Report - gecu-upgrade.from-tx.com/x/login.php/Cloudfare.php?id=dfff0b7dc1d2656c0da1e278ffabc007Cloudfare.php?id=d3805f38e1fcaca0d0333d378780229eCloudfare.php?id=39f8678650a5821e95b11c4fb51f7cfbCloudfare.php?id=29e757ccf9e17f47958f02cad947de1aCloudfare.php?id=c1f0c0a80d408795dc430c45e5b4602bCloudfare.php?id=00b3a5f54d617de7232537e6c3c93182

Report Overview

Submitted URL
gecu-upgrade.from-tx.com/x/login.php/Cloudfare.php?id=dfff0b7dc1d2656c0da1e278ffabc007Cloudfare.php?id=d3805f38e1fcaca0d0333d378780229eCloudfare.php?id=39f8678650a5821e95b11c4fb51f7cfbCloudfare.php?id=29e757ccf9e17f47958f02cad947de1aCloudfare.php?id=c1f0c0a80d408795dc430c45e5b4602bCloudfare.php?id=00b3a5f54d617de7232537e6c3c93182
IP
152.42.244.54
ASN
#0
Submitted
2024-05-10 12:26:31
Access
public
Website Title
about:privatebrowsing
Final URL
about:privatebrowsing
Tags
urlquery detections
No alerts detected

Detections

urlquery
0
Network Intrusion Detection
6
Threat Detection Systems
0

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
gecu-upgrade.from-tx.com	unknown	unknown	No data	No data	13 kB	7.2 kB	152.42.244.54

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Timestamp	Severity	Source IP	Destination IP	Alert
2024-05-10 12:26:10	medium	Client IP	152.42.244.54	ET INFO DYNAMIC_DNS HTTP Request to a *.from-tx .com Domain
2024-05-10 12:26:10	medium	Client IP	152.42.244.54	ET INFO DYNAMIC_DNS HTTP Request to a *.from-tx .com Domain
2024-05-10 12:26:12	medium	Client IP	152.42.244.54	ET INFO DYNAMIC_DNS HTTP Request to a *.from-tx .com Domain
2024-05-10 12:26:12	medium	Client IP	152.42.244.54	ET INFO DYNAMIC_DNS HTTP Request to a *.from-tx .com Domain
2024-05-10 12:26:28	medium	Client IP	152.42.244.54	ET INFO DYNAMIC_DNS HTTP Request to a *.from-tx .com Domain
2024-05-10 12:26:28	medium	Client IP	152.42.244.54	ET INFO DYNAMIC_DNS HTTP Request to a *.from-tx .com Domain

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

JavaScript (0)

HTTP Transactions (25)

URL IP Response Size

gecu-upgrade.from-tx.com/x/login.php/Cloudfare.php?id=dfff0b7dc1d2656c0da1e278ffabc007Cloudfare.php?id=d3805f38e1fcaca0d0333d378780229eCloudfare.php?id=39f8678650a5821e95b11c4fb51f7cfbCloudfare.php?id=29e757ccf9e17f47958f02cad947de1aCloudfare.php?id=c1f0c0a80d408795dc430c45e5b4602bCloudfare.php?id=00b3a5f54d617de7232537e6c3c93182

152.42.244.54

302 Found

0 B

URL User Request GET HTTP/1.1
gecu-upgrade.from-tx.com/x/login.php/Cloudfare.php?id=dfff0b7dc1d2656c0da1e278ffabc007Cloudfare.php?id=d3805f38e1fcaca0d0333d378780229eCloudfare.php?id=39f8678650a5821e95b11c4fb51f7cfbCloudfare.php?id=29e757ccf9e17f47958f02cad947de1aCloudfare.php?id=c1f0c0a80d408795dc430c45e5b4602bCloudfare.php?id=00b3a5f54d617de7232537e6c3c93182
IP
152.42.244.54:443
ASN
#0

Certificate
IssuerLet's Encrypt
Subjectgecu-upgrade.from-tx.com
FingerprintDB:39:19:94:98:29:3E:A4:3C:06:8C:71:04:C6:AE:90:B6:73:19:A9
ValidityThu, 02 May 2024 16:39:09 GMT - Wed, 31 Jul 2024 16:39:08 GMT

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /x/login.php/Cloudfare.php?id=dfff0b7dc1d2656c0da1e278ffabc007Cloudfare.php?id=d3805f38e1fcaca0d0333d378780229eCloudfare.php?id=39f8678650a5821e95b11c4fb51f7cfbCloudfare.php?id=29e757ccf9e17f47958f02cad947de1aCloudfare.php?id=c1f0c0a80d408795dc430c45e5b4602bCloudfare.php?id=00b3a5f54d617de7232537e6c3c93182 HTTP/1.1
Host: gecu-upgrade.from-tx.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 302 Found
Date: Fri, 10 May 2024 12:26:07 GMT
Server: Apache
Location: Cloudfare.php?id=4824ff0835453898bbc55759e477a557
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8

gecu-upgrade.from-tx.com/

152.42.244.54

793 B

URL
gecu-upgrade.from-tx.com/
IP
152.42.244.54:0
ASN
#0

Certificate
IssuerLet's Encrypt
Subjectgecu-upgrade.from-tx.com
FingerprintDB:39:19:94:98:29:3E:A4:3C:06:8C:71:04:C6:AE:90:B6:73:19:A9
ValidityThu, 02 May 2024 16:39:09 GMT - Wed, 31 Jul 2024 16:39:08 GMT

File type
HTML document, ASCII text
Size
793 B (793 bytes)
Hash
c8fe84bcabd250a27fcb016318479703
4ace7853954bf0b79c61ac5db272110c848b2c41
0b7dd7400bb1a1b50a73b55f4de651bedca85e77fd43d70c774a5a904cbf1dbe

Detections

NIDS	Severity	Alert
suricata	medium	ET INFO DYNAMIC_DNS HTTP Request to a *.from-tx .com Domain
suricata	medium	ET INFO DYNAMIC_DNS HTTP Request to a *.from-tx .com Domain

HTTP Headers

GET / HTTP/1.1
Host: gecu-upgrade.from-tx.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Fri, 10 May 2024 12:26:09 GMT
Server: Apache
Content-Length: 793
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html;charset=ISO-8859-1

gecu-upgrade.from-tx.com/x/login.php/Cloudfare.php?id=4824ff0835453898bbc55759e477a557

152.42.244.54

302 Found

0 B

URL User Request GET HTTP/1.1
gecu-upgrade.from-tx.com/x/login.php/Cloudfare.php?id=4824ff0835453898bbc55759e477a557
IP
152.42.244.54:80
ASN
#0

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Detections

NIDS	Severity	Alert
suricata	medium	ET INFO DYNAMIC_DNS HTTP Request to a *.from-tx .com Domain
suricata	medium	ET INFO DYNAMIC_DNS HTTP Request to a *.from-tx .com Domain

HTTP Headers

GET /x/login.php/Cloudfare.php?id=4824ff0835453898bbc55759e477a557 HTTP/1.1
Host: gecu-upgrade.from-tx.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 302 Found
Date: Fri, 10 May 2024 12:26:10 GMT
Server: Apache
Location: Cloudfare.php?id=2ec5a54f783301a5c833f6d429baf052
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8

gecu-upgrade.from-tx.com/x/login.php/Cloudfare.php?id=2ec5a54f783301a5c833f6d429baf052

152.42.244.54

302 Found

0 B

URL User Request GET HTTP/1.1
gecu-upgrade.from-tx.com/x/login.php/Cloudfare.php?id=2ec5a54f783301a5c833f6d429baf052
IP
152.42.244.54:443
ASN
#0

Certificate
IssuerLet's Encrypt
Subjectgecu-upgrade.from-tx.com
FingerprintDB:39:19:94:98:29:3E:A4:3C:06:8C:71:04:C6:AE:90:B6:73:19:A9
ValidityThu, 02 May 2024 16:39:09 GMT - Wed, 31 Jul 2024 16:39:08 GMT

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /x/login.php/Cloudfare.php?id=2ec5a54f783301a5c833f6d429baf052 HTTP/1.1
Host: gecu-upgrade.from-tx.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 302 Found
Date: Fri, 10 May 2024 12:26:13 GMT
Server: Apache
Location: Cloudfare.php?id=323ce3dded9c1316441aa6f32bf6b144
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8

gecu-upgrade.from-tx.com/x/login.php/Cloudfare.php?id=323ce3dded9c1316441aa6f32bf6b144

152.42.244.54

302 Found

0 B

URL User Request GET HTTP/1.1
gecu-upgrade.from-tx.com/x/login.php/Cloudfare.php?id=323ce3dded9c1316441aa6f32bf6b144
IP
152.42.244.54:443
ASN
#0

Certificate
IssuerLet's Encrypt
Subjectgecu-upgrade.from-tx.com
FingerprintDB:39:19:94:98:29:3E:A4:3C:06:8C:71:04:C6:AE:90:B6:73:19:A9
ValidityThu, 02 May 2024 16:39:09 GMT - Wed, 31 Jul 2024 16:39:08 GMT

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /x/login.php/Cloudfare.php?id=323ce3dded9c1316441aa6f32bf6b144 HTTP/1.1
Host: gecu-upgrade.from-tx.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 302 Found
Date: Fri, 10 May 2024 12:26:15 GMT
Server: Apache
Location: Cloudfare.php?id=11e6c790e72a757a52f046222edf1308
Keep-Alive: timeout=5, max=98
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8

gecu-upgrade.from-tx.com/x/login.php/Cloudfare.php?id=11e6c790e72a757a52f046222edf1308

152.42.244.54

302 Found

0 B

URL User Request GET HTTP/1.1
gecu-upgrade.from-tx.com/x/login.php/Cloudfare.php?id=11e6c790e72a757a52f046222edf1308
IP
152.42.244.54:443
ASN
#0

Certificate
IssuerLet's Encrypt
Subjectgecu-upgrade.from-tx.com
FingerprintDB:39:19:94:98:29:3E:A4:3C:06:8C:71:04:C6:AE:90:B6:73:19:A9
ValidityThu, 02 May 2024 16:39:09 GMT - Wed, 31 Jul 2024 16:39:08 GMT

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /x/login.php/Cloudfare.php?id=11e6c790e72a757a52f046222edf1308 HTTP/1.1
Host: gecu-upgrade.from-tx.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 302 Found
Date: Fri, 10 May 2024 12:26:17 GMT
Server: Apache
Location: Cloudfare.php?id=94b86ed378302c3ef8268df07fe91a33
Keep-Alive: timeout=5, max=97
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8

gecu-upgrade.from-tx.com/x/login.php/Cloudfare.php?id=94b86ed378302c3ef8268df07fe91a33

152.42.244.54

302 Found

0 B

URL User Request GET HTTP/1.1
gecu-upgrade.from-tx.com/x/login.php/Cloudfare.php?id=94b86ed378302c3ef8268df07fe91a33
IP
152.42.244.54:443
ASN
#0

Certificate
IssuerLet's Encrypt
Subjectgecu-upgrade.from-tx.com
FingerprintDB:39:19:94:98:29:3E:A4:3C:06:8C:71:04:C6:AE:90:B6:73:19:A9
ValidityThu, 02 May 2024 16:39:09 GMT - Wed, 31 Jul 2024 16:39:08 GMT

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /x/login.php/Cloudfare.php?id=94b86ed378302c3ef8268df07fe91a33 HTTP/1.1
Host: gecu-upgrade.from-tx.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 302 Found
Date: Fri, 10 May 2024 12:26:19 GMT
Server: Apache
Location: Cloudfare.php?id=560757ad4650f19e14d558559b1e6b57
Keep-Alive: timeout=5, max=96
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8

gecu-upgrade.from-tx.com/x/login.php/Cloudfare.php?id=560757ad4650f19e14d558559b1e6b57

152.42.244.54

302 Found

0 B

URL User Request GET HTTP/1.1
gecu-upgrade.from-tx.com/x/login.php/Cloudfare.php?id=560757ad4650f19e14d558559b1e6b57
IP
152.42.244.54:443
ASN
#0

Certificate
IssuerLet's Encrypt
Subjectgecu-upgrade.from-tx.com
FingerprintDB:39:19:94:98:29:3E:A4:3C:06:8C:71:04:C6:AE:90:B6:73:19:A9
ValidityThu, 02 May 2024 16:39:09 GMT - Wed, 31 Jul 2024 16:39:08 GMT

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /x/login.php/Cloudfare.php?id=560757ad4650f19e14d558559b1e6b57 HTTP/1.1
Host: gecu-upgrade.from-tx.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 302 Found
Date: Fri, 10 May 2024 12:26:20 GMT
Server: Apache
Location: Cloudfare.php?id=b731d0957eef57d7132bf90a493100f7
Keep-Alive: timeout=5, max=95
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8

gecu-upgrade.from-tx.com/x/login.php/Cloudfare.php?id=b731d0957eef57d7132bf90a493100f7

152.42.244.54

302 Found

0 B

URL User Request GET HTTP/1.1
gecu-upgrade.from-tx.com/x/login.php/Cloudfare.php?id=b731d0957eef57d7132bf90a493100f7
IP
152.42.244.54:443
ASN
#0

Certificate
IssuerLet's Encrypt
Subjectgecu-upgrade.from-tx.com
FingerprintDB:39:19:94:98:29:3E:A4:3C:06:8C:71:04:C6:AE:90:B6:73:19:A9
ValidityThu, 02 May 2024 16:39:09 GMT - Wed, 31 Jul 2024 16:39:08 GMT

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /x/login.php/Cloudfare.php?id=b731d0957eef57d7132bf90a493100f7 HTTP/1.1
Host: gecu-upgrade.from-tx.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 302 Found
Date: Fri, 10 May 2024 12:26:21 GMT
Server: Apache
Location: Cloudfare.php?id=48b5373d9fb4b8b0fdcbe3245b830fa4
Keep-Alive: timeout=5, max=94
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8

gecu-upgrade.from-tx.com/x/login.php/Cloudfare.php?id=48b5373d9fb4b8b0fdcbe3245b830fa4

152.42.244.54

302 Found

0 B

URL User Request GET HTTP/1.1
gecu-upgrade.from-tx.com/x/login.php/Cloudfare.php?id=48b5373d9fb4b8b0fdcbe3245b830fa4
IP
152.42.244.54:443
ASN
#0

Certificate
IssuerLet's Encrypt
Subjectgecu-upgrade.from-tx.com
FingerprintDB:39:19:94:98:29:3E:A4:3C:06:8C:71:04:C6:AE:90:B6:73:19:A9
ValidityThu, 02 May 2024 16:39:09 GMT - Wed, 31 Jul 2024 16:39:08 GMT

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /x/login.php/Cloudfare.php?id=48b5373d9fb4b8b0fdcbe3245b830fa4 HTTP/1.1
Host: gecu-upgrade.from-tx.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 302 Found
Date: Fri, 10 May 2024 12:26:21 GMT
Server: Apache
Location: Cloudfare.php?id=5d92623d7dcb18dc1df46ca02cbc64b5
Keep-Alive: timeout=5, max=93
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8

gecu-upgrade.from-tx.com/x/login.php/Cloudfare.php?id=5d92623d7dcb18dc1df46ca02cbc64b5

152.42.244.54

302 Found

0 B

URL User Request GET HTTP/1.1
gecu-upgrade.from-tx.com/x/login.php/Cloudfare.php?id=5d92623d7dcb18dc1df46ca02cbc64b5
IP
152.42.244.54:443
ASN
#0

Certificate
IssuerLet's Encrypt
Subjectgecu-upgrade.from-tx.com
FingerprintDB:39:19:94:98:29:3E:A4:3C:06:8C:71:04:C6:AE:90:B6:73:19:A9
ValidityThu, 02 May 2024 16:39:09 GMT - Wed, 31 Jul 2024 16:39:08 GMT

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /x/login.php/Cloudfare.php?id=5d92623d7dcb18dc1df46ca02cbc64b5 HTTP/1.1
Host: gecu-upgrade.from-tx.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 302 Found
Date: Fri, 10 May 2024 12:26:21 GMT
Server: Apache
Location: Cloudfare.php?id=f43cdffc9690d01b83ec2fc14c34be46
Keep-Alive: timeout=5, max=92
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8

gecu-upgrade.from-tx.com/x/login.php/Cloudfare.php?id=f43cdffc9690d01b83ec2fc14c34be46

152.42.244.54

302 Found

0 B

URL User Request GET HTTP/1.1
gecu-upgrade.from-tx.com/x/login.php/Cloudfare.php?id=f43cdffc9690d01b83ec2fc14c34be46
IP
152.42.244.54:443
ASN
#0

Certificate
IssuerLet's Encrypt
Subjectgecu-upgrade.from-tx.com
FingerprintDB:39:19:94:98:29:3E:A4:3C:06:8C:71:04:C6:AE:90:B6:73:19:A9
ValidityThu, 02 May 2024 16:39:09 GMT - Wed, 31 Jul 2024 16:39:08 GMT

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /x/login.php/Cloudfare.php?id=f43cdffc9690d01b83ec2fc14c34be46 HTTP/1.1
Host: gecu-upgrade.from-tx.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 302 Found
Date: Fri, 10 May 2024 12:26:22 GMT
Server: Apache
Location: Cloudfare.php?id=e377764bf773d58a2fb0925e5aca8775
Keep-Alive: timeout=5, max=91
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8

gecu-upgrade.from-tx.com/x/login.php/Cloudfare.php?id=e377764bf773d58a2fb0925e5aca8775

152.42.244.54

302 Found

0 B

URL User Request GET HTTP/1.1
gecu-upgrade.from-tx.com/x/login.php/Cloudfare.php?id=e377764bf773d58a2fb0925e5aca8775
IP
152.42.244.54:443
ASN
#0

Certificate
IssuerLet's Encrypt
Subjectgecu-upgrade.from-tx.com
FingerprintDB:39:19:94:98:29:3E:A4:3C:06:8C:71:04:C6:AE:90:B6:73:19:A9
ValidityThu, 02 May 2024 16:39:09 GMT - Wed, 31 Jul 2024 16:39:08 GMT

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /x/login.php/Cloudfare.php?id=e377764bf773d58a2fb0925e5aca8775 HTTP/1.1
Host: gecu-upgrade.from-tx.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 302 Found
Date: Fri, 10 May 2024 12:26:22 GMT
Server: Apache
Location: Cloudfare.php?id=b7356889d0ad52253adcaf732898ac66
Keep-Alive: timeout=5, max=90
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8

gecu-upgrade.from-tx.com/x/login.php/Cloudfare.php?id=b7356889d0ad52253adcaf732898ac66

152.42.244.54

302 Found

0 B

URL User Request GET HTTP/1.1
gecu-upgrade.from-tx.com/x/login.php/Cloudfare.php?id=b7356889d0ad52253adcaf732898ac66
IP
152.42.244.54:443
ASN
#0

Certificate
IssuerLet's Encrypt
Subjectgecu-upgrade.from-tx.com
FingerprintDB:39:19:94:98:29:3E:A4:3C:06:8C:71:04:C6:AE:90:B6:73:19:A9
ValidityThu, 02 May 2024 16:39:09 GMT - Wed, 31 Jul 2024 16:39:08 GMT

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /x/login.php/Cloudfare.php?id=b7356889d0ad52253adcaf732898ac66 HTTP/1.1
Host: gecu-upgrade.from-tx.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 302 Found
Date: Fri, 10 May 2024 12:26:22 GMT
Server: Apache
Location: Cloudfare.php?id=c88abf1032dfa0e6f5e9ded68d8c732e
Keep-Alive: timeout=5, max=89
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8

gecu-upgrade.from-tx.com/x/login.php/Cloudfare.php?id=c88abf1032dfa0e6f5e9ded68d8c732e

152.42.244.54

302 Found

0 B

URL User Request GET HTTP/1.1
gecu-upgrade.from-tx.com/x/login.php/Cloudfare.php?id=c88abf1032dfa0e6f5e9ded68d8c732e
IP
152.42.244.54:443
ASN
#0

Certificate
IssuerLet's Encrypt
Subjectgecu-upgrade.from-tx.com
FingerprintDB:39:19:94:98:29:3E:A4:3C:06:8C:71:04:C6:AE:90:B6:73:19:A9
ValidityThu, 02 May 2024 16:39:09 GMT - Wed, 31 Jul 2024 16:39:08 GMT

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /x/login.php/Cloudfare.php?id=c88abf1032dfa0e6f5e9ded68d8c732e HTTP/1.1
Host: gecu-upgrade.from-tx.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 302 Found
Date: Fri, 10 May 2024 12:26:23 GMT
Server: Apache
Location: Cloudfare.php?id=e58c69bc8d4723f40ac48c2b947e5365
Keep-Alive: timeout=5, max=88
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8

gecu-upgrade.from-tx.com/x/login.php/Cloudfare.php?id=e58c69bc8d4723f40ac48c2b947e5365

152.42.244.54

302 Found

0 B

URL User Request GET HTTP/1.1
gecu-upgrade.from-tx.com/x/login.php/Cloudfare.php?id=e58c69bc8d4723f40ac48c2b947e5365
IP
152.42.244.54:443
ASN
#0

Certificate
IssuerLet's Encrypt
Subjectgecu-upgrade.from-tx.com
FingerprintDB:39:19:94:98:29:3E:A4:3C:06:8C:71:04:C6:AE:90:B6:73:19:A9
ValidityThu, 02 May 2024 16:39:09 GMT - Wed, 31 Jul 2024 16:39:08 GMT

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /x/login.php/Cloudfare.php?id=e58c69bc8d4723f40ac48c2b947e5365 HTTP/1.1
Host: gecu-upgrade.from-tx.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 302 Found
Date: Fri, 10 May 2024 12:26:23 GMT
Server: Apache
Location: Cloudfare.php?id=377278ed738c7cc5c4dc765edbb34ec4
Keep-Alive: timeout=5, max=87
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8

gecu-upgrade.from-tx.com/x/login.php/Cloudfare.php?id=377278ed738c7cc5c4dc765edbb34ec4

152.42.244.54

302 Found

0 B

URL User Request GET HTTP/1.1
gecu-upgrade.from-tx.com/x/login.php/Cloudfare.php?id=377278ed738c7cc5c4dc765edbb34ec4
IP
152.42.244.54:443
ASN
#0

Certificate
IssuerLet's Encrypt
Subjectgecu-upgrade.from-tx.com
FingerprintDB:39:19:94:98:29:3E:A4:3C:06:8C:71:04:C6:AE:90:B6:73:19:A9
ValidityThu, 02 May 2024 16:39:09 GMT - Wed, 31 Jul 2024 16:39:08 GMT

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /x/login.php/Cloudfare.php?id=377278ed738c7cc5c4dc765edbb34ec4 HTTP/1.1
Host: gecu-upgrade.from-tx.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 302 Found
Date: Fri, 10 May 2024 12:26:24 GMT
Server: Apache
Location: Cloudfare.php?id=fa501b3bd182fcd32712e356b76104f5
Keep-Alive: timeout=5, max=86
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8

gecu-upgrade.from-tx.com/x/login.php/Cloudfare.php?id=fa501b3bd182fcd32712e356b76104f5

152.42.244.54

302 Found

0 B

URL User Request GET HTTP/1.1
gecu-upgrade.from-tx.com/x/login.php/Cloudfare.php?id=fa501b3bd182fcd32712e356b76104f5
IP
152.42.244.54:443
ASN
#0

Certificate
IssuerLet's Encrypt
Subjectgecu-upgrade.from-tx.com
FingerprintDB:39:19:94:98:29:3E:A4:3C:06:8C:71:04:C6:AE:90:B6:73:19:A9
ValidityThu, 02 May 2024 16:39:09 GMT - Wed, 31 Jul 2024 16:39:08 GMT

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /x/login.php/Cloudfare.php?id=fa501b3bd182fcd32712e356b76104f5 HTTP/1.1
Host: gecu-upgrade.from-tx.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 302 Found
Date: Fri, 10 May 2024 12:26:24 GMT
Server: Apache
Location: Cloudfare.php?id=f168b8270fd5750854d85e1c4f270d9c
Keep-Alive: timeout=5, max=85
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8

gecu-upgrade.from-tx.com/x/login.php/Cloudfare.php?id=f168b8270fd5750854d85e1c4f270d9c

152.42.244.54

302 Found

0 B

URL User Request GET HTTP/1.1
gecu-upgrade.from-tx.com/x/login.php/Cloudfare.php?id=f168b8270fd5750854d85e1c4f270d9c
IP
152.42.244.54:443
ASN
#0

Certificate
IssuerLet's Encrypt
Subjectgecu-upgrade.from-tx.com
FingerprintDB:39:19:94:98:29:3E:A4:3C:06:8C:71:04:C6:AE:90:B6:73:19:A9
ValidityThu, 02 May 2024 16:39:09 GMT - Wed, 31 Jul 2024 16:39:08 GMT

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /x/login.php/Cloudfare.php?id=f168b8270fd5750854d85e1c4f270d9c HTTP/1.1
Host: gecu-upgrade.from-tx.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 302 Found
Date: Fri, 10 May 2024 12:26:25 GMT
Server: Apache
Location: Cloudfare.php?id=601a5ffea4d4bdbfe5ab9cab25119c7e
Keep-Alive: timeout=5, max=84
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8

gecu-upgrade.from-tx.com/x/login.php/Cloudfare.php?id=601a5ffea4d4bdbfe5ab9cab25119c7e

152.42.244.54

302 Found

0 B

URL User Request GET HTTP/1.1
gecu-upgrade.from-tx.com/x/login.php/Cloudfare.php?id=601a5ffea4d4bdbfe5ab9cab25119c7e
IP
152.42.244.54:443
ASN
#0

Certificate
IssuerLet's Encrypt
Subjectgecu-upgrade.from-tx.com
FingerprintDB:39:19:94:98:29:3E:A4:3C:06:8C:71:04:C6:AE:90:B6:73:19:A9
ValidityThu, 02 May 2024 16:39:09 GMT - Wed, 31 Jul 2024 16:39:08 GMT

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /x/login.php/Cloudfare.php?id=601a5ffea4d4bdbfe5ab9cab25119c7e HTTP/1.1
Host: gecu-upgrade.from-tx.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 302 Found
Date: Fri, 10 May 2024 12:26:25 GMT
Server: Apache
Location: Cloudfare.php?id=de886716aa1f953e4c61ea54d6ef50e8
Keep-Alive: timeout=5, max=83
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8

gecu-upgrade.from-tx.com/x/login.php/Cloudfare.php?id=de886716aa1f953e4c61ea54d6ef50e8

152.42.244.54

302 Found

0 B

URL User Request GET HTTP/1.1
gecu-upgrade.from-tx.com/x/login.php/Cloudfare.php?id=de886716aa1f953e4c61ea54d6ef50e8
IP
152.42.244.54:443
ASN
#0

Certificate
IssuerLet's Encrypt
Subjectgecu-upgrade.from-tx.com
FingerprintDB:39:19:94:98:29:3E:A4:3C:06:8C:71:04:C6:AE:90:B6:73:19:A9
ValidityThu, 02 May 2024 16:39:09 GMT - Wed, 31 Jul 2024 16:39:08 GMT

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /x/login.php/Cloudfare.php?id=de886716aa1f953e4c61ea54d6ef50e8 HTTP/1.1
Host: gecu-upgrade.from-tx.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 302 Found
Date: Fri, 10 May 2024 12:26:26 GMT
Server: Apache
Location: Cloudfare.php?id=f62d9fc637e303aa813b197754a8ad9a
Keep-Alive: timeout=5, max=82
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8

gecu-upgrade.from-tx.com/x/login.php/Cloudfare.php?id=f62d9fc637e303aa813b197754a8ad9a

152.42.244.54

0 B

URL User Request GET
gecu-upgrade.from-tx.com/x/login.php/Cloudfare.php?id=f62d9fc637e303aa813b197754a8ad9a
IP
152.42.244.54:0
ASN
#0

Certificate
IssuerLet's Encrypt
Subjectgecu-upgrade.from-tx.com
FingerprintDB:39:19:94:98:29:3E:A4:3C:06:8C:71:04:C6:AE:90:B6:73:19:A9
ValidityThu, 02 May 2024 16:39:09 GMT - Wed, 31 Jul 2024 16:39:08 GMT

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Detections

NIDS	Severity	Alert
suricata	medium	ET INFO DYNAMIC_DNS HTTP Request to a *.from-tx .com Domain
suricata	medium	ET INFO DYNAMIC_DNS HTTP Request to a *.from-tx .com Domain

HTTP Headers

GET /x/login.php/Cloudfare.php?id=f62d9fc637e303aa813b197754a8ad9a HTTP/1.1
Host: gecu-upgrade.from-tx.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 302 Found
Date: Fri, 10 May 2024 12:26:26 GMT
Server: Apache
Location: Cloudfare.php?id=d376561a9a6e3590fc89479127aad77c
Keep-Alive: timeout=5, max=81
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8

gecu-upgrade.from-tx.com/x/login.php/Cloudfare.php?id=f62d9fc637e303aa813b197754a8ad9a

152.42.244.54

0 B

URL User Request GET
gecu-upgrade.from-tx.com/x/login.php/Cloudfare.php?id=f62d9fc637e303aa813b197754a8ad9a
IP
152.42.244.54:0
ASN
#0

Certificate
IssuerLet's Encrypt
Subjectgecu-upgrade.from-tx.com
FingerprintDB:39:19:94:98:29:3E:A4:3C:06:8C:71:04:C6:AE:90:B6:73:19:A9
ValidityThu, 02 May 2024 16:39:09 GMT - Wed, 31 Jul 2024 16:39:08 GMT

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Detections

NIDS	Severity	Alert
suricata	medium	ET INFO DYNAMIC_DNS HTTP Request to a *.from-tx .com Domain
suricata	medium	ET INFO DYNAMIC_DNS HTTP Request to a *.from-tx .com Domain

HTTP Headers

GET /x/login.php/Cloudfare.php?id=f62d9fc637e303aa813b197754a8ad9a HTTP/1.1
Host: gecu-upgrade.from-tx.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 302 Found
Date: Fri, 10 May 2024 12:26:28 GMT
Server: Apache
Location: Cloudfare.php?id=a8ad48ffc75b7e626472bc6a3ee4f74b
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8

gecu-upgrade.from-tx.com/x/login.php/Cloudfare.php?id=a8ad48ffc75b7e626472bc6a3ee4f74b

152.42.244.54

0 B

URL User Request GET
gecu-upgrade.from-tx.com/x/login.php/Cloudfare.php?id=a8ad48ffc75b7e626472bc6a3ee4f74b
IP
152.42.244.54:0
ASN
#0

Certificate
IssuerLet's Encrypt
Subjectgecu-upgrade.from-tx.com
FingerprintDB:39:19:94:98:29:3E:A4:3C:06:8C:71:04:C6:AE:90:B6:73:19:A9
ValidityThu, 02 May 2024 16:39:09 GMT - Wed, 31 Jul 2024 16:39:08 GMT

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /x/login.php/Cloudfare.php?id=a8ad48ffc75b7e626472bc6a3ee4f74b HTTP/1.1
Host: gecu-upgrade.from-tx.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 302 Found
Date: Fri, 10 May 2024 12:26:28 GMT
Server: Apache
Location: Cloudfare.php?id=0adf114a75363493a1ca91719e3acc38
Keep-Alive: timeout=5, max=80
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8

gecu-upgrade.from-tx.com/x/login.php/Cloudfare.php?id=0adf114a75363493a1ca91719e3acc38

152.42.244.54

0 B

URL User Request GET
gecu-upgrade.from-tx.com/x/login.php/Cloudfare.php?id=0adf114a75363493a1ca91719e3acc38
IP
152.42.244.54:0
ASN
#0

Certificate
IssuerLet's Encrypt
Subjectgecu-upgrade.from-tx.com
FingerprintDB:39:19:94:98:29:3E:A4:3C:06:8C:71:04:C6:AE:90:B6:73:19:A9
ValidityThu, 02 May 2024 16:39:09 GMT - Wed, 31 Jul 2024 16:39:08 GMT

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /x/login.php/Cloudfare.php?id=0adf114a75363493a1ca91719e3acc38 HTTP/1.1
Host: gecu-upgrade.from-tx.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 302 Found
Date: Fri, 10 May 2024 12:26:29 GMT
Server: Apache
Location: Cloudfare.php?id=07eb578d5ae9bb51c66fd119608ecbcf
Keep-Alive: timeout=5, max=79
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (0)

HTTP Transactions (25)

URL User Request GET HTTP/1.1

IP

ASN

Certificate

File type

Size

Hash

HTTP Headers

URL

IP

ASN

Certificate

File type

Size

Hash

Detections

HTTP Headers

URL User Request GET HTTP/1.1

IP

ASN

File type

Size

Hash

Detections

HTTP Headers

URL User Request GET HTTP/1.1

IP

ASN

Certificate

File type

Size

Hash

HTTP Headers

URL User Request GET HTTP/1.1

IP

ASN

Certificate

File type

Size

Hash

HTTP Headers

URL User Request GET HTTP/1.1

IP

ASN

Certificate

File type

Size

Hash

HTTP Headers

URL User Request GET HTTP/1.1

IP

ASN

Certificate