloudflare Radar screenshot (2026-10-21T21:30:44Z): https://screenshots.phishdestroy.io/cf/1e049816-39cc-4ef9-bb08-1cdd787bab99.png URLQuery screenshot: https://screenshots.phishdestroy.io/uq/90906491-e3d1-4821-af2c-a18816ba7e12.png URLScan screenshot (2026-10-21T20:48:43Z): https://screenshots.phishdestroy.io/us/01a16039-0012-72ec-8df3-7d5ca3122128.png URLScan capture report: https://urlscan.io/result/01a16039-0012-72ec-8df3-7d5ca3122128/ URLScan screenshot (2026-10-21T20:49:58Z): https://screenshots.phishdestroy.io/us/01a1603a-27ed-723e-be20-2140399d3c9e.png URLScan capture report: https://urlscan.io/result/01a1603a-27ed-723e-be20-2140399d3c9e/ VirusTotal report: https://www.virustotal.com/gui/domain/app.linkila.com Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=app.linkila.com Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-21 21:32:28 UTC ## Stored page captures - Primary capture: https://i.ibb.co/0pxNmFV5/76046fa47446.png Captured: 2026-10-21 20:54:05 UTC - URLScan capture: https://screenshots.phishdestroy.io/01a1603d-ab91-73cc-85c2-64caea8e73ec.png Captured: 2026-10-21 20:54:05 UTC Source report: https://urlscan.io/result/01a1603d-ab91-73cc-85c2-64caea8e73ec/ - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/1e049816-39cc-4ef9-bb08-1cdd787bab99.png Captured: 2026-10-21 21:30:44 UTC Source report: https://radar.cloudflare.com/scan/1e049816-39cc-4ef9-bb08-1cdd787bab99 SHA-256: 1eb3d748cf0812e359ffb1da482547346a09e673f5e621ae4ac84f85bdc5f350 - URLQuery: https://screenshots.phishdestroy.io/uq/90906491-e3d1-4821-af2c-a18816ba7e12.png Source report: https://urlquery.net/report/90906491-e3d1-4821-af2c-a18816ba7e12 SHA-256: 3bde93b3b7501fb9faf79b1e8e51d39295d5f7b071e0d8c07e769b8f3f287728 - URLScan · 2026-10-21: https://screenshots.phishdestroy.io/us/01a16039-0012-72ec-8df3-7d5ca3122128.png Captured: 2026-10-21 20:48:43 UTC Source report: https://urlscan.io/result/01a16039-0012-72ec-8df3-7d5ca3122128/ SHA-256: faf94eff0d49527667dfe42a4610c36922797d6dfdfd04b784837418e6273b4d - URLScan · 2026-10-21: https://screenshots.phishdestroy.io/us/01a1603a-27ed-723e-be20-2140399d3c9e.png Captured: 2026-10-21 20:49:58 UTC Source report: https://urlscan.io/result/01a1603a-27ed-723e-be20-2140399d3c9e/ SHA-256: 963f8b5c98dabbbb84846cb112988952183e2fe04e18c1c0ac39c669652e7f9b ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-21T21:16:19Z", "uuid": "01a1603d-ab91-73cc-85c2-64caea8e73ec", "scanned_at": "2026-10-21T20:53:50Z", "final_url": "https://app.linkila.com/", "status": 200, "redirected": "https-only", "redirects": [ { "to": "https://app.linkila.com/", "from": "http://app.linkila.com/", "status": 307 } ], "ip": "188.114.97.3", "domains": [ "static.linkila.com", "at.linkila.com", "fonts.gstatic.com", "challenges.cloudflare.com", "region1.google-analytics.com", "www.googletagmanager.com", "fonts.googleapis.com", "static.cloudflareinsights.com" ], "ips": [ "2001:4860:4802:32::36", "2606:4700:10::ac42:a949", "142.251.110.94", "2a00:1450:4001:c1f::61", "2a00:1450:4001:c1f::5f", "2606:4700::6810:4f49", "104.18.95.41", "188.114.97.3" ], "asns": [ "15169", "13335" ], "countries": [ "US", "DE" ], "link_domains": [ "linkila.com", "www.cloudflare.com" ], "doc_hash": "11736746396bfbec0564c412a52805688af1600b5ed4f14fa3d21d8b3ee75bff", "script_hashes": [ "009e15bda0fd6dd1964750253c9b17403e904e9dc296f51c1e376599ae512062", "27ffc00bcc77df18e54074926eeefb8f8243600959fca253294738754005981a", "4c72487811bc7f218da5e3db6c7931ba7a29eceb503f5449a1f0bb456fcf0007", "9719b92698fc9da98e2054c27e8c540db6d375791d68c686d48f1fb8584886a9", "c045fb567d0c537cd9545abed2b54499f625e2d7374c31d9d28d434120e135c7", "df8028288765a10318afacaff5a27f678394f74ce8354bab7ebbb318bc0463c8" ], "globals": [ "SITE_NAME", "GAID", "CNAME_TARGET", "PRIVACY_POLICY_URL", "TERMS_AND_CONDITIONS_URL", "GOOGLE_LOGIN_URL", "STRIPE_PUB_KEY", "RSID", "SUPPORT_EMAIL", "HOME_PAGE", "LOGO", "RECAPTCHA_CLIENT_KEY", "CAPTCHA_CONFIG", "POSTHOG_PROJECT_TOKEN", "POSTHOG_HOST", "SENTRY_DSN", "SENTRY_ENVIRONMENT", "JS_LK_ENDPOINT", "JS_INCLUDE_URL", "FLAGS", "turnstile", "parcelRequireada1", "__reactRouterVersion", "MAYBE_DEEPLINK_MAP", "__SENTRY__", "dataLayer", "gtag", "__cfBeacon", "__sentry_instrumentation_handlers__", "__PosthogExtensions__", "google_tag_data", "google_tag_manager", "gaGlobal", "_POSTHOG_REMOTE_CONFIG", "extendPostHogWithSurveys", "postHogWebVitalsCallbacks" ], "cookies": [ "csrftoken", "_ga_G89R19193M", "_ga", "ph_phc_4kWBmOefWbUKg4neQFHsDV6nBn825KSa7dmFvKZK5s2_posthog" ], "storage_keys": [ "i18next.translate.boo", "i18nextLng", "__support__", "ph_phc_4kWBmOefWbUKg4neQFHsDV6nBn825KSa7dmFvKZK5s2_posthog", "ph_phc_4kWBmOefWbUKg4neQFHsDV6nBn825KSa7dmFvKZK5s2_primary_window_exists", "ph_phc_4kWBmOefWbUKg4neQFHsDV6nBn825KSa7dmFvKZK5s2_session_registered_properties", "__mplssupport__", "test", "ph_phc_4kWBmOefWbUKg4neQFHsDV6nBn825KSa7dmFvKZK5s2_window_id" ], "tls": { "san": [ "linkila.com", "*.linkila.com" ], "cipher": "AES_128_GCM", "issuer": "WE1", "subject": "linkila.com", "protocol": "QUIC", "valid_to": "2026-12-26T08:31:46Z", "valid_from": "2026-09-27T07:31:53Z" }, "domain_age_days": 2200, "apex_age_days": 2209, "tls_age_days": 24, "tls_valid_days": 90, "requests": 23, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": -6, "malicious": false }, "overall": { "score": 0, "malicious": false } }, "headers": { "server": "cloudflare", "content-type": "text/html; charset=utf-8", "x-frame-options": "DENY", "x-content-type-options": "nosniff", "referrer-policy": "strict-origin-when-cross-origin", "cross-origin-opener-policy": "same-origin" } }, "cf": { "v": 1, "fetched_at": "2026-10-21T21:31:46Z", "uuid": "1e049816-39cc-4ef9-bb08-1cdd787bab99", "scanned_at": "2026-10-21T21:30:44Z", "final_url": "https://app.linkila.com/", "status": 200, "history": [ { "url": "https://app.linkila.com/", "status": 200 } ], "dom_hash": "7e1eda80bc34b6db61cbddc5c048fe6d29e50306b689e2c0781f8e729c0f86dd", "doc_hash": "11736746396bfbec0564c412a52805688af1600b5ed4f14fa3d21d8b3ee75bff", "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "app.linkila.com", "type": "A", "value": "188.114.96.0" }, { "name": "app.linkila.com", "type": "A", "value": "188.114.97.0" }, { "name": "app.linkila.com", "type": "AAAA", "value": "2a06:98c1:3121::" }, { "name": "app.linkila.com", "type": "AAAA", "value": "2a06:98c1:3120::" }, { "name": "at.linkila.com", "type": "CNAME", "value": "34e514ccf8c5c0b95402.cf-prod-us-proxy.proxyhog.com" }, { "name": "at.linkila.com", "type": "CNAME", "value": "34e514ccf8c5c0b95402.cf-prod-us-proxy.proxyhog.com" }, { "name": "static.linkila.com", "type": "A", "value": "188.114.97.0" }, { "name": "static.linkila.com", "type": "A", "value": "188.114.96.0" }, { "name": "static.linkila.com", "type": "AAAA", "value": "2a06:98c1:3121::" }, { "name": "static.linkila.com", "type": "AAAA", "value": "2a06:98c1:3120::" } ], "dnssec_valid": false, "ip": "188.114.96.0", "whois": { "registrar": "Tucows Domains Inc.", "created": "2020-09-17T05:03:02Z", "updated": "2026-05-05T04:49:29Z", "expires": "2028-09-17T05:03:02Z", "nameservers": [ "coco.ns.cloudflare.com", "sean.ns.cloudflare.com" ] } }, "vt": { "v": 1, "fetched_at": "2026-10-21T21:29:56Z", "analysis_at": "2026-10-21T18:15:11Z", "stats": { "timeout": 0, "harmless": 53, "malicious": 6, "suspicious": 0, "undetected": 33 }, "detections": { "VIPRE": "phishing", "Webroot": "malicious", "Seclookup": "malicious", "Gridinsoft": "phishing", "Chong Lua Dao": "malicious", "alphaMountain.ai": "phishing" }, "reputation": 0, "registrar": "Tucows Domains Inc.", "created": "2020-09-17T05:03:02Z", "expires": "2028-09-17T05:03:02Z", "updated": "2026-05-05T04:49:29Z", "first_seen": "2023-12-25T22:26:33Z", "dns": [ { "ttl": 300, "type": "A", "value": "172.67.217.152" }, { "ttl": 300, "type": "A", "value": "104.21.59.67" }, { "ttl": 300, "type": "AAAA", "value": "2606:4700:3033::6815:3b43" }, { "ttl": 300, "type": "AAAA", "value": "2606:4700:3035::ac43:d998" } ], "dns_at": "2026-10-21T18:16:06Z", "jarm": "27d40d40d00040d1dc42d43d00041d6183ff1bfae51ebd88d70384363d525c", "cert": { "san": [ "linkila.com", "*.linkila.com" ], "issuer": "Google Trust Services / WE1", "serial": "d53cb390fcde2c1513e643e828705685", "sha256": "9e4a9b1ae1826f9987887ba5517259bf27462ba6dc4a8159dfe762fe4f52496c", "subject": "linkila.com", "valid_to": "2026-12-26T08:31:46Z", "valid_from": "2026-09-27T07:31:53Z" }, "whois": { "registrar": "Tucows Domains Inc.", "registrar_iana_id": "69", "registrar_url": "http://www.tucows.com", "created": "2020-09-17T05:03:02Z", "updated": "2026-05-05T04:49:29Z", "expires": "2028-09-17T05:03:02Z", "status": [ "clientTransferProhibited", "clientUpdateProhibited" ], "nameservers": [ "coco.ns.cloudflare.com", "sean.ns.cloudflare.com" ], "dnssec": "unsigned" } }, "webcheck": { "v": 1, "fetched_at": "2026-10-21T21:32:03Z", "caa_records": { "domain": "app.linkila.com" }, "block_lists": { "resolvers": 12, "blocked_count": 0 }, "archives": { "last": "2026-10-21T20:55:21Z", "first": "2021-03-03T18:04:15Z", "changes": 50, "days_archived": 56, "scans_per_day": 0.03, "avg_page_bytes": 2280 }, "social_tags": { "title": "Linkila", "description": "Advanced URL redirection as a service" }, "trackers": { "requests": 17, "trackers": [ { "name": "Google Tag", "company": "Google", "country": "US", "category": "Advertising", "requests": 1 }, { "name": "Cloudflare", "company": "Cloudflare", "country": "US", "category": "Hosting", "requests": 2 }, { "name": "Google Fonts", "company": "Google", "country": "US", "category": "Hosting", "requests": 1 }, { "name": "Google Static", "company": "Google", "country": "US", "category": "Hosting", "requests": 3 }, { "name": "Cloudflare Insights", "company": "Cloudflare", "country": "US", "category": "Site Analytics", "requests": 1 }, { "name": "Google Analytics", "company": "Google", "country": "US", "category": "Site Analytics", "requests": 1 } ] }, "mixed_content": { "no_sri": [ "https://challenges.cloudflare.com/turnstile/v0/api.js" ], "third_party_scripts": 1 }, "status": { "up": true, "code": 200, "timings": { "dns": 45, "tls": 33, "wait": 69, "connect": 10, "download": 1 }, "response_ms": 158 }, "tls_connection": { "alpn": "h2", "cipher": "TLS_AES_256_GCM_SHA384", "protocol": "TLSv1.3", "versions": [ "TLSv1", "TLSv1.1", "TLSv1.2", "TLSv1.3" ], "authorized": true, "forward_secrecy": true }, "ports": { "open": [ 80, 443, 8080 ] }, "carbon": { "bytes": 3181, "co2_grams": 0.0001, "cleaner_than": 95 }, "dns_server": { "ns": [ { "ip": "173.245.59.231", "host": "sean.ns.cloudflare.com" }, { "ip": "108.162.192.104", "host": "coco.ns.cloudflare.com" } ], "zone": "linkila.com" }, "cookies": { "cookies": [ { "name": "csrftoken", "same_site": "Lax" }, { "name": "_ga_G89R19193M" }, { "name": "_ga" }, { "name": "ph_phc_4kWBmOefWbUKg4neQFHsDV6nBn825KSa7dmFvKZK5s2_posthog", "secure": true, "same_site": "Lax" } ] }, "location": { "ip": "2a06:98c1:3121::9", "asn": "13335", "org": "CloudFLARENET-EU", "city": "London", "country": "GB" }, "ssl": { "issuer": "Google Trust Services / WE1", "subject": "linkila.com" }, "dns": { "A": [ "188.114.97.9", "188.114.96.9" ], "AAAA": [ "2a06:98c1:3120::9", "2a06:98c1:3121::9" ] }, "dnssec": { "ds": false, "rrsig": false, "dnskey": false }, "hsts": { "message": "Site does not serve any HSTS headers." }, "http_security": { "xFrameOptions": "DENY", "referrerPolicy": "strict-origin-when-cross-origin", "xXSSProtection": false, "permissionsPolicy": false, "xContentTypeOptions": "nosniff", "contentSecurityPolicy": false, "strictTransportPolicy": false, "crossOriginOpenerPolicy": "same-origin", "crossOriginEmbedderPolicy": false, "crossOriginResourcePolicy": false }, "firewall": { "waf": "Cloudflare", "has_waf": true }, "get_ip": { "ip": "2a06:98c1:3120::9", "family": 6 }, "redirects": { "chain": [ "https://app.linkila.com" ] }, "tech_stack": { "technologies": [ "Sentry", "Cloudflare Browser Insights", "Google Analytics", "Cloudflare Turnstile", "Cloudflare", "HTTP/3" ] }, "whois": { "registrar": "Tucows Domains Inc.", "created": "2020-09-17T05:03:02Z", "updated": "2026-05-05T04:49:29Z", "expires": "2028-09-17T05:03:02Z", "status": [ "clientTransferProhibited https://icann.org/epp", "clientUpdateProhibited https://icann.org/epp" ], "nameservers": [ "coco.ns.cloudflare.com", "sean.ns.cloudflare.com" ] }, "headers": { "headers": { "server": "cloudflare", "content-type": "text/html; charset=utf-8", "x-frame-options": "DENY", "x-content-type-options": "nosniff", "referrer-policy": "strict-origin-when-cross-origin", "cross-origin-opener-policy": "same-origin" } } } } ```