www.upload.ee/download/15695061/5d6d22946fdd1d8dad4b/heg1.exe
397 B URL www.upload.ee/download/15695061/5d6d22946fdd1d8dad4b/heg1.exe
IP
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document, ASCII text, with very long lines (397), with no line terminators
Hash 672fd1bf134419c4ab4c4ff544554464
b7add0f78e823f45fdc2c664a4c0c87bea0850dd
4a0aff6f19d0017ba1892c8fffdae89f3c22f085f075f9622004b60214e01ea9
GET /download/15695061/5d6d22946fdd1d8dad4b/heg1.exe HTTP/1.1
Host: www.upload.ee
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 404 Not Found
Server: nginx
Date: Sun, 17 Sep 2023 15:05:41 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 397
Connection: keep-alive
Keep-Alive: timeout=5
Strict-Transport-Security: max-age=31536000
X-XSS-Protection: 1
P3P: CP="CAO PSA OUR"
www.upload.ee/download/15695061/5d6d22946fdd1d8dad4b/heg1.exe
397 B URL www.upload.ee/download/15695061/5d6d22946fdd1d8dad4b/heg1.exe
IP
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document, ASCII text, with very long lines (397), with no line terminators
Hash 672fd1bf134419c4ab4c4ff544554464
b7add0f78e823f45fdc2c664a4c0c87bea0850dd
4a0aff6f19d0017ba1892c8fffdae89f3c22f085f075f9622004b60214e01ea9
GET /download/15695061/5d6d22946fdd1d8dad4b/heg1.exe HTTP/1.1
Host: www.upload.ee
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 404 Not Found
Server: nginx
Date: Sun, 17 Sep 2023 15:05:41 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 397
Connection: keep-alive
Keep-Alive: timeout=5
Strict-Transport-Security: max-age=31536000
X-XSS-Protection: 1
P3P: CP="CAO PSA OUR"
www.upload.ee/files/15695061/heg1.exe.html?msg=sess_error
200 OK 9.0 kB URL User Request GET HTTP/1.1 www.upload.ee/files/15695061/heg1.exe.html?msg=sess_error
IP
Certificate IssuerDigiCert, Inc.
Subjectwww.upload.ee
Fingerprint50:32:93:34:C8:04:2F:84:49:77:0D:C4:DD:CA:79:C9:CB:3E:C0:F4
ValidityThu, 02 Mar 2023 00:00:00 GMT - Mon, 01 Apr 2024 23:59:59 GMT
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (4526)
Hash f36c79296c1049f80e22d56750ab500d
448347904370800ec42a199f591f22c9f32a69bc
afcedee05174da70a88596e37e99da28838a8a4312f4e433c1f0a32937de9824
GET /files/15695061/heg1.exe.html?msg=sess_error HTTP/1.1
Host: www.upload.ee
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.upload.ee/download/15695061/5d6d22946fdd1d8dad4b/heg1.exe
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Sun, 17 Sep 2023 15:05:41 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 8984
Connection: keep-alive
Keep-Alive: timeout=20
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Last-Modified: Sun, 17 Sep 2023 18:05:41 +0300
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Strict-Transport-Security: max-age=31536000
X-XSS-Protection: 1
P3P: CP="CAO PSA OUR"
Set-Cookie: lng=eng; expires=Sun, 15-Oct-2023 15:05:41 GMT; path=/; domain=www.upload.ee; secure; httponly; SameSite=None
Content-Encoding: gzip
www.upload.ee/static/ubr__style.css
200 OK 2.9 kB URL GET HTTP/1.1 www.upload.ee/static/ubr__style.css
IP
Requested by https://www.upload.ee/files/15695061/heg1.exe.html?msg=sess_error
Certificate IssuerDigiCert, Inc.
Subjectwww.upload.ee
Fingerprint50:32:93:34:C8:04:2F:84:49:77:0D:C4:DD:CA:79:C9:CB:3E:C0:F4
ValidityThu, 02 Mar 2023 00:00:00 GMT - Mon, 01 Apr 2024 23:59:59 GMT
File type ASCII text, with very long lines (591), with CRLF line terminators
Hash 3ba04e290212b44bcca8f10a60a4e879
a9b021c9019bdbb28250836039b2372a1b4d0f0f
f618b1c7be10c3203620d44c6f323be5b61ac10e67588d96cb69988b3173c7d2
GET /static/ubr__style.css HTTP/1.1
Host: www.upload.ee
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.upload.ee/files/15695061/heg1.exe.html?msg=sess_error
Cookie: lng=eng
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Sun, 17 Sep 2023 15:05:41 GMT
Content-Type: text/css
Last-Modified: Fri, 04 Oct 2013 10:02:27 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Keep-Alive: timeout=20
ETag: W/"524e9233-25a0"
Expires: Sun, 24 Sep 2023 15:05:41 GMT
Cache-Control: max-age=604800
Vary: Accept-Encoding
Content-Encoding: gzip
www.upload.ee/js/js__file_upload.js
200 OK 27 kB URL GET HTTP/1.1 www.upload.ee/js/js__file_upload.js
IP
Requested by https://www.upload.ee/files/15695061/heg1.exe.html?msg=sess_error
Certificate IssuerDigiCert, Inc.
Subjectwww.upload.ee
Fingerprint50:32:93:34:C8:04:2F:84:49:77:0D:C4:DD:CA:79:C9:CB:3E:C0:F4
ValidityThu, 02 Mar 2023 00:00:00 GMT - Mon, 01 Apr 2024 23:59:59 GMT
File type Unicode text, UTF-8 text, with very long lines (1853)
Hash 617f6d5a2744bc8c02e3d2c67544bd68
f57c068257c8bc85644d3be1e845c36506cd4625
62a3bb4d9d2b5a55b6d821a75d7b155fac47def3c241e4f1215d17e022f02658
GET /js/js__file_upload.js HTTP/1.1
Host: www.upload.ee
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.upload.ee/files/15695061/heg1.exe.html?msg=sess_error
Cookie: lng=eng
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Sun, 17 Sep 2023 15:05:41 GMT
Content-Type: application/javascript
Content-Length: 27351
Last-Modified: Thu, 07 May 2020 19:13:28 GMT
Connection: keep-alive
Keep-Alive: timeout=20
ETag: "5eb45dd8-6ad7"
Expires: Sun, 24 Sep 2023 15:05:41 GMT
Cache-Control: max-age=604800
Vary: Accept-Encoding
Accept-Ranges: bytes
www.upload.ee/images/arrow.gif
200 OK 59 B URL GET HTTP/1.1 www.upload.ee/images/arrow.gif
IP
Requested by https://www.upload.ee/files/15695061/heg1.exe.html?msg=sess_error
Certificate IssuerDigiCert, Inc.
Subjectwww.upload.ee
Fingerprint50:32:93:34:C8:04:2F:84:49:77:0D:C4:DD:CA:79:C9:CB:3E:C0:F4
ValidityThu, 02 Mar 2023 00:00:00 GMT - Mon, 01 Apr 2024 23:59:59 GMT
File type GIF image data, version 89a, 6 x 9\012- data
Hash 6675f814b94f13f91f1383707b250e36
31452650e8fce2095613a2010799bdb7548bdd51
061d01a0b85f948c6ec464870ecec4654c4bd2ff15cacda941bbbf16225ec411
GET /images/arrow.gif HTTP/1.1
Host: www.upload.ee
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.upload.ee/files/15695061/heg1.exe.html?msg=sess_error
Cookie: lng=eng
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Sun, 17 Sep 2023 15:05:42 GMT
Content-Type: image/gif
Content-Length: 59
Last-Modified: Sun, 14 Apr 2013 07:15:01 GMT
Connection: keep-alive
Keep-Alive: timeout=20
ETag: "516a5775-3b"
Expires: Sun, 24 Sep 2023 15:05:42 GMT
Cache-Control: max-age=604800
Accept-Ranges: bytes
www.upload.ee/images/dl_.png
200 OK 1.9 kB URL GET HTTP/1.1 www.upload.ee/images/dl_.png
IP
Requested by https://www.upload.ee/files/15695061/heg1.exe.html?msg=sess_error
Certificate IssuerDigiCert, Inc.
Subjectwww.upload.ee
Fingerprint50:32:93:34:C8:04:2F:84:49:77:0D:C4:DD:CA:79:C9:CB:3E:C0:F4
ValidityThu, 02 Mar 2023 00:00:00 GMT - Mon, 01 Apr 2024 23:59:59 GMT
File type PNG image data, 154 x 32, 8-bit colormap, non-interlaced\012- data
Hash f3e8f284a4e98cdb91b6abfc142d94a4
fa9e618c2f56bea752ddd7e45a372c5539dadda9
2f13919383f54ca21e5b87f5644df8a875b99815c821dcbbabea352d854c6882
GET /images/dl_.png HTTP/1.1
Host: www.upload.ee
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.upload.ee/files/15695061/heg1.exe.html?msg=sess_error
Cookie: lng=eng
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Sun, 17 Sep 2023 15:05:42 GMT
Content-Type: image/png
Content-Length: 1900
Last-Modified: Thu, 01 Dec 2016 09:37:27 GMT
Connection: keep-alive
Keep-Alive: timeout=20
ETag: "583fef57-76c"
Expires: Sun, 24 Sep 2023 15:05:42 GMT
Cache-Control: max-age=604800
Accept-Ranges: bytes
ocsp.pki.goog/gts1c3
472 B IP
Hash 6baf1d8a31b46b31d2194fa3d66d08bd
e22400364dd8ef4742854ce14a2ae125efbc94ca
5baf7a3cffc50d8a196828ec49da7527c6b99a513a1e14344a1e3d3c4df40f3f
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sun, 17 Sep 2023 15:05:42 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
du0pud0sdlmzf.cloudfront.net/?dupud=997369
200 OK 118 kB URL GET HTTP/2 du0pud0sdlmzf.cloudfront.net/?dupud=997369
IP
Requested by https://www.upload.ee/files/15695061/heg1.exe.html?msg=sess_error
Certificate IssuerAmazon
Subject*.cloudfront.net
FingerprintBA:0F:CD:B3:EA:19:B2:9D:99:9B:51:2D:16:33:6B:D0:3F:31:A2:AB
ValidityThu, 08 Dec 2022 00:00:00 GMT - Thu, 07 Dec 2023 23:59:59 GMT
File type Unicode text, UTF-8 text, with very long lines (15948)
Size 118 kB (117750 bytes)
Hash 2f5b35b995dff916e95682be30a76c57
c638b82e1e174c017512c950777eac7f93372d6a
fdc37520a0f5cc1944ce0fa3ee133c87fdde5443efa4d0d9eff907f00a71d1b9
GET /?dupud=997369 HTTP/1.1
Host: du0pud0sdlmzf.cloudfront.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.upload.ee/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
content-length: 117750
date: Sun, 17 Sep 2023 14:46:39 GMT
access-control-allow-origin: *
cache-control: no-store, no-cache, proxy-revalidate, must-revalidate, private, no-transform
content-encoding: gzip
pragma: no-cache
x-cache: Hit from cloudfront
via: 1.1 d4fd24ae65d4d2b97cfdea8d2f0c21a6.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-C1
x-amz-cf-id: B4sSGZUY-J7TyY83sV-LlKp_xtlWMQbFdbX9B3U694Iy80eQSrXn1A==
age: 1143
X-Firefox-Spdy: h2
www.googletagmanager.com/gtag/js?id=UA-6703115-1
200 OK 51 kB URL GET HTTP/2 www.googletagmanager.com/gtag/js?id=UA-6703115-1
IP
Requested by https://www.upload.ee/files/15695061/heg1.exe.html?msg=sess_error
Certificate IssuerGoogle Trust Services LLC
Subject*.google-analytics.com
FingerprintE6:F7:82:C1:10:AC:08:76:A1:97:70:B7:56:B7:EF:92:30:BA:1E:12
ValidityMon, 14 Aug 2023 08:16:28 GMT - Mon, 06 Nov 2023 08:16:27 GMT
File type ASCII text, with very long lines (2271)
Hash 86f62deb7036ef21b59358402db8cc73
2932f3335b11a19c391c3cb5ee1ca00b157c44c1
9176c39b9d7e130f8921da3f835b48f6e35fbda388dc46effea2c66f22a29f61
GET /gtag/js?id=UA-6703115-1 HTTP/1.1
Host: www.googletagmanager.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.upload.ee/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
content-encoding: br
vary: Accept-Encoding
date: Sun, 17 Sep 2023 15:05:42 GMT
expires: Sun, 17 Sep 2023 15:05:42 GMT
cache-control: private, max-age=900
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
server: Google Tag Manager
content-length: 51408
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
ocsp.pki.goog/gts1c3
472 B IP
Hash 6baf1d8a31b46b31d2194fa3d66d08bd
e22400364dd8ef4742854ce14a2ae125efbc94ca
5baf7a3cffc50d8a196828ec49da7527c6b99a513a1e14344a1e3d3c4df40f3f
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sun, 17 Sep 2023 15:05:42 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
www.googletagmanager.com/gtag/js?id=G-LT9YQX0N49&l=dataLayer&cx=c
200 OK 86 kB URL GET HTTP/3 www.googletagmanager.com/gtag/js?id=G-LT9YQX0N49&l=dataLayer&cx=c
IP
Requested by https://www.upload.ee/files/15695061/heg1.exe.html?msg=sess_error
Certificate IssuerGoogle Trust Services LLC
Subject*.google-analytics.com
FingerprintE6:F7:82:C1:10:AC:08:76:A1:97:70:B7:56:B7:EF:92:30:BA:1E:12
ValidityMon, 14 Aug 2023 08:16:28 GMT - Mon, 06 Nov 2023 08:16:27 GMT
File type ASCII text, with very long lines (3034)
Hash 6536a2a0764995dc8d96a6a31a62c2a4
d878965ef1c8e5784938740ee95296ba65c2d51d
3e72d8871bb4fcb3a7df96472cef03b3981b13e7f4211601529fb12b942b06f5
GET /gtag/js?id=G-LT9YQX0N49&l=dataLayer&cx=c HTTP/1.1
Host: www.googletagmanager.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.upload.ee/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
content-encoding: br
vary: Accept-Encoding
date: Sun, 17 Sep 2023 15:05:42 GMT
expires: Sun, 17 Sep 2023 15:05:42 GMT
cache-control: private, max-age=900
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
server: Google Tag Manager
content-length: 85524
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
eownouncillors.info/MHZtZTcfSQ4WCmYgClF6aBoKPHYANz5XZUI3LA12ahsGNXVlN0sRXlRLVFwAA0BUQ0dZElBUEUMCDBFCQ0tcQ15eEAJYEUZLXEsEBFheURkAUBhYBhYCHQRQDUdLFUNEGlBUAQlCVFMEAUJfUAcB
204 No Content 0 B URL GET HTTP/2 eownouncillors.info/MHZtZTcfSQ4WCmYgClF6aBoKPHYANz5XZUI3LA12ahsGNXVlN0sRXlRLVFwAA0BUQ0dZElBUEUMCDBFCQ0tcQ15eEAJYEUZLXEsEBFheURkAUBhYBhYCHQRQDUdLFUNEGlBUAQlCVFMEAUJfUAcB
IP
Requested by https://www.upload.ee/files/15695061/heg1.exe.html?msg=sess_error
Certificate IssuerGoogle Trust Services LLC
Subjecteownouncillors.info
Fingerprint15:95:EB:48:9F:45:AB:B4:6E:35:F9:99:AE:3A:73:6D:04:C7:13:FC
ValidityMon, 04 Sep 2023 06:52:49 GMT - Sun, 03 Dec 2023 06:52:48 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /MHZtZTcfSQ4WCmYgClF6aBoKPHYANz5XZUI3LA12ahsGNXVlN0sRXlRLVFwAA0BUQ0dZElBUEUMCDBFCQ0tcQ15eEAJYEUZLXEsEBFheURkAUBhYBhYCHQRQDUdLFUNEGlBUAQlCVFMEAUJfUAcB HTTP/1.1
Host: eownouncillors.info
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.upload.ee/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 204 No Content
date: Sun, 17 Sep 2023 15:05:42 GMT
access-control-allow-origin: *
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=D9vTc%2BamQ7USDydVkzCzrpOi2tnqWMze7rbR6tBnNZHjFschIzA5XR4JdWHVNK6TqT0UELvNi%2BH2S2Wrtp4U6CzT0Y8pll7gXb6lD0m%2BGByvm8gYX6hMccCxU2v%2F2IHEvokWju68"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 80823fb849061bfe-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
eownouncillors.info/Y3JaUzRMTTkgCTInF2JlGR5vNkMtBRlgUFUzaR59ACofFFEEBXwnXQdPY2oDV0NudUQKFmdiEhAGOydBEE9rdV0NFDVuEhVPa30HV1xpZxpTVC9uBUUGKjJTXkN8I0AXHmdiAlpGY2UHUkZoZgFQ
204 No Content 0 B URL GET HTTP/2 eownouncillors.info/Y3JaUzRMTTkgCTInF2JlGR5vNkMtBRlgUFUzaR59ACofFFEEBXwnXQdPY2oDV0NudUQKFmdiEhAGOydBEE9rdV0NFDVuEhVPa30HV1xpZxpTVC9uBUUGKjJTXkN8I0AXHmdiAlpGY2UHUkZoZgFQ
IP
Requested by https://www.upload.ee/files/15695061/heg1.exe.html?msg=sess_error
Certificate IssuerGoogle Trust Services LLC
Subjecteownouncillors.info
Fingerprint15:95:EB:48:9F:45:AB:B4:6E:35:F9:99:AE:3A:73:6D:04:C7:13:FC
ValidityMon, 04 Sep 2023 06:52:49 GMT - Sun, 03 Dec 2023 06:52:48 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /Y3JaUzRMTTkgCTInF2JlGR5vNkMtBRlgUFUzaR59ACofFFEEBXwnXQdPY2oDV0NudUQKFmdiEhAGOydBEE9rdV0NFDVuEhVPa30HV1xpZxpTVC9uBUUGKjJTXkN8I0AXHmdiAlpGY2UHUkZoZgFQ HTTP/1.1
Host: eownouncillors.info
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.upload.ee/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 204 No Content
date: Sun, 17 Sep 2023 15:05:42 GMT
access-control-allow-origin: *
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=vdosfr7DGUVUY8b8OXjVTTjgM4AS4t%2BGGufCGCC80w56DJFGVCGHqpC2LZWMNXVnYQhagK9J92MKMm543DOT9cOofeP8Sn1eS2NoeBFy3AoGNKfePImQbguu3humhfCcUOIaCxNZ"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 80823fb849071bfe-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
eownouncillors.info/UkNLRHB9fCg3TTcuPHAlBA0IEzEiJBEvQQsHJiAdAXJ/Bik/Fm0wGTZ+cn1HZnNzYgA7J3Z1SHQwPyUEJzB2dVY7LS0rTXQ1dnVeYm15akR0NnZ1ViYzKiNNY2U7MAQ+fnpySWZ6fXdBZnF+dkU
204 No Content 0 B URL GET HTTP/2 eownouncillors.info/UkNLRHB9fCg3TTcuPHAlBA0IEzEiJBEvQQsHJiAdAXJ/Bik/Fm0wGTZ+cn1HZnNzYgA7J3Z1SHQwPyUEJzB2dVY7LS0rTXQ1dnVeYm15akR0NnZ1ViYzKiNNY2U7MAQ+fnpySWZ6fXdBZnF+dkU
IP
Requested by https://www.upload.ee/files/15695061/heg1.exe.html?msg=sess_error
Certificate IssuerGoogle Trust Services LLC
Subjecteownouncillors.info
Fingerprint15:95:EB:48:9F:45:AB:B4:6E:35:F9:99:AE:3A:73:6D:04:C7:13:FC
ValidityMon, 04 Sep 2023 06:52:49 GMT - Sun, 03 Dec 2023 06:52:48 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /UkNLRHB9fCg3TTcuPHAlBA0IEzEiJBEvQQsHJiAdAXJ/Bik/Fm0wGTZ+cn1HZnNzYgA7J3Z1SHQwPyUEJzB2dVY7LS0rTXQ1dnVeYm15akR0NnZ1ViYzKiNNY2U7MAQ+fnpySWZ6fXdBZnF+dkU HTTP/1.1
Host: eownouncillors.info
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.upload.ee/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 204 No Content
date: Sun, 17 Sep 2023 15:05:42 GMT
access-control-allow-origin: *
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=62ZKZW5kS9XDX6UeLSnZsQuraP46qbWU5L1xpksiucWy2fNWpGAq0WdCu8%2Fcr7xWC0fASR5x%2FzyybuXAdex1G1Jhtzin3spkT%2FMSS2OPlVw5JS%2BGv50GA%2B855Akn7Hh3%2FaXmjS7q"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 80823fb849091bfe-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
deatchshipsmotor.com/ODc3WmNZVVQ3XFkKVXwWSlsKf1F+EgUcB00HRy8HCERTNg5CURk5D1dCUzwRV1lDdA1dQxJoJXx5YAhVYQZ9DSBAZnE4Nn15fzZWSnNxFCxtWm4OJ19cegombm17GVcLdXYUM31fcR8tCUBvESV+bWQxNh0FdQwiV1NvNDFpdF82BmFPehwrX3FBGzZxeHIgUl1gZW4BcnEPCCBPQFkLMXJUcTAucXRlDzl3BlwTJAhtUDlSfmJiaQBwYXETAWFAZRgwa3EEGFJpYHQwG3l/cWMxYVwGOTd8T1wbNn59fgIAcGF2PTVcQG42MAl5RR1SamNlNyJ+dk93W3l4YSoha3RhPSFuYXwPUXVxYQxaam5bFy17dm5qNFBPUQ8xaXJhDxd2bl8XMWoGfnwJS1hZKl5uelJrBA1GdCsw
200 OK 1.2 kB URL GET HTTP/2 deatchshipsmotor.com/ODc3WmNZVVQ3XFkKVXwWSlsKf1F+EgUcB00HRy8HCERTNg5CURk5D1dCUzwRV1lDdA1dQxJoJXx5YAhVYQZ9DSBAZnE4Nn15fzZWSnNxFCxtWm4OJ19cegombm17GVcLdXYUM31fcR8tCUBvESV+bWQxNh0FdQwiV1NvNDFpdF82BmFPehwrX3FBGzZxeHIgUl1gZW4BcnEPCCBPQFkLMXJUcTAucXRlDzl3BlwTJAhtUDlSfmJiaQBwYXETAWFAZRgwa3EEGFJpYHQwG3l/cWMxYVwGOTd8T1wbNn59fgIAcGF2PTVcQG42MAl5RR1SamNlNyJ+dk93W3l4YSoha3RhPSFuYXwPUXVxYQxaam5bFy17dm5qNFBPUQ8xaXJhDxd2bl8XMWoGfnwJS1hZKl5uelJrBA1GdCsw
IP
Requested by https://www.upload.ee/files/15695061/heg1.exe.html?msg=sess_error
Certificate IssuerAmazon
Subjectdeatchshipsmotor.com
Fingerprint9C:34:2D:04:62:30:9B:47:17:CD:C6:43:FB:50:04:74:EB:2B:63:8A
ValidityWed, 13 Sep 2023 00:00:00 GMT - Fri, 11 Oct 2024 23:59:59 GMT
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (3015), with no line terminators
Hash bac6f25cfb5e638d6998a75ff2cc20ba
5277512ead8a2ef7738725c672899c380d97e893
29c27ace8accbc3cefa29bcad1fbdde179df5d3ef92d4e87f9de590dc1ffed44
GET /ODc3WmNZVVQ3XFkKVXwWSlsKf1F+EgUcB00HRy8HCERTNg5CURk5D1dCUzwRV1lDdA1dQxJoJXx5YAhVYQZ9DSBAZnE4Nn15fzZWSnNxFCxtWm4OJ19cegombm17GVcLdXYUM31fcR8tCUBvESV+bWQxNh0FdQwiV1NvNDFpdF82BmFPehwrX3FBGzZxeHIgUl1gZW4BcnEPCCBPQFkLMXJUcTAucXRlDzl3BlwTJAhtUDlSfmJiaQBwYXETAWFAZRgwa3EEGFJpYHQwG3l/cWMxYVwGOTd8T1wbNn59fgIAcGF2PTVcQG42MAl5RR1SamNlNyJ+dk93W3l4YSoha3RhPSFuYXwPUXVxYQxaam5bFy17dm5qNFBPUQ8xaXJhDxd2bl8XMWoGfnwJS1hZKl5uelJrBA1GdCsw HTTP/1.1
Host: deatchshipsmotor.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.upload.ee/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
content-type: text/html
content-length: 1172
date: Sun, 17 Sep 2023 15:05:42 GMT
server: openresty/1.17.8.2
cache-control: no-store, no-cache, must-revalidate, no-transform
pragma: no-cache
p3p: CP="NID DSP ALL COR"
content-encoding: gzip
accept-ch: DPR, Width, Viewport-Width, Device-Memory, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List
x-cache: Miss from cloudfront
via: 1.1 1a8662d51ed58f0336021036df8bf88a.cloudfront.net (CloudFront)
x-amz-cf-pop: ARN54-C1
x-amz-cf-id: xGhpm_p3SjnIm4tazjqrQcpwoqv5ET7PLhm3lpe4ySShHvREQsYNpA==
X-Firefox-Spdy: h2
deatchshipsmotor.com/NnNXTmdXETQjWFdONWgSRB9qa1VwVmUIA0NDJzsDBgAzIgpMFXktC1kGMygVWR0jYAlTB3J8IQcXOjYyb0AaGCZMHBEaJn81GghSfSdmOglgJicfJV8QGgY2bCEaIghUPBE9HnUyBiMrZQsRDBBBOjYYKWA0MH5RdDZiHyRiHBYaDFI4GR8EZCBmJh5wBBoUJQQYHw0QdzQeHC5VMi8pDmQiDhYyYhgaDTUOMhgPLWEhFD4PYiYZGj9bIRsNV1IXNBgmTiZmewxyCzgXIGULEB8ybyY1CDJFIhEmH2M3ERo/WyIFDDF4FREYLXInZwQMZR8NCz9yXhoJInRDEy0xc0IFCB9aJmcAL240AQk2YyocHjVzJBIPKkUhPAsQbiQBHT9jKRwHMQMwcSQUWR0ncwEPGxl5AV0EBw8f
200 OK 1.2 kB URL GET HTTP/2 deatchshipsmotor.com/NnNXTmdXETQjWFdONWgSRB9qa1VwVmUIA0NDJzsDBgAzIgpMFXktC1kGMygVWR0jYAlTB3J8IQcXOjYyb0AaGCZMHBEaJn81GghSfSdmOglgJicfJV8QGgY2bCEaIghUPBE9HnUyBiMrZQsRDBBBOjYYKWA0MH5RdDZiHyRiHBYaDFI4GR8EZCBmJh5wBBoUJQQYHw0QdzQeHC5VMi8pDmQiDhYyYhgaDTUOMhgPLWEhFD4PYiYZGj9bIRsNV1IXNBgmTiZmewxyCzgXIGULEB8ybyY1CDJFIhEmH2M3ERo/WyIFDDF4FREYLXInZwQMZR8NCz9yXhoJInRDEy0xc0IFCB9aJmcAL240AQk2YyocHjVzJBIPKkUhPAsQbiQBHT9jKRwHMQMwcSQUWR0ncwEPGxl5AV0EBw8f
IP
Requested by https://www.upload.ee/files/15695061/heg1.exe.html?msg=sess_error
Certificate IssuerAmazon
Subjectdeatchshipsmotor.com
Fingerprint9C:34:2D:04:62:30:9B:47:17:CD:C6:43:FB:50:04:74:EB:2B:63:8A
ValidityWed, 13 Sep 2023 00:00:00 GMT - Fri, 11 Oct 2024 23:59:59 GMT
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (3017), with no line terminators
Hash 4ee7dfa0773b31f462a3c30b1714351a
23f676107e3dc0da0623ba9dca51fe156d2b9357
87d8ad47a1a5e9c5a35dba5d4ed1ef566581565a4a9f89012ee081f7c544f214
GET /NnNXTmdXETQjWFdONWgSRB9qa1VwVmUIA0NDJzsDBgAzIgpMFXktC1kGMygVWR0jYAlTB3J8IQcXOjYyb0AaGCZMHBEaJn81GghSfSdmOglgJicfJV8QGgY2bCEaIghUPBE9HnUyBiMrZQsRDBBBOjYYKWA0MH5RdDZiHyRiHBYaDFI4GR8EZCBmJh5wBBoUJQQYHw0QdzQeHC5VMi8pDmQiDhYyYhgaDTUOMhgPLWEhFD4PYiYZGj9bIRsNV1IXNBgmTiZmewxyCzgXIGULEB8ybyY1CDJFIhEmH2M3ERo/WyIFDDF4FREYLXInZwQMZR8NCz9yXhoJInRDEy0xc0IFCB9aJmcAL240AQk2YyocHjVzJBIPKkUhPAsQbiQBHT9jKRwHMQMwcSQUWR0ncwEPGxl5AV0EBw8f HTTP/1.1
Host: deatchshipsmotor.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.upload.ee/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
content-type: text/html
content-length: 1173
date: Sun, 17 Sep 2023 15:05:42 GMT
server: openresty/1.17.8.2
cache-control: no-store, no-cache, must-revalidate, no-transform
pragma: no-cache
p3p: CP="NID DSP ALL COR"
content-encoding: gzip
accept-ch: DPR, Width, Viewport-Width, Device-Memory, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List
x-cache: Miss from cloudfront
via: 1.1 1a8662d51ed58f0336021036df8bf88a.cloudfront.net (CloudFront)
x-amz-cf-pop: ARN54-C1
x-amz-cf-id: rS0TxUy70-ytQZhQNUf06AG8RnhZA6aC2Ud4cZp9jRIG9XedvwKeAw==
X-Firefox-Spdy: h2
deatchshipsmotor.com/MVBuQmZQMg0vWVBtDGQTQzxTZ1R3dVwEAkRgHjcCASMKLgtLNkAhCl4lCiQUXj4abAhUJEtwIGgEXQBQYz4vMS5JAQkWHEIKJiwSezQFJilVOwYyIVY7HgoMCB4rLD8UYiwNHlZjDQBeXx47DzJgOB0vPnUZJQlWABs3ABFEGAZzUWc5ASchaSQsIzR0NSQHVwYGCXoIZQMnJCdyaA0LHnc2CgY8BwgFMgxgPlcbJ180LCMNfGQ3ciwUYigKJHw/LBYCZwMmGy9VYDcuBXQCHxMcWTo/LF5yFCkMInU7KAkAAGVLcCBmBldyN3I3OAU1ATYPKS8JNCsAQwMSPwdLQWM/ClNnAyYbMXs3JyQvc2hdFDNWET8aU3MGJhgxfjtfDkBbIwEsFgw4XgwSWR1YLQ50aTtwMmc
200 OK 1.2 kB URL GET HTTP/2 deatchshipsmotor.com/MVBuQmZQMg0vWVBtDGQTQzxTZ1R3dVwEAkRgHjcCASMKLgtLNkAhCl4lCiQUXj4abAhUJEtwIGgEXQBQYz4vMS5JAQkWHEIKJiwSezQFJilVOwYyIVY7HgoMCB4rLD8UYiwNHlZjDQBeXx47DzJgOB0vPnUZJQlWABs3ABFEGAZzUWc5ASchaSQsIzR0NSQHVwYGCXoIZQMnJCdyaA0LHnc2CgY8BwgFMgxgPlcbJ180LCMNfGQ3ciwUYigKJHw/LBYCZwMmGy9VYDcuBXQCHxMcWTo/LF5yFCkMInU7KAkAAGVLcCBmBldyN3I3OAU1ATYPKS8JNCsAQwMSPwdLQWM/ClNnAyYbMXs3JyQvc2hdFDNWET8aU3MGJhgxfjtfDkBbIwEsFgw4XgwSWR1YLQ50aTtwMmc
IP
Requested by https://www.upload.ee/files/15695061/heg1.exe.html?msg=sess_error
Certificate IssuerAmazon
Subjectdeatchshipsmotor.com
Fingerprint9C:34:2D:04:62:30:9B:47:17:CD:C6:43:FB:50:04:74:EB:2B:63:8A
ValidityWed, 13 Sep 2023 00:00:00 GMT - Fri, 11 Oct 2024 23:59:59 GMT
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (3005), with no line terminators
Hash 2eb634149aed9537845a31b14c1504c8
5e7c5e5647eba94aadc93fc305aa73bc92a9531d
110e6fc7bfed7c6c7b9674700dbd72086f7c640f090f9b99691da2a6b4f0c56e
GET /MVBuQmZQMg0vWVBtDGQTQzxTZ1R3dVwEAkRgHjcCASMKLgtLNkAhCl4lCiQUXj4abAhUJEtwIGgEXQBQYz4vMS5JAQkWHEIKJiwSezQFJilVOwYyIVY7HgoMCB4rLD8UYiwNHlZjDQBeXx47DzJgOB0vPnUZJQlWABs3ABFEGAZzUWc5ASchaSQsIzR0NSQHVwYGCXoIZQMnJCdyaA0LHnc2CgY8BwgFMgxgPlcbJ180LCMNfGQ3ciwUYigKJHw/LBYCZwMmGy9VYDcuBXQCHxMcWTo/LF5yFCkMInU7KAkAAGVLcCBmBldyN3I3OAU1ATYPKS8JNCsAQwMSPwdLQWM/ClNnAyYbMXs3JyQvc2hdFDNWET8aU3MGJhgxfjtfDkBbIwEsFgw4XgwSWR1YLQ50aTtwMmc HTTP/1.1
Host: deatchshipsmotor.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.upload.ee/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
content-type: text/html
content-length: 1163
date: Sun, 17 Sep 2023 15:05:42 GMT
server: openresty/1.17.8.2
cache-control: no-store, no-cache, must-revalidate, no-transform
pragma: no-cache
p3p: CP="NID DSP ALL COR"
content-encoding: gzip
accept-ch: DPR, Width, Viewport-Width, Device-Memory, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List
x-cache: Miss from cloudfront
via: 1.1 1a8662d51ed58f0336021036df8bf88a.cloudfront.net (CloudFront)
x-amz-cf-pop: ARN54-C1
x-amz-cf-id: NiE0rzOytoZROAObPf264HIHhm58SssSWqoxD_0tIJbVoY5DWQu_SQ==
X-Firefox-Spdy: h2
www.upload.ee/favicon.ico
200 OK 1.2 kB URL GET HTTP/1.1 www.upload.ee/favicon.ico
IP
Requested by https://www.upload.ee/files/15695061/heg1.exe.html?msg=sess_error
Certificate IssuerDigiCert, Inc.
Subjectwww.upload.ee
Fingerprint50:32:93:34:C8:04:2F:84:49:77:0D:C4:DD:CA:79:C9:CB:3E:C0:F4
ValidityThu, 02 Mar 2023 00:00:00 GMT - Mon, 01 Apr 2024 23:59:59 GMT
File type MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel\012- data
Hash f299cf2e651c19e48d27900ced493ccb
c2d1086d517d7a26292e0d7b32da7c55b166c23b
115c8eb4840245f7aed0cb2a17fa7e91b86f79bb2f223a25af8cc533e1dedff1
GET /favicon.ico HTTP/1.1
Host: www.upload.ee
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.upload.ee/files/15695061/heg1.exe.html?msg=sess_error
Cookie: lng=eng; _ga_LT9YQX0N49=GS1.1.1694963142.1.0.1694963142.0.0.0; _ga=GA1.1.1676957659.1694963143
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Sun, 17 Sep 2023 15:05:42 GMT
Content-Type: image/x-icon
Content-Length: 1150
Last-Modified: Tue, 16 Dec 2008 17:17:25 GMT
Connection: keep-alive
Keep-Alive: timeout=20
ETag: "4947e2a5-47e"
Expires: Sun, 24 Sep 2023 15:05:42 GMT
Cache-Control: max-age=604800
Accept-Ranges: bytes
ocsp.pki.goog/gts1c3
472 B IP
Hash 50ce194ebe72fce3e26030c01f8d34ce
939dea7777d608c5bb4bd2ffe47c96f9cd41af91
b5d7f57896d8e329cbd5f2966509bf8e4556e2603662a72e72ee584763c360a5
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sun, 17 Sep 2023 15:05:42 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
ocsp.pki.goog/gts1c3
472 B IP
Hash 149a7377ce505162af15127c384d5e3b
f4bf765455a03741b3c401204af7aadc8356e4a4
f6731d465327021f3b3ced0bb1087faf90bf1d7b7619edb8b94dbf3f80fd3f43
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sun, 17 Sep 2023 15:05:42 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
accounts.google.com/ServiceLogin?passive=true&continue=https%3A%2F%2Fwww.google.com%2Ffavicon.ico&uilel=3&hl=en&service=mail
302 Found 0 B URL GET HTTP/2 accounts.google.com/ServiceLogin?passive=true&continue=https%3A%2F%2Fwww.google.com%2Ffavicon.ico&uilel=3&hl=en&service=mail
IP
Requested by https://www.upload.ee/files/15695061/heg1.exe.html?msg=sess_error
Certificate IssuerGoogle Trust Services LLC
Subjectaccounts.google.com
Fingerprint75:5C:17:06:78:FB:DD:37:D1:56:96:14:FC:26:4B:66:26:5F:D9:9D
ValidityMon, 14 Aug 2023 08:23:05 GMT - Mon, 06 Nov 2023 08:23:04 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /ServiceLogin?passive=true&continue=https%3A%2F%2Fwww.google.com%2Ffavicon.ico&uilel=3&hl=en&service=mail HTTP/1.1
Host: accounts.google.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.upload.ee/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 302 Found
content-type: application/binary
set-cookie: __Host-GAPS=1:dB3grz79qsIqDgUMMS6NwqHNhb8ILw:gh6nSZcuQ9yu527H; Expires=Tue, 16-Sep-2025 15:05:42 GMT; Path=/; Secure; HttpOnly; Priority=HIGH
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: Mon, 01 Jan 1990 00:00:00 GMT
date: Sun, 17 Sep 2023 15:05:42 GMT
location: https://accounts.google.com/InteractiveLogin?continue=https://www.google.com/favicon.ico&hl=en&passive=true&service=mail&uilel=3&ifkv=AYZoVhcAEVVuivnGUdYJD3epKKiaHV5MLsxvFZkjkEcZ_-IYX9aSq4XyHqGBtxavOCOuy6TzyTNC0g
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
content-security-policy: script-src 'nonce-ELkCF9Ne2nZYet0yEGL_4Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/AccountsSigninPassiveLoginHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/AccountsSigninPassiveLoginHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/AccountsSigninPassiveLoginHttp/cspreport
cross-origin-opener-policy: unsafe-none
server: ESF
content-length: 0
x-xss-protection: 0
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
accounts.google.com/ServiceLogin?passive=true&continue=https%3A%2F%2Fwww.youtube.com%2Ffavicon.ico&uilel=3&hl=en&service=youtube
302 Found 0 B URL GET HTTP/2 accounts.google.com/ServiceLogin?passive=true&continue=https%3A%2F%2Fwww.youtube.com%2Ffavicon.ico&uilel=3&hl=en&service=youtube
IP
Requested by https://www.upload.ee/files/15695061/heg1.exe.html?msg=sess_error
Certificate IssuerGoogle Trust Services LLC
Subjectaccounts.google.com
Fingerprint75:5C:17:06:78:FB:DD:37:D1:56:96:14:FC:26:4B:66:26:5F:D9:9D
ValidityMon, 14 Aug 2023 08:23:05 GMT - Mon, 06 Nov 2023 08:23:04 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /ServiceLogin?passive=true&continue=https%3A%2F%2Fwww.youtube.com%2Ffavicon.ico&uilel=3&hl=en&service=youtube HTTP/1.1
Host: accounts.google.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.upload.ee/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 302 Found
content-type: application/binary
set-cookie: __Host-GAPS=1:InGfJLyJgkQiD4zoBbVaEveLexJZCA:zvikaToBqf3fsa7z; Expires=Tue, 16-Sep-2025 15:05:42 GMT; Path=/; Secure; HttpOnly; Priority=HIGH
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: Mon, 01 Jan 1990 00:00:00 GMT
date: Sun, 17 Sep 2023 15:05:42 GMT
location: https://accounts.google.com/InteractiveLogin?continue=https://www.youtube.com/favicon.ico&hl=en&passive=true&service=youtube&uilel=3&ifkv=AYZoVhc4AX6lNVBeQltoSprMUdmzUTp9EHbCVZOkT-h2JFcE8lV9-igmfzIixyktifOWZ1tDQdqQhQ
strict-transport-security: max-age=31536000; includeSubDomains
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
content-security-policy: require-trusted-types-for 'script';report-uri /_/AccountsSigninPassiveLoginHttp/cspreport, script-src 'nonce-0fDFyCIY46WSyZzh7fN9yw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/AccountsSigninPassiveLoginHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/AccountsSigninPassiveLoginHttp/cspreport/allowlist
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: unsafe-none
server: ESF
content-length: 0
x-xss-protection: 0
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
deatchshipsmotor.com/utx?cb=JhT6I1PynWcU&top=www.upload.ee&tid=997369
204 No Content 0 B URL GET HTTP/2 deatchshipsmotor.com/utx?cb=JhT6I1PynWcU&top=www.upload.ee&tid=997369
IP
Requested by https://www.upload.ee/files/15695061/heg1.exe.html?msg=sess_error
Certificate IssuerAmazon
Subjectdeatchshipsmotor.com
Fingerprint9C:34:2D:04:62:30:9B:47:17:CD:C6:43:FB:50:04:74:EB:2B:63:8A
ValidityWed, 13 Sep 2023 00:00:00 GMT - Fri, 11 Oct 2024 23:59:59 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /utx?cb=JhT6I1PynWcU&top=www.upload.ee&tid=997369 HTTP/1.1
Host: deatchshipsmotor.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://www.upload.ee
DNT: 1
Connection: keep-alive
Referer: https://www.upload.ee/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 204 No Content
date: Sun, 17 Sep 2023 15:05:42 GMT
server: openresty/1.17.8.2
access-control-allow-credentials: true
access-control-allow-origin: https://www.upload.ee
cache-control: no-store, no-cache, must-revalidate, no-transform
pragma: no-cache
p3p: CP="NID DSP ALL COR"
set-cookie: ut=x; Expires=Sun, 17 Sep 2023 15:06:42 GMT; Max-Age=60
accept-ch: DPR, Width, Viewport-Width, Device-Memory, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List
x-cache: Miss from cloudfront
via: 1.1 1a8662d51ed58f0336021036df8bf88a.cloudfront.net (CloudFront)
x-amz-cf-pop: ARN54-C1
x-amz-cf-id: 7NvjlIi5BQRwFNAxXDFpqLWIqozwkZbpc2T7ocYFClGY3OVxxZyt_Q==
X-Firefox-Spdy: h2
deatchshipsmotor.com/utx?cb=6tgmRXyptRki&top=www.upload.ee&tid=997414
204 No Content 0 B URL GET HTTP/2 deatchshipsmotor.com/utx?cb=6tgmRXyptRki&top=www.upload.ee&tid=997414
IP
Requested by https://www.upload.ee/files/15695061/heg1.exe.html?msg=sess_error
Certificate IssuerAmazon
Subjectdeatchshipsmotor.com
Fingerprint9C:34:2D:04:62:30:9B:47:17:CD:C6:43:FB:50:04:74:EB:2B:63:8A
ValidityWed, 13 Sep 2023 00:00:00 GMT - Fri, 11 Oct 2024 23:59:59 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /utx?cb=6tgmRXyptRki&top=www.upload.ee&tid=997414 HTTP/1.1
Host: deatchshipsmotor.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://www.upload.ee
DNT: 1
Connection: keep-alive
Referer: https://www.upload.ee/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 204 No Content
date: Sun, 17 Sep 2023 15:05:42 GMT
server: openresty/1.17.8.2
access-control-allow-credentials: true
access-control-allow-origin: https://www.upload.ee
cache-control: no-store, no-cache, must-revalidate, no-transform
pragma: no-cache
p3p: CP="NID DSP ALL COR"
set-cookie: ut=x; Expires=Sun, 17 Sep 2023 15:06:42 GMT; Max-Age=60
accept-ch: DPR, Width, Viewport-Width, Device-Memory, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List
x-cache: Miss from cloudfront
via: 1.1 1a8662d51ed58f0336021036df8bf88a.cloudfront.net (CloudFront)
x-amz-cf-pop: ARN54-C1
x-amz-cf-id: QXxF-vakqoJC3eZsf8eV8mRsV1QJd05ExoisEWVX4aFPYXbcM0NKhg==
X-Firefox-Spdy: h2
ocsp.pki.goog/gts1c3
471 B IP
Hash d9c643fc674d6243af5ecccfb079138d
8c2ddcbe735ab7e9e54f90e2b50ec93aa84283f8
0bf4076f8f4993fad4b08a51f25a9c9241b35e2608d84bb1fa2a568017712336
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sun, 17 Sep 2023 15:05:42 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
accounts.google.com/InteractiveLogin?continue=https://www.google.com/favicon.ico&hl=en&passive=true&service=mail&uilel=3&ifkv=AYZoVhcAEVVuivnGUdYJD3epKKiaHV5MLsxvFZkjkEcZ_-IYX9aSq4XyHqGBtxavOCOuy6TzyTNC0g
302 Found 402 B URL GET HTTP/2 accounts.google.com/InteractiveLogin?continue=https://www.google.com/favicon.ico&hl=en&passive=true&service=mail&uilel=3&ifkv=AYZoVhcAEVVuivnGUdYJD3epKKiaHV5MLsxvFZkjkEcZ_-IYX9aSq4XyHqGBtxavOCOuy6TzyTNC0g
IP
Requested by https://www.upload.ee/files/15695061/heg1.exe.html?msg=sess_error
Certificate IssuerGoogle Trust Services LLC
Subjectaccounts.google.com
Fingerprint75:5C:17:06:78:FB:DD:37:D1:56:96:14:FC:26:4B:66:26:5F:D9:9D
ValidityMon, 14 Aug 2023 08:23:05 GMT - Mon, 06 Nov 2023 08:23:04 GMT
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document, ASCII text, with very long lines (396)
Hash 3ff6872608642f67da36f3a1d2131603
3839f5a6a84c6ef540175452dfda5d9672d04cf5
99f3f269c4e875b49d45bfdd27a929ac3cdc2d98bcb7b2b186eb859e8f4c924b
GET /InteractiveLogin?continue=https://www.google.com/favicon.ico&hl=en&passive=true&service=mail&uilel=3&ifkv=AYZoVhcAEVVuivnGUdYJD3epKKiaHV5MLsxvFZkjkEcZ_-IYX9aSq4XyHqGBtxavOCOuy6TzyTNC0g HTTP/1.1
Host: accounts.google.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://www.upload.ee/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 302 Found
content-type: text/html; charset=UTF-8
set-cookie: __Host-GAPS=1:rpP1PU0cDS1FHM7zSYgc3cIn4cXPHQ:mvvp4bhMF2Iv65Gm;Path=/;Expires=Tue, 16-Sep-2025 15:05:42 GMT;Secure;HttpOnly;Priority=HIGH
x-frame-options: DENY
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: Mon, 01 Jan 1990 00:00:00 GMT
date: Sun, 17 Sep 2023 15:05:42 GMT
location: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fwww.google.com%2Ffavicon.ico&hl=en&ifkv=AYZoVhe2UvOEOqeQsZ1Hw5xhnbnDLmekHA0cUq7uSMI9eODKYYdP0dhRt9xRmYFgNUN_8vokkvmL_A&passive=true&service=mail&uilel=3&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S-1039891409%3A1694963142936039&theme=glif
strict-transport-security: max-age=31536000; includeSubDomains
report-to: {"group":"coop_gse_qebhlk","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gse_qebhlk"}]}
content-security-policy: require-trusted-types-for 'script';report-uri /cspreport, script-src 'nonce-17qGp6Ed6kXfs5ATHZ_8YQ' 'unsafe-inline' 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /cspreport
cross-origin-opener-policy-report-only: same-origin; report-to="coop_gse_qebhlk"
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-length: 402
server: GSE
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
accounts.google.com/InteractiveLogin?continue=https://www.youtube.com/favicon.ico&hl=en&passive=true&service=youtube&uilel=3&ifkv=AYZoVhc4AX6lNVBeQltoSprMUdmzUTp9EHbCVZOkT-h2JFcE8lV9-igmfzIixyktifOWZ1tDQdqQhQ
302 Found 405 B URL GET HTTP/2 accounts.google.com/InteractiveLogin?continue=https://www.youtube.com/favicon.ico&hl=en&passive=true&service=youtube&uilel=3&ifkv=AYZoVhc4AX6lNVBeQltoSprMUdmzUTp9EHbCVZOkT-h2JFcE8lV9-igmfzIixyktifOWZ1tDQdqQhQ
IP
Requested by https://www.upload.ee/files/15695061/heg1.exe.html?msg=sess_error
Certificate IssuerGoogle Trust Services LLC
Subjectaccounts.google.com
Fingerprint75:5C:17:06:78:FB:DD:37:D1:56:96:14:FC:26:4B:66:26:5F:D9:9D
ValidityMon, 14 Aug 2023 08:23:05 GMT - Mon, 06 Nov 2023 08:23:04 GMT
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document, ASCII text, with very long lines (400)
Hash 81665c9cba2fdb3c7995504076292ec7
98f822e60ff299a96ccc5f244e243f295b7471f4
1c2f62d6f7c051c11867e74a37fd0c0cf0f24c9deb0a92035225e99f17dea5f4
GET /InteractiveLogin?continue=https://www.youtube.com/favicon.ico&hl=en&passive=true&service=youtube&uilel=3&ifkv=AYZoVhc4AX6lNVBeQltoSprMUdmzUTp9EHbCVZOkT-h2JFcE8lV9-igmfzIixyktifOWZ1tDQdqQhQ HTTP/1.1
Host: accounts.google.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://www.upload.ee/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 302 Found
content-type: text/html; charset=UTF-8
set-cookie: __Host-GAPS=1:C3GFGNF-ZleLUihc3tB-uGSBQpYiIQ:OJWoYx0i3UKwDkxY;Path=/;Expires=Tue, 16-Sep-2025 15:05:42 GMT;Secure;HttpOnly;Priority=HIGH
x-frame-options: DENY
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: Mon, 01 Jan 1990 00:00:00 GMT
date: Sun, 17 Sep 2023 15:05:42 GMT
location: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fwww.youtube.com%2Ffavicon.ico&hl=en&ifkv=AYZoVhfuAQ3jr_Ji4pJZ0oBH0hV4HLdWmQ7qd-hUL4GTol4N75HhEM_Af4IPThrPx5TSOMyVAGP6Bw&passive=true&service=youtube&uilel=3&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S-1090100075%3A1694963142979203&theme=glif
strict-transport-security: max-age=31536000; includeSubDomains
content-security-policy: require-trusted-types-for 'script';report-uri /cspreport, script-src 'nonce-j0bXOIuBwAkLYIAWqtbQfg' 'unsafe-inline' 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /cspreport
cross-origin-opener-policy-report-only: same-origin; report-to="coop_gse_qebhlk"
report-to: {"group":"coop_gse_qebhlk","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gse_qebhlk"}]}
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-length: 405
server: GSE
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
du0pud0sdlmzf.cloudfront.net/1dmxUY3MVAzoFTAIFMF5KT1tnVUpQBicMHQZRMlobOFsyCAQmLSxFBwwIaVNVGg06BE5QCToATkdKNQcRS1hyFwMZB2kHCwAGIRIcAxgiRQYXUTkMCR8AOAJWRCphTUNTXmRLC0ddcVAxU15kDxoYGSxGQUYUbFUsQFhxUDFTXmQRBVNfFVJDT0JkSlZEXD-MGEB0DcVE1RFxlU0NHXGVGQUYKPREWEAMsRkEwXWVSXUZKIV5C
612 B URL du0pud0sdlmzf.cloudfront.net/1dmxUY3MVAzoFTAIFMF5KT1tnVUpQBicMHQZRMlobOFsyCAQmLSxFBwwIaVNVGg06BE5QCToATkdKNQcRS1hyFwMZB2kHCwAGIRIcAxgiRQYXUTkMCR8AOAJWRCphTUNTXmRLC0ddcVAxU15kDxoYGSxGQUYUbFUsQFhxUDFTXmQRBVNfFVJDT0JkSlZEXD-MGEB0DcVE1RFxlU0NHXGVGQUYKPREWEAMsRkEwXWVSXUZKIV5C
IP
Certificate IssuerAmazon
Subject*.cloudfront.net
FingerprintBA:0F:CD:B3:EA:19:B2:9D:99:9B:51:2D:16:33:6B:D0:3F:31:A2:AB
ValidityThu, 08 Dec 2022 00:00:00 GMT - Thu, 07 Dec 2023 23:59:59 GMT
File type ASCII text, with very long lines (871), with no line terminators
Hash 4e296d6de4452ef65bb67493adc9f386
1d3e0a97432f10e520302da99eb90617ae3403c2
57a396f2d21ae06f92930cbd5902a4a629a1aafd2ac45b6f0ca39ced7638b152
GET /1dmxUY3MVAzoFTAIFMF5KT1tnVUpQBicMHQZRMlobOFsyCAQmLSxFBwwIaVNVGg06BE5QCToATkdKNQcRS1hyFwMZB2kHCwAGIRIcAxgiRQYXUTkMCR8AOAJWRCphTUNTXmRLC0ddcVAxU15kDxoYGSxGQUYUbFUsQFhxUDFTXmQRBVNfFVJDT0JkSlZEXD-MGEB0DcVE1RFxlU0NHXGVGQUYKPREWEAMsRkEwXWVSXUZKIV5C HTTP/1.1
Host: du0pud0sdlmzf.cloudfront.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://deatchshipsmotor.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
content-length: 612
date: Sun, 17 Sep 2023 15:05:43 GMT
access-control-allow-origin: *
cache-control: max-age=31556926
content-encoding: gzip
x-cache: Miss from cloudfront
via: 1.1 d4fd24ae65d4d2b97cfdea8d2f0c21a6.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-C1
x-amz-cf-id: 0B3mVeRMyOPgzNLFOED_PeRxovYziqsIDUEoAy8yIfl3q2fSIMVrGQ==
X-Firefox-Spdy: h2
du0pud0sdlmzf.cloudfront.net/DNWR6Y1JWCxQFbUENHl5rDFNOUmYTDgkMPEVZLC43BANPEhFEN1wXKFFZSkU+VAodXnRQChleYxMFHgFvAUIOEz1eWR4bJF8RCwwnQRJcFjMICRUZO1kIG0Zgc1FUU3cHVFIbYwRBSSF3B1QWCjxAHF9RYk1cTDxkAUFJIXcHVAgVdwYlS1NrG1RTRmAFAx-8AOVpBSCVgBVVKU2MFVV9RYlMNCAY0WhxfURQEVUtNYhMRR1I
568 B URL du0pud0sdlmzf.cloudfront.net/DNWR6Y1JWCxQFbUENHl5rDFNOUmYTDgkMPEVZLC43BANPEhFEN1wXKFFZSkU+VAodXnRQChleYxMFHgFvAUIOEz1eWR4bJF8RCwwnQRJcFjMICRUZO1kIG0Zgc1FUU3cHVFIbYwRBSSF3B1QWCjxAHF9RYk1cTDxkAUFJIXcHVAgVdwYlS1NrG1RTRmAFAx-8AOVpBSCVgBVVKU2MFVV9RYlMNCAY0WhxfURQEVUtNYhMRR1I
IP
Certificate IssuerAmazon
Subject*.cloudfront.net
FingerprintBA:0F:CD:B3:EA:19:B2:9D:99:9B:51:2D:16:33:6B:D0:3F:31:A2:AB
ValidityThu, 08 Dec 2022 00:00:00 GMT - Thu, 07 Dec 2023 23:59:59 GMT
File type ASCII text, with very long lines (802), with no line terminators
Hash 6b3b5639a286233b6a190dbfc3cf08c5
2ea8422975be9ce8901d149dd6c4e44395130b53
79104688f709116498b44280dda0407a4e76e1557ae3171b05221be545e15af6
GET /DNWR6Y1JWCxQFbUENHl5rDFNOUmYTDgkMPEVZLC43BANPEhFEN1wXKFFZSkU+VAodXnRQChleYxMFHgFvAUIOEz1eWR4bJF8RCwwnQRJcFjMICRUZO1kIG0Zgc1FUU3cHVFIbYwRBSSF3B1QWCjxAHF9RYk1cTDxkAUFJIXcHVAgVdwYlS1NrG1RTRmAFAx-8AOVpBSCVgBVVKU2MFVV9RYlMNCAY0WhxfURQEVUtNYhMRR1I HTTP/1.1
Host: du0pud0sdlmzf.cloudfront.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://deatchshipsmotor.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
content-length: 568
date: Sun, 17 Sep 2023 15:05:43 GMT
access-control-allow-origin: *
cache-control: max-age=31556926
content-encoding: gzip
x-cache: Miss from cloudfront
via: 1.1 d4fd24ae65d4d2b97cfdea8d2f0c21a6.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-C1
x-amz-cf-id: _hAXVOiEeWnDG1umGV1hwLNWHjbOFHiwC-eZrOhtr719Oht8GxH-xg==
X-Firefox-Spdy: h2
du0pud0sdlmzf.cloudfront.net/YT3B6RnAsHxQgTzsZHntJdkdOdkhpGgkpHj9NEnY+Oxg3cB8nNUMTQhsmXDIKK01KYBwuHh17VioeGXtBaREeJE17Vg8nTSIfAC8cIxFfdDZ6XkpjQn9YAndBakM4Y0J/HBMoBTdVSHYId0YlcERqQzhjQn8CDGNDDkFKf15/WV90QCgVGS0fakI8dEB+QE-p3QH5VSHYWJgIfIB83VUgAQX5BVHZWOk1L
198 B URL du0pud0sdlmzf.cloudfront.net/YT3B6RnAsHxQgTzsZHntJdkdOdkhpGgkpHj9NEnY+Oxg3cB8nNUMTQhsmXDIKK01KYBwuHh17VioeGXtBaREeJE17Vg8nTSIfAC8cIxFfdDZ6XkpjQn9YAndBakM4Y0J/HBMoBTdVSHYId0YlcERqQzhjQn8CDGNDDkFKf15/WV90QCgVGS0fakI8dEB+QE-p3QH5VSHYWJgIfIB83VUgAQX5BVHZWOk1L
IP
Certificate IssuerAmazon
Subject*.cloudfront.net
FingerprintBA:0F:CD:B3:EA:19:B2:9D:99:9B:51:2D:16:33:6B:D0:3F:31:A2:AB
ValidityThu, 08 Dec 2022 00:00:00 GMT - Thu, 07 Dec 2023 23:59:59 GMT
File type ASCII text, with no line terminators
Hash 547853513534e58a2d5ca227baef46bf
640bcc7b7adf5742d469103cdd0786fc721b6622
945cc979578c6ae4a66864c58b014a1638d4c44565b23039cb8297153b7cbcae
GET /YT3B6RnAsHxQgTzsZHntJdkdOdkhpGgkpHj9NEnY+Oxg3cB8nNUMTQhsmXDIKK01KYBwuHh17VioeGXtBaREeJE17Vg8nTSIfAC8cIxFfdDZ6XkpjQn9YAndBakM4Y0J/HBMoBTdVSHYId0YlcERqQzhjQn8CDGNDDkFKf15/WV90QCgVGS0fakI8dEB+QE-p3QH5VSHYWJgIfIB83VUgAQX5BVHZWOk1L HTTP/1.1
Host: du0pud0sdlmzf.cloudfront.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://deatchshipsmotor.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
content-length: 198
date: Sun, 17 Sep 2023 15:05:43 GMT
access-control-allow-origin: *
cache-control: max-age=31556926
content-encoding: gzip
x-cache: Miss from cloudfront
via: 1.1 d4fd24ae65d4d2b97cfdea8d2f0c21a6.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-C1
x-amz-cf-id: X-Dh1leCdY1wxwht8XGq_Xjxfb6AgX8jpb8R6za-MeahnmkjKnCvBA==
X-Firefox-Spdy: h2
serving.bepolite.eu/script?space=50dd7b0f-4105-441f-8f60-18cc3fcb090c&type=direct&page_id=6934686&screen_width=1280&screen_height=1024&os=Linux%20x86_64&refurl=https%3A%2F%2Fwww.upload.ee%2Fdownload%2F15695061%2F5d6d22946fdd1d8dad4b%2Fheg1.exe&pageurl=https%3A%2F%2Fwww.upload.ee%2Ffiles%2F15695061%2Fheg1.exe.html%3Fmsg%3Dsess_error&rnd=1694963142320
1.4 kB URL GET serving.bepolite.eu/script?space=50dd7b0f-4105-441f-8f60-18cc3fcb090c&type=direct&page_id=6934686&screen_width=1280&screen_height=1024&os=Linux%20x86_64&refurl=https%3A%2F%2Fwww.upload.ee%2Fdownload%2F15695061%2F5d6d22946fdd1d8dad4b%2Fheg1.exe&pageurl=https%3A%2F%2Fwww.upload.ee%2Ffiles%2F15695061%2Fheg1.exe.html%3Fmsg%3Dsess_error&rnd=1694963142320
IP
ASN #3327 CITIC Telecom CPC Netherlands B.V.
Requested by https://www.upload.ee/files/15695061/heg1.exe.html?msg=sess_error
Certificate IssuerLet's Encrypt
Subjectstatic.bepolite.eu
FingerprintB7:1B:BB:35:5B:E5:6E:92:4D:DE:79:2E:0E:C8:1F:0D:CE:28:88:FD
ValidityMon, 04 Sep 2023 21:06:47 GMT - Sun, 03 Dec 2023 21:06:46 GMT
File type ASCII text, with very long lines (394)
Hash a1dc3f1f09dd556fe7b9b8434e8ffd02
8ed78275440c65a8339867cb86e17e0f0db33ff9
815664714437c39052ba657cc023ce888da3b75ac1cc1f5e88a90dce80c428ea
GET /script?space=50dd7b0f-4105-441f-8f60-18cc3fcb090c&type=direct&page_id=6934686&screen_width=1280&screen_height=1024&os=Linux%20x86_64&refurl=https%3A%2F%2Fwww.upload.ee%2Fdownload%2F15695061%2F5d6d22946fdd1d8dad4b%2Fheg1.exe&pageurl=https%3A%2F%2Fwww.upload.ee%2Ffiles%2F15695061%2Fheg1.exe.html%3Fmsg%3Dsess_error&rnd=1694963142320 HTTP/1.1
Host: serving.bepolite.eu
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.upload.ee/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
cache-control: private, must-revalidate, max-age=0
vary: accept-encoding
content-encoding: gzip
content-type: text/plain;charset=ISO-8859-1
date: Sun, 17 Sep 2023 14:57:50 GMT
set-cookie: bepolite_id=929806dd6c42aecd910bcbddad809e46; Max-Age=7776000; Expires=Sat, 16-Dec-2023 14:57:50 GMT; SameSite=None; Secure
p3p: CP='BePolite does not have a P3P policy'
x-varnish: 439891384
age: 0
accept-ranges: bytes
content-length: 1447
X-Firefox-Spdy: h2
pogothere.xyz/
200 OK 178 kB IP
Requested by https://www.upload.ee/files/15695061/heg1.exe.html?msg=sess_error
Certificate IssuerCloudflare, Inc.
Subjectsni.cloudflaressl.com
Fingerprint17:F9:2D:6F:B5:5E:5F:37:A6:FB:BE:61:4F:97:64:33:85:5C:3A:FB
ValidityTue, 28 Feb 2023 00:00:00 GMT - Tue, 27 Feb 2024 23:59:59 GMT
File type ASCII text, with no line terminators
Size 178 kB (177844 bytes)
Hash fdc701a26211c8291c17fe1441b8f138
f165266b9be07be027a026c84eac80f689ff2d1c
737be85c0c7ec99e8071c5e3de07a0f05bfe078123c5eae10101ad004ecf4670
GET / HTTP/1.1
Host: pogothere.xyz
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://www.upload.ee/
Origin: https://www.upload.ee
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Sun, 17 Sep 2023 15:05:42 GMT
content-type: text/plain
set-cookie: csu=1723223550900606@1@1694963142; Max-Age=31104000; Secure; SameSite=None
access-control-allow-origin: https://www.upload.ee
access-control-allow-credentials: true
access-control-allow-methods: GET
access-control-allow-headers: X-Requested-With, content-type
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=1emmzVR0uRYT5gumdZ0akV%2FXDjr7cgwyWK%2BxFHLKSssw%2BPKs9rT7EEj9b8F8442LtS%2BxofLQgASU1MjnpcDZ0h1fVttxQFJ38VQibQ4q%2BbFngX8aIe%2FNdjBASXnO6jTX"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 80823fbb0f1648cd-LHR
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
ocsp.r2m02.amazontrust.com/
471 B URL ocsp.r2m02.amazontrust.com/
IP
Hash a193f568444042cc977640b8646efa32
55e6e0fb1a7e2ee5eeeee1976e915a867c2fccfa
7c6e8eaed5bcc49183add7a21dc00bbd8e3b99f54077f26c012c874d0d7a5229
POST / HTTP/1.1
Host: ocsp.r2m02.amazontrust.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Content-Length: 471
Connection: keep-alive
Accept-Ranges: bytes
Cache-Control: max-age=7200
Date: Sun, 17 Sep 2023 15:05:44 GMT
Last-Modified: Sun, 17 Sep 2023 13:35:44 GMT
Server: ECAcc (ska/F749)
X-Cache: Miss from cloudfront
Via: 1.1 0f31cf94bd251bd501ac532dacb719fe.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: ARN56-P2
X-Amz-Cf-Id: FNRrsIcanis_ypIT2B9bNs2AXch3V_-sTLnWMmW_OPTurR5stPTqxA==
Age: 5400
ocsp.r2m02.amazontrust.com/
471 B URL ocsp.r2m02.amazontrust.com/
IP
Hash a193f568444042cc977640b8646efa32
55e6e0fb1a7e2ee5eeeee1976e915a867c2fccfa
7c6e8eaed5bcc49183add7a21dc00bbd8e3b99f54077f26c012c874d0d7a5229
POST / HTTP/1.1
Host: ocsp.r2m02.amazontrust.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Content-Length: 471
Connection: keep-alive
Accept-Ranges: bytes
Cache-Control: max-age=7200
Date: Sun, 17 Sep 2023 15:05:44 GMT
Last-Modified: Sun, 17 Sep 2023 14:36:16 GMT
Server: ECAcc (ska/F6A0)
X-Cache: Miss from cloudfront
Via: 1.1 b301fa8d72072cc0289eb055d8389e68.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: ARN56-P2
X-Amz-Cf-Id: n3xcXfG9XDtq6paWTlxmixhQRB5zV9KNEp_LIOeF4RE3vf0Ply_fQA==
Age: 1768
banner.hookusbookus.com/config/config.js?v=1
200 OK 75 B URL GET HTTP/2 banner.hookusbookus.com/config/config.js?v=1
IP
Requested by https://banner.hookusbookus.com/index_300x600.html?language=et_ee&utmSource=allmedia&click_url=https%3A%2F%2Fserving.bepolite.eu%2Fevent%3Fkey%3DFYFWuDany3hwv6rfuoAYF93T_QRJ2hBZwmsMl3Whl_99ix5uY53jsKJJwc1ygGrsJod2k2p7ECyT7Xf8GZjjJQ3JhI1rZetSRMPn9hvkuS6U77_5qqmjl-sQxYFvVV5P_lO51mNc3a12xtzS21jn071PaUfEhNNCxerdZWPZj93zp3ZdgWtH0MKue5p5AGKHXJxXiVJEh1Vfgxn38rgFo-tSrOiriedI-Oi3R5i8w-2KEKyCRIfPP1ktkR_a1xBEN4Mp3hCHV2gL5wIlp7AQSx5xbztKZEP3IVdh-WxRkrPa5hY8OvOxWaQQS9P0iYfnngZXtFEp1ljuqs475VAp1Q%26clink%3Dhttp%253A%252F%252Fsmartad.ee&dynamic_url=https%3A%2F%2Fserving.bepolite.eu%2Fevent%3Fkey%3DFYFWuDany3hwv6rfuoAYF93T_QRJ2hBZwmsMl3Whl_99ix5uY53jsKJJwc1ygGrsJod2k2p7ECyT7Xf8GZjjJQ3JhI1rZetSRMPn9hvkuS6U77_5qqmjl-sQxYFvVV5P_lO51mNc3a12xtzS21jn071PaUfEhNNCxerdZWPZj93zp3ZdgWtH0MKue5p5AGKHXJxXiVJEh1Vfgxn38rgFo-tSrOiriedI-Oi3R5i8w-2KEKyCRIfPP1ktkR_a1xBEN4Mp3hCHV2gL5wIlp7AQSx5xbztKZEP3IVdh-WxRkrPa5hY8OvOxWaQQS9P0iYfnngZXtFEp1ljuqs475VAp1Q%26clink%3D&f=https%3A%2F%2Fbanner.hookusbookus.com%2Findex_300x600.html%3Flanguage%3Det_ee%26utmSource%3Dallmedia&clink=https%3A%2F%2Fsmartad.ee&banner_id=3b881495c84042deb0d0288185da231350dd7b0f4105441f8f6018cc3fcb090c&bg=black&w=300&h=600&locale=Display%20Estonia-EST&info=https%3A%2F%2Fdigital.tv3.ee%2Fbepolite-id%2F%3Futm_src%3Dbanner
Certificate IssuerAmazon
Subject*.hookusbookus.com
FingerprintCD:CD:3C:03:66:21:F8:A9:21:BC:F8:C8:3C:DC:88:0A:C5:19:F1:7A
ValiditySun, 07 May 2023 00:00:00 GMT - Tue, 04 Jun 2024 23:59:59 GMT
Hash ee16e21326dec006274a554647c4d759
8e4389c35e12ea6d1e4d7214c174fda343047865
5ccb649c18765165e7128191ea14ab53d8de87d6ad7eea29328b681d455d7a4f
GET /config/config.js?v=1 HTTP/1.1
Host: banner.hookusbookus.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://banner.hookusbookus.com/index_1000x200.html?language=et_ee&utmSource=allmedia&click_url=https%3A%2F%2Fserving.bepolite.eu%2Fevent%3Fkey%3DFYFWuDany3hwv6rfuoAYF93T_QRJ2hBZwmsMl3Whl_99ix5uY53jsKJJwc1ygGrsJod2k2p7ECyT7Xf8GZjjJQ3JhI1rZetSRMPn9hvkuS6U77_5qqmjl-sQxYFvVV5P_lO51mNc3a12xtzS21jn071PaUfEhNNCxerdZWPZj93zp3ZdgWtH0MKue5p5AGKHXJxXiVJEh1Vfgxn38rgFo-tSrOiriedI-Oi3R5i8w-3Nph6AhIbGKPDtMF7YPxkDU4_Ogio8x-bd6qxktBd7cU06ZH0Tqu0wnEKgeSbUH3La5hY8OvOxWaQQS9P0iYfnngZXtFEp1ljuqs475VAp1Q%26clink%3Dhttp%253A%252F%252Fsmartad.ee&dynamic_url=https%3A%2F%2Fserving.bepolite.eu%2Fevent%3Fkey%3DFYFWuDany3hwv6rfuoAYF93T_QRJ2hBZwmsMl3Whl_99ix5uY53jsKJJwc1ygGrsJod2k2p7ECyT7Xf8GZjjJQ3JhI1rZetSRMPn9hvkuS6U77_5qqmjl-sQxYFvVV5P_lO51mNc3a12xtzS21jn071PaUfEhNNCxerdZWPZj93zp3ZdgWtH0MKue5p5AGKHXJxXiVJEh1Vfgxn38rgFo-tSrOiriedI-Oi3R5i8w-3Nph6AhIbGKPDtMF7YPxkDU4_Ogio8x-bd6qxktBd7cU06ZH0Tqu0wnEKgeSbUH3La5hY8OvOxWaQQS9P0iYfnngZXtFEp1ljuqs475VAp1Q%26clink%3D&f=https%3A%2F%2Fbanner.hookusbookus.com%2Findex_1000x200.html%3Flanguage%3Det_ee%26utmSource%3Dallmedia&clink=https%3A%2F%2Fsmartad.ee&banner_id=2b832712c40e4d1885d21996092d5e9350dd7b0f4105441f8f6018cc3fcb090c&bg=transparent&w=1000&h=200&locale=Display%20Estonia-EST&info=https%3A%2F%2Fdigital.tv3.ee%2Fbepolite-id%2F%3Futm_src%3Dbanner
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
date: Sun, 17 Sep 2023 15:05:44 GMT
content-type: application/javascript
content-length: 75
server: nginx/1.15.12
last-modified: Tue, 24 Jan 2023 14:19:47 GMT
etag: "63cfe903-4b"
accept-ranges: bytes
X-Firefox-Spdy: h2
banner.hookusbookus.com/config/config.js?v=1
200 OK 75 B URL GET HTTP/2 banner.hookusbookus.com/config/config.js?v=1
IP
Requested by https://banner.hookusbookus.com/index_300x600.html?language=et_ee&utmSource=allmedia&click_url=https%3A%2F%2Fserving.bepolite.eu%2Fevent%3Fkey%3DFYFWuDany3hwv6rfuoAYF93T_QRJ2hBZwmsMl3Whl_99ix5uY53jsKJJwc1ygGrsJod2k2p7ECyT7Xf8GZjjJQ3JhI1rZetSRMPn9hvkuS6U77_5qqmjl-sQxYFvVV5P_lO51mNc3a12xtzS21jn071PaUfEhNNCxerdZWPZj93zp3ZdgWtH0MKue5p5AGKHXJxXiVJEh1Vfgxn38rgFo-tSrOiriedI-Oi3R5i8w-2KEKyCRIfPP1ktkR_a1xBEN4Mp3hCHV2gL5wIlp7AQSx5xbztKZEP3IVdh-WxRkrPa5hY8OvOxWaQQS9P0iYfnngZXtFEp1ljuqs475VAp1Q%26clink%3Dhttp%253A%252F%252Fsmartad.ee&dynamic_url=https%3A%2F%2Fserving.bepolite.eu%2Fevent%3Fkey%3DFYFWuDany3hwv6rfuoAYF93T_QRJ2hBZwmsMl3Whl_99ix5uY53jsKJJwc1ygGrsJod2k2p7ECyT7Xf8GZjjJQ3JhI1rZetSRMPn9hvkuS6U77_5qqmjl-sQxYFvVV5P_lO51mNc3a12xtzS21jn071PaUfEhNNCxerdZWPZj93zp3ZdgWtH0MKue5p5AGKHXJxXiVJEh1Vfgxn38rgFo-tSrOiriedI-Oi3R5i8w-2KEKyCRIfPP1ktkR_a1xBEN4Mp3hCHV2gL5wIlp7AQSx5xbztKZEP3IVdh-WxRkrPa5hY8OvOxWaQQS9P0iYfnngZXtFEp1ljuqs475VAp1Q%26clink%3D&f=https%3A%2F%2Fbanner.hookusbookus.com%2Findex_300x600.html%3Flanguage%3Det_ee%26utmSource%3Dallmedia&clink=https%3A%2F%2Fsmartad.ee&banner_id=3b881495c84042deb0d0288185da231350dd7b0f4105441f8f6018cc3fcb090c&bg=black&w=300&h=600&locale=Display%20Estonia-EST&info=https%3A%2F%2Fdigital.tv3.ee%2Fbepolite-id%2F%3Futm_src%3Dbanner
Certificate IssuerAmazon
Subject*.hookusbookus.com
FingerprintCD:CD:3C:03:66:21:F8:A9:21:BC:F8:C8:3C:DC:88:0A:C5:19:F1:7A
ValiditySun, 07 May 2023 00:00:00 GMT - Tue, 04 Jun 2024 23:59:59 GMT
Hash ee16e21326dec006274a554647c4d759
8e4389c35e12ea6d1e4d7214c174fda343047865
5ccb649c18765165e7128191ea14ab53d8de87d6ad7eea29328b681d455d7a4f
GET /config/config.js?v=1 HTTP/1.1
Host: banner.hookusbookus.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://banner.hookusbookus.com/index_300x600.html?language=et_ee&utmSource=allmedia&click_url=https%3A%2F%2Fserving.bepolite.eu%2Fevent%3Fkey%3DFYFWuDany3hwv6rfuoAYF93T_QRJ2hBZwmsMl3Whl_99ix5uY53jsKJJwc1ygGrsJod2k2p7ECyT7Xf8GZjjJQ3JhI1rZetSRMPn9hvkuS6U77_5qqmjl-sQxYFvVV5P_lO51mNc3a12xtzS21jn071PaUfEhNNCxerdZWPZj93zp3ZdgWtH0MKue5p5AGKHXJxXiVJEh1Vfgxn38rgFo-tSrOiriedI-Oi3R5i8w-2KEKyCRIfPP1ktkR_a1xBEN4Mp3hCHV2gL5wIlp7AQSx5xbztKZEP3IVdh-WxRkrPa5hY8OvOxWaQQS9P0iYfnngZXtFEp1ljuqs475VAp1Q%26clink%3Dhttp%253A%252F%252Fsmartad.ee&dynamic_url=https%3A%2F%2Fserving.bepolite.eu%2Fevent%3Fkey%3DFYFWuDany3hwv6rfuoAYF93T_QRJ2hBZwmsMl3Whl_99ix5uY53jsKJJwc1ygGrsJod2k2p7ECyT7Xf8GZjjJQ3JhI1rZetSRMPn9hvkuS6U77_5qqmjl-sQxYFvVV5P_lO51mNc3a12xtzS21jn071PaUfEhNNCxerdZWPZj93zp3ZdgWtH0MKue5p5AGKHXJxXiVJEh1Vfgxn38rgFo-tSrOiriedI-Oi3R5i8w-2KEKyCRIfPP1ktkR_a1xBEN4Mp3hCHV2gL5wIlp7AQSx5xbztKZEP3IVdh-WxRkrPa5hY8OvOxWaQQS9P0iYfnngZXtFEp1ljuqs475VAp1Q%26clink%3D&f=https%3A%2F%2Fbanner.hookusbookus.com%2Findex_300x600.html%3Flanguage%3Det_ee%26utmSource%3Dallmedia&clink=https%3A%2F%2Fsmartad.ee&banner_id=3b881495c84042deb0d0288185da231350dd7b0f4105441f8f6018cc3fcb090c&bg=black&w=300&h=600&locale=Display%20Estonia-EST&info=https%3A%2F%2Fdigital.tv3.ee%2Fbepolite-id%2F%3Futm_src%3Dbanner
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
date: Sun, 17 Sep 2023 15:05:44 GMT
content-type: application/javascript
content-length: 75
server: nginx/1.15.12
last-modified: Tue, 24 Jan 2023 14:19:47 GMT
etag: "63cfe903-4b"
accept-ranges: bytes
X-Firefox-Spdy: h2
banner.hookusbookus.com/assets/image/prices-bg-3.png
200 OK 2.4 kB URL GET HTTP/2 banner.hookusbookus.com/assets/image/prices-bg-3.png
IP
Requested by https://banner.hookusbookus.com/index_1000x200.html?language=et_ee&utmSource=allmedia&click_url=https%3A%2F%2Fserving.bepolite.eu%2Fevent%3Fkey%3DFYFWuDany3hwv6rfuoAYF93T_QRJ2hBZwmsMl3Whl_99ix5uY53jsKJJwc1ygGrsJod2k2p7ECyT7Xf8GZjjJQ3JhI1rZetSRMPn9hvkuS6U77_5qqmjl-sQxYFvVV5P_lO51mNc3a12xtzS21jn071PaUfEhNNCxerdZWPZj93zp3ZdgWtH0MKue5p5AGKHXJxXiVJEh1Vfgxn38rgFo-tSrOiriedI-Oi3R5i8w-3Nph6AhIbGKPDtMF7YPxkDU4_Ogio8x-bd6qxktBd7cU06ZH0Tqu0wnEKgeSbUH3La5hY8OvOxWaQQS9P0iYfnngZXtFEp1ljuqs475VAp1Q%26clink%3Dhttp%253A%252F%252Fsmartad.ee&dynamic_url=https%3A%2F%2Fserving.bepolite.eu%2Fevent%3Fkey%3DFYFWuDany3hwv6rfuoAYF93T_QRJ2hBZwmsMl3Whl_99ix5uY53jsKJJwc1ygGrsJod2k2p7ECyT7Xf8GZjjJQ3JhI1rZetSRMPn9hvkuS6U77_5qqmjl-sQxYFvVV5P_lO51mNc3a12xtzS21jn071PaUfEhNNCxerdZWPZj93zp3ZdgWtH0MKue5p5AGKHXJxXiVJEh1Vfgxn38rgFo-tSrOiriedI-Oi3R5i8w-3Nph6AhIbGKPDtMF7YPxkDU4_Ogio8x-bd6qxktBd7cU06ZH0Tqu0wnEKgeSbUH3La5hY8OvOxWaQQS9P0iYfnngZXtFEp1ljuqs475VAp1Q%26clink%3D&f=https%3A%2F%2Fbanner.hookusbookus.com%2Findex_1000x200.html%3Flanguage%3Det_ee%26utmSource%3Dallmedia&clink=https%3A%2F%2Fsmartad.ee&banner_id=2b832712c40e4d1885d21996092d5e9350dd7b0f4105441f8f6018cc3fcb090c&bg=transparent&w=1000&h=200&locale=Display%20Estonia-EST&info=https%3A%2F%2Fdigital.tv3.ee%2Fbepolite-id%2F%3Futm_src%3Dbanner
Certificate IssuerAmazon
Subject*.hookusbookus.com
FingerprintCD:CD:3C:03:66:21:F8:A9:21:BC:F8:C8:3C:DC:88:0A:C5:19:F1:7A
ValiditySun, 07 May 2023 00:00:00 GMT - Tue, 04 Jun 2024 23:59:59 GMT
File type PNG image data, 250 x 118, 8-bit/color RGBA, non-interlaced\012- data
Hash ef56eff9c1246b25c0088c156116ae05
21f5a8245443365c960a196d005277a3c5ef4709
be624625b85909d1b549672c0a13b167751f842e035c3156f1d5e4a1b677ce54
GET /assets/image/prices-bg-3.png HTTP/1.1
Host: banner.hookusbookus.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://banner.hookusbookus.com/assets/css/index_1000x200.css
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
date: Sun, 17 Sep 2023 15:05:44 GMT
content-type: image/png
content-length: 2442
server: nginx/1.15.12
last-modified: Thu, 22 Apr 2021 07:20:15 GMT
etag: "608123af-98a"
accept-ranges: bytes
X-Firefox-Spdy: h2
banner.hookusbookus.com/assets/fonts/greycliff-cf-regular.woff
200 OK 53 kB URL GET HTTP/2 banner.hookusbookus.com/assets/fonts/greycliff-cf-regular.woff
IP
Requested by https://banner.hookusbookus.com/index_1000x200.html?language=et_ee&utmSource=allmedia&click_url=https%3A%2F%2Fserving.bepolite.eu%2Fevent%3Fkey%3DFYFWuDany3hwv6rfuoAYF93T_QRJ2hBZwmsMl3Whl_99ix5uY53jsKJJwc1ygGrsJod2k2p7ECyT7Xf8GZjjJQ3JhI1rZetSRMPn9hvkuS6U77_5qqmjl-sQxYFvVV5P_lO51mNc3a12xtzS21jn071PaUfEhNNCxerdZWPZj93zp3ZdgWtH0MKue5p5AGKHXJxXiVJEh1Vfgxn38rgFo-tSrOiriedI-Oi3R5i8w-3Nph6AhIbGKPDtMF7YPxkDU4_Ogio8x-bd6qxktBd7cU06ZH0Tqu0wnEKgeSbUH3La5hY8OvOxWaQQS9P0iYfnngZXtFEp1ljuqs475VAp1Q%26clink%3Dhttp%253A%252F%252Fsmartad.ee&dynamic_url=https%3A%2F%2Fserving.bepolite.eu%2Fevent%3Fkey%3DFYFWuDany3hwv6rfuoAYF93T_QRJ2hBZwmsMl3Whl_99ix5uY53jsKJJwc1ygGrsJod2k2p7ECyT7Xf8GZjjJQ3JhI1rZetSRMPn9hvkuS6U77_5qqmjl-sQxYFvVV5P_lO51mNc3a12xtzS21jn071PaUfEhNNCxerdZWPZj93zp3ZdgWtH0MKue5p5AGKHXJxXiVJEh1Vfgxn38rgFo-tSrOiriedI-Oi3R5i8w-3Nph6AhIbGKPDtMF7YPxkDU4_Ogio8x-bd6qxktBd7cU06ZH0Tqu0wnEKgeSbUH3La5hY8OvOxWaQQS9P0iYfnngZXtFEp1ljuqs475VAp1Q%26clink%3D&f=https%3A%2F%2Fbanner.hookusbookus.com%2Findex_1000x200.html%3Flanguage%3Det_ee%26utmSource%3Dallmedia&clink=https%3A%2F%2Fsmartad.ee&banner_id=2b832712c40e4d1885d21996092d5e9350dd7b0f4105441f8f6018cc3fcb090c&bg=transparent&w=1000&h=200&locale=Display%20Estonia-EST&info=https%3A%2F%2Fdigital.tv3.ee%2Fbepolite-id%2F%3Futm_src%3Dbanner
Certificate IssuerAmazon
Subject*.hookusbookus.com
FingerprintCD:CD:3C:03:66:21:F8:A9:21:BC:F8:C8:3C:DC:88:0A:C5:19:F1:7A
ValiditySun, 07 May 2023 00:00:00 GMT - Tue, 04 Jun 2024 23:59:59 GMT
File type Web Open Font Format, TrueType, length 53104, version 1.500\012- data
Hash 4f5975fe17a8ca74963be0165ff6a443
4bca2ab6c3da2b6ae09602601adeac22e7a90381
5b8f98e0c93afef19bd64c3dea2a16d60dc1574e5a4a79b788ef03b9eb3c22df
GET /assets/fonts/greycliff-cf-regular.woff HTTP/1.1
Host: banner.hookusbookus.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
DNT: 1
Connection: keep-alive
Referer: https://banner.hookusbookus.com/assets/css/index_300x600.css
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
date: Sun, 17 Sep 2023 15:05:44 GMT
content-type: font/woff
content-length: 53104
server: nginx/1.15.12
last-modified: Thu, 22 Apr 2021 07:20:15 GMT
etag: "608123af-cf70"
accept-ranges: bytes
X-Firefox-Spdy: h2
banner.hookusbookus.com/assets/fonts/greycliff-cf-bold.woff
200 OK 53 kB URL GET HTTP/2 banner.hookusbookus.com/assets/fonts/greycliff-cf-bold.woff
IP
Requested by https://banner.hookusbookus.com/index_300x600.html?language=et_ee&utmSource=allmedia&click_url=https%3A%2F%2Fserving.bepolite.eu%2Fevent%3Fkey%3DFYFWuDany3hwv6rfuoAYF93T_QRJ2hBZwmsMl3Whl_99ix5uY53jsKJJwc1ygGrsJod2k2p7ECyT7Xf8GZjjJQ3JhI1rZetSRMPn9hvkuS6U77_5qqmjl-sQxYFvVV5P_lO51mNc3a12xtzS21jn071PaUfEhNNCxerdZWPZj93zp3ZdgWtH0MKue5p5AGKHXJxXiVJEh1Vfgxn38rgFo-tSrOiriedI-Oi3R5i8w-2KEKyCRIfPP1ktkR_a1xBEN4Mp3hCHV2gL5wIlp7AQSx5xbztKZEP3IVdh-WxRkrPa5hY8OvOxWaQQS9P0iYfnngZXtFEp1ljuqs475VAp1Q%26clink%3Dhttp%253A%252F%252Fsmartad.ee&dynamic_url=https%3A%2F%2Fserving.bepolite.eu%2Fevent%3Fkey%3DFYFWuDany3hwv6rfuoAYF93T_QRJ2hBZwmsMl3Whl_99ix5uY53jsKJJwc1ygGrsJod2k2p7ECyT7Xf8GZjjJQ3JhI1rZetSRMPn9hvkuS6U77_5qqmjl-sQxYFvVV5P_lO51mNc3a12xtzS21jn071PaUfEhNNCxerdZWPZj93zp3ZdgWtH0MKue5p5AGKHXJxXiVJEh1Vfgxn38rgFo-tSrOiriedI-Oi3R5i8w-2KEKyCRIfPP1ktkR_a1xBEN4Mp3hCHV2gL5wIlp7AQSx5xbztKZEP3IVdh-WxRkrPa5hY8OvOxWaQQS9P0iYfnngZXtFEp1ljuqs475VAp1Q%26clink%3D&f=https%3A%2F%2Fbanner.hookusbookus.com%2Findex_300x600.html%3Flanguage%3Det_ee%26utmSource%3Dallmedia&clink=https%3A%2F%2Fsmartad.ee&banner_id=3b881495c84042deb0d0288185da231350dd7b0f4105441f8f6018cc3fcb090c&bg=black&w=300&h=600&locale=Display%20Estonia-EST&info=https%3A%2F%2Fdigital.tv3.ee%2Fbepolite-id%2F%3Futm_src%3Dbanner
Certificate IssuerAmazon
Subject*.hookusbookus.com
FingerprintCD:CD:3C:03:66:21:F8:A9:21:BC:F8:C8:3C:DC:88:0A:C5:19:F1:7A
ValiditySun, 07 May 2023 00:00:00 GMT - Tue, 04 Jun 2024 23:59:59 GMT
File type Web Open Font Format, TrueType, length 53208, version 1.500\012- data
Hash c03dece8ec0635406a35b888337dca8f
b72706815dccadd44dba1693ed8865b41782b14f
092416b2a5cbe9f6596ff7ee177db702262c64326231a3664a34a65c861601b1
GET /assets/fonts/greycliff-cf-bold.woff HTTP/1.1
Host: banner.hookusbookus.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
DNT: 1
Connection: keep-alive
Referer: https://banner.hookusbookus.com/assets/css/index_300x600.css
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
date: Sun, 17 Sep 2023 15:05:44 GMT
content-type: font/woff
content-length: 53208
server: nginx/1.15.12
last-modified: Thu, 22 Apr 2021 07:20:15 GMT
etag: "608123af-cfd8"
accept-ranges: bytes
X-Firefox-Spdy: h2
banner.hookusbookus.com/assets/js/jquery.min.js
200 OK 84 kB URL GET HTTP/2 banner.hookusbookus.com/assets/js/jquery.min.js
IP
Requested by https://banner.hookusbookus.com/index_300x600.html?language=et_ee&utmSource=allmedia&click_url=https%3A%2F%2Fserving.bepolite.eu%2Fevent%3Fkey%3DFYFWuDany3hwv6rfuoAYF93T_QRJ2hBZwmsMl3Whl_99ix5uY53jsKJJwc1ygGrsJod2k2p7ECyT7Xf8GZjjJQ3JhI1rZetSRMPn9hvkuS6U77_5qqmjl-sQxYFvVV5P_lO51mNc3a12xtzS21jn071PaUfEhNNCxerdZWPZj93zp3ZdgWtH0MKue5p5AGKHXJxXiVJEh1Vfgxn38rgFo-tSrOiriedI-Oi3R5i8w-2KEKyCRIfPP1ktkR_a1xBEN4Mp3hCHV2gL5wIlp7AQSx5xbztKZEP3IVdh-WxRkrPa5hY8OvOxWaQQS9P0iYfnngZXtFEp1ljuqs475VAp1Q%26clink%3Dhttp%253A%252F%252Fsmartad.ee&dynamic_url=https%3A%2F%2Fserving.bepolite.eu%2Fevent%3Fkey%3DFYFWuDany3hwv6rfuoAYF93T_QRJ2hBZwmsMl3Whl_99ix5uY53jsKJJwc1ygGrsJod2k2p7ECyT7Xf8GZjjJQ3JhI1rZetSRMPn9hvkuS6U77_5qqmjl-sQxYFvVV5P_lO51mNc3a12xtzS21jn071PaUfEhNNCxerdZWPZj93zp3ZdgWtH0MKue5p5AGKHXJxXiVJEh1Vfgxn38rgFo-tSrOiriedI-Oi3R5i8w-2KEKyCRIfPP1ktkR_a1xBEN4Mp3hCHV2gL5wIlp7AQSx5xbztKZEP3IVdh-WxRkrPa5hY8OvOxWaQQS9P0iYfnngZXtFEp1ljuqs475VAp1Q%26clink%3D&f=https%3A%2F%2Fbanner.hookusbookus.com%2Findex_300x600.html%3Flanguage%3Det_ee%26utmSource%3Dallmedia&clink=https%3A%2F%2Fsmartad.ee&banner_id=3b881495c84042deb0d0288185da231350dd7b0f4105441f8f6018cc3fcb090c&bg=black&w=300&h=600&locale=Display%20Estonia-EST&info=https%3A%2F%2Fdigital.tv3.ee%2Fbepolite-id%2F%3Futm_src%3Dbanner
Certificate IssuerAmazon
Subject*.hookusbookus.com
FingerprintCD:CD:3C:03:66:21:F8:A9:21:BC:F8:C8:3C:DC:88:0A:C5:19:F1:7A
ValiditySun, 07 May 2023 00:00:00 GMT - Tue, 04 Jun 2024 23:59:59 GMT
File type gzip compressed data, from Unix\012- data
Hash 0916059107c0f58599101f895170bff8
46ec4413262e861f4ec1de96c6a677ff2734064d
7885bf57f3c92cab8c85714717e0eee788ca93008abaaee93ed3d0481825ca3b
GET /assets/js/jquery.min.js HTTP/1.1
Host: banner.hookusbookus.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://banner.hookusbookus.com/index_300x600.html?language=et_ee&utmSource=allmedia&click_url=https%3A%2F%2Fserving.bepolite.eu%2Fevent%3Fkey%3DFYFWuDany3hwv6rfuoAYF93T_QRJ2hBZwmsMl3Whl_99ix5uY53jsKJJwc1ygGrsJod2k2p7ECyT7Xf8GZjjJQ3JhI1rZetSRMPn9hvkuS6U77_5qqmjl-sQxYFvVV5P_lO51mNc3a12xtzS21jn071PaUfEhNNCxerdZWPZj93zp3ZdgWtH0MKue5p5AGKHXJxXiVJEh1Vfgxn38rgFo-tSrOiriedI-Oi3R5i8w-2KEKyCRIfPP1ktkR_a1xBEN4Mp3hCHV2gL5wIlp7AQSx5xbztKZEP3IVdh-WxRkrPa5hY8OvOxWaQQS9P0iYfnngZXtFEp1ljuqs475VAp1Q%26clink%3Dhttp%253A%252F%252Fsmartad.ee&dynamic_url=https%3A%2F%2Fserving.bepolite.eu%2Fevent%3Fkey%3DFYFWuDany3hwv6rfuoAYF93T_QRJ2hBZwmsMl3Whl_99ix5uY53jsKJJwc1ygGrsJod2k2p7ECyT7Xf8GZjjJQ3JhI1rZetSRMPn9hvkuS6U77_5qqmjl-sQxYFvVV5P_lO51mNc3a12xtzS21jn071PaUfEhNNCxerdZWPZj93zp3ZdgWtH0MKue5p5AGKHXJxXiVJEh1Vfgxn38rgFo-tSrOiriedI-Oi3R5i8w-2KEKyCRIfPP1ktkR_a1xBEN4Mp3hCHV2gL5wIlp7AQSx5xbztKZEP3IVdh-WxRkrPa5hY8OvOxWaQQS9P0iYfnngZXtFEp1ljuqs475VAp1Q%26clink%3D&f=https%3A%2F%2Fbanner.hookusbookus.com%2Findex_300x600.html%3Flanguage%3Det_ee%26utmSource%3Dallmedia&clink=https%3A%2F%2Fsmartad.ee&banner_id=3b881495c84042deb0d0288185da231350dd7b0f4105441f8f6018cc3fcb090c&bg=black&w=300&h=600&locale=Display%20Estonia-EST&info=https%3A%2F%2Fdigital.tv3.ee%2Fbepolite-id%2F%3Futm_src%3Dbanner
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
date: Sun, 17 Sep 2023 15:05:44 GMT
content-type: application/javascript
server: nginx/1.15.12
last-modified: Thu, 22 Apr 2021 07:20:15 GMT
vary: Accept-Encoding
etag: W/"608123af-15d84"
content-encoding: gzip
X-Firefox-Spdy: h2
banner.hookusbookus.com/assets/css/index_1000x200.css
200 OK 72 kB URL GET HTTP/2 banner.hookusbookus.com/assets/css/index_1000x200.css
IP
Requested by https://banner.hookusbookus.com/index_1000x200.html?language=et_ee&utmSource=allmedia&click_url=https%3A%2F%2Fserving.bepolite.eu%2Fevent%3Fkey%3DFYFWuDany3hwv6rfuoAYF93T_QRJ2hBZwmsMl3Whl_99ix5uY53jsKJJwc1ygGrsJod2k2p7ECyT7Xf8GZjjJQ3JhI1rZetSRMPn9hvkuS6U77_5qqmjl-sQxYFvVV5P_lO51mNc3a12xtzS21jn071PaUfEhNNCxerdZWPZj93zp3ZdgWtH0MKue5p5AGKHXJxXiVJEh1Vfgxn38rgFo-tSrOiriedI-Oi3R5i8w-3Nph6AhIbGKPDtMF7YPxkDU4_Ogio8x-bd6qxktBd7cU06ZH0Tqu0wnEKgeSbUH3La5hY8OvOxWaQQS9P0iYfnngZXtFEp1ljuqs475VAp1Q%26clink%3Dhttp%253A%252F%252Fsmartad.ee&dynamic_url=https%3A%2F%2Fserving.bepolite.eu%2Fevent%3Fkey%3DFYFWuDany3hwv6rfuoAYF93T_QRJ2hBZwmsMl3Whl_99ix5uY53jsKJJwc1ygGrsJod2k2p7ECyT7Xf8GZjjJQ3JhI1rZetSRMPn9hvkuS6U77_5qqmjl-sQxYFvVV5P_lO51mNc3a12xtzS21jn071PaUfEhNNCxerdZWPZj93zp3ZdgWtH0MKue5p5AGKHXJxXiVJEh1Vfgxn38rgFo-tSrOiriedI-Oi3R5i8w-3Nph6AhIbGKPDtMF7YPxkDU4_Ogio8x-bd6qxktBd7cU06ZH0Tqu0wnEKgeSbUH3La5hY8OvOxWaQQS9P0iYfnngZXtFEp1ljuqs475VAp1Q%26clink%3D&f=https%3A%2F%2Fbanner.hookusbookus.com%2Findex_1000x200.html%3Flanguage%3Det_ee%26utmSource%3Dallmedia&clink=https%3A%2F%2Fsmartad.ee&banner_id=2b832712c40e4d1885d21996092d5e9350dd7b0f4105441f8f6018cc3fcb090c&bg=transparent&w=1000&h=200&locale=Display%20Estonia-EST&info=https%3A%2F%2Fdigital.tv3.ee%2Fbepolite-id%2F%3Futm_src%3Dbanner
Certificate IssuerAmazon
Subject*.hookusbookus.com
FingerprintCD:CD:3C:03:66:21:F8:A9:21:BC:F8:C8:3C:DC:88:0A:C5:19:F1:7A
ValiditySun, 07 May 2023 00:00:00 GMT - Tue, 04 Jun 2024 23:59:59 GMT
File type gzip compressed data, from Unix\012- data
Hash 0c1513fe56faa24e07612143cd7318e8
3a81e8ec399aeb5e64cc4647815dabf8b17ca767
99543d930a28dfd0b9a93d752116b774137dc939bcaa1417a73db214022a4e3b
GET /assets/css/index_1000x200.css HTTP/1.1
Host: banner.hookusbookus.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://banner.hookusbookus.com/index_1000x200.html?language=et_ee&utmSource=allmedia&click_url=https%3A%2F%2Fserving.bepolite.eu%2Fevent%3Fkey%3DFYFWuDany3hwv6rfuoAYF93T_QRJ2hBZwmsMl3Whl_99ix5uY53jsKJJwc1ygGrsJod2k2p7ECyT7Xf8GZjjJQ3JhI1rZetSRMPn9hvkuS6U77_5qqmjl-sQxYFvVV5P_lO51mNc3a12xtzS21jn071PaUfEhNNCxerdZWPZj93zp3ZdgWtH0MKue5p5AGKHXJxXiVJEh1Vfgxn38rgFo-tSrOiriedI-Oi3R5i8w-3Nph6AhIbGKPDtMF7YPxkDU4_Ogio8x-bd6qxktBd7cU06ZH0Tqu0wnEKgeSbUH3La5hY8OvOxWaQQS9P0iYfnngZXtFEp1ljuqs475VAp1Q%26clink%3Dhttp%253A%252F%252Fsmartad.ee&dynamic_url=https%3A%2F%2Fserving.bepolite.eu%2Fevent%3Fkey%3DFYFWuDany3hwv6rfuoAYF93T_QRJ2hBZwmsMl3Whl_99ix5uY53jsKJJwc1ygGrsJod2k2p7ECyT7Xf8GZjjJQ3JhI1rZetSRMPn9hvkuS6U77_5qqmjl-sQxYFvVV5P_lO51mNc3a12xtzS21jn071PaUfEhNNCxerdZWPZj93zp3ZdgWtH0MKue5p5AGKHXJxXiVJEh1Vfgxn38rgFo-tSrOiriedI-Oi3R5i8w-3Nph6AhIbGKPDtMF7YPxkDU4_Ogio8x-bd6qxktBd7cU06ZH0Tqu0wnEKgeSbUH3La5hY8OvOxWaQQS9P0iYfnngZXtFEp1ljuqs475VAp1Q%26clink%3D&f=https%3A%2F%2Fbanner.hookusbookus.com%2Findex_1000x200.html%3Flanguage%3Det_ee%26utmSource%3Dallmedia&clink=https%3A%2F%2Fsmartad.ee&banner_id=2b832712c40e4d1885d21996092d5e9350dd7b0f4105441f8f6018cc3fcb090c&bg=transparent&w=1000&h=200&locale=Display%20Estonia-EST&info=https%3A%2F%2Fdigital.tv3.ee%2Fbepolite-id%2F%3Futm_src%3Dbanner
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
date: Sun, 17 Sep 2023 15:05:44 GMT
content-type: text/css
server: nginx/1.15.12
last-modified: Fri, 17 Dec 2021 08:13:58 GMT
vary: Accept-Encoding
etag: W/"61bc46c6-1301"
content-encoding: gzip
X-Firefox-Spdy: h2
dskwugy0u6y9l.cloudfront.net/hotelliveeb/images/general/1/uKEQ3VnYU3XSxSyNM64d.jpg
421 Misdirected Request 73 kB URL GET HTTP/2 dskwugy0u6y9l.cloudfront.net/hotelliveeb/images/general/1/uKEQ3VnYU3XSxSyNM64d.jpg
IP
Requested by https://banner.hookusbookus.com/index_1000x200.html?language=et_ee&utmSource=allmedia&click_url=https%3A%2F%2Fserving.bepolite.eu%2Fevent%3Fkey%3DFYFWuDany3hwv6rfuoAYF93T_QRJ2hBZwmsMl3Whl_99ix5uY53jsKJJwc1ygGrsJod2k2p7ECyT7Xf8GZjjJQ3JhI1rZetSRMPn9hvkuS6U77_5qqmjl-sQxYFvVV5P_lO51mNc3a12xtzS21jn071PaUfEhNNCxerdZWPZj93zp3ZdgWtH0MKue5p5AGKHXJxXiVJEh1Vfgxn38rgFo-tSrOiriedI-Oi3R5i8w-3Nph6AhIbGKPDtMF7YPxkDU4_Ogio8x-bd6qxktBd7cU06ZH0Tqu0wnEKgeSbUH3La5hY8OvOxWaQQS9P0iYfnngZXtFEp1ljuqs475VAp1Q%26clink%3Dhttp%253A%252F%252Fsmartad.ee&dynamic_url=https%3A%2F%2Fserving.bepolite.eu%2Fevent%3Fkey%3DFYFWuDany3hwv6rfuoAYF93T_QRJ2hBZwmsMl3Whl_99ix5uY53jsKJJwc1ygGrsJod2k2p7ECyT7Xf8GZjjJQ3JhI1rZetSRMPn9hvkuS6U77_5qqmjl-sQxYFvVV5P_lO51mNc3a12xtzS21jn071PaUfEhNNCxerdZWPZj93zp3ZdgWtH0MKue5p5AGKHXJxXiVJEh1Vfgxn38rgFo-tSrOiriedI-Oi3R5i8w-3Nph6AhIbGKPDtMF7YPxkDU4_Ogio8x-bd6qxktBd7cU06ZH0Tqu0wnEKgeSbUH3La5hY8OvOxWaQQS9P0iYfnngZXtFEp1ljuqs475VAp1Q%26clink%3D&f=https%3A%2F%2Fbanner.hookusbookus.com%2Findex_1000x200.html%3Flanguage%3Det_ee%26utmSource%3Dallmedia&clink=https%3A%2F%2Fsmartad.ee&banner_id=2b832712c40e4d1885d21996092d5e9350dd7b0f4105441f8f6018cc3fcb090c&bg=transparent&w=1000&h=200&locale=Display%20Estonia-EST&info=https%3A%2F%2Fdigital.tv3.ee%2Fbepolite-id%2F%3Futm_src%3Dbanner
Certificate IssuerAmazon
Subject*.cloudfront.net
FingerprintBA:0F:CD:B3:EA:19:B2:9D:99:9B:51:2D:16:33:6B:D0:3F:31:A2:AB
ValidityThu, 08 Dec 2022 00:00:00 GMT - Thu, 07 Dec 2023 23:59:59 GMT
File type JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 346x198, components 3\012- data
Hash bf36e0bf265a935a340671b4d66f2e01
71eacdd355861fa4500b9961d4fcd24b81aa87e4
8e6b881322ec75b0070fe04c905f40284ddc3806fdb6253cce210d544c8a0c19
GET /hotelliveeb/images/general/1/uKEQ3VnYU3XSxSyNM64d.jpg HTTP/1.1
Host: dskwugy0u6y9l.cloudfront.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://banner.hookusbookus.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 421 Misdirected Request
server: CloudFront
date: Sun, 17 Sep 2023 15:05:44 GMT
content-type: text/html
content-length: 1003
x-cache: Error from cloudfront
via: 1.1 d4fd24ae65d4d2b97cfdea8d2f0c21a6.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-C1
x-amz-cf-id: XOwDTk3APSWdvpoV8GUBgEBfR0VbHWZPg7p3SM66QYbEVwgE3_nrmA==
X-Firefox-Spdy: h2
static.bepolite.eu/files/close-gray.png
200 OK 1.5 kB URL GET HTTP/2 static.bepolite.eu/files/close-gray.png
IP
ASN #3327 CITIC Telecom CPC Netherlands B.V.
Requested by https://www.upload.ee/files/15695061/heg1.exe.html?msg=sess_error
Certificate IssuerLet's Encrypt
Subjectstatic.bepolite.eu
FingerprintB7:1B:BB:35:5B:E5:6E:92:4D:DE:79:2E:0E:C8:1F:0D:CE:28:88:FD
ValidityMon, 04 Sep 2023 21:06:47 GMT - Sun, 03 Dec 2023 21:06:46 GMT
File type PNG image data, 35 x 35, 8-bit/color RGBA, non-interlaced\012- data
Hash 41d9676ab94bece3f7a549b4769ddbe2
521f14490fc57fea51e2e5bf00e2299dce51561b
c2f89787bda82263fceb9ec11d398fa83a5f22abf248956df29bdee2987d2f34
GET /files/close-gray.png HTTP/1.1
Host: static.bepolite.eu
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.upload.ee/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
content-type: image/png
accept-ranges: bytes
etag: "2525417386"
last-modified: Fri, 08 Apr 2022 18:07:56 GMT
content-length: 1497
date: Sun, 17 Sep 2023 15:05:34 GMT
cache-control: must-revalidate, private
expires: -1
p3p: CP='BePolite does not have a P3P policy'
x-varnish: 440102279
age: 0
X-Firefox-Spdy: h2
banner-server.hookusbookus.com/package-feed?language=et_ee&utmSource=allmedia
200 OK 25 kB URL GET HTTP/2 banner-server.hookusbookus.com/package-feed?language=et_ee&utmSource=allmedia
IP
Requested by https://banner.hookusbookus.com/index_1000x200.html?language=et_ee&utmSource=allmedia&click_url=https%3A%2F%2Fserving.bepolite.eu%2Fevent%3Fkey%3DFYFWuDany3hwv6rfuoAYF93T_QRJ2hBZwmsMl3Whl_99ix5uY53jsKJJwc1ygGrsJod2k2p7ECyT7Xf8GZjjJQ3JhI1rZetSRMPn9hvkuS6U77_5qqmjl-sQxYFvVV5P_lO51mNc3a12xtzS21jn071PaUfEhNNCxerdZWPZj93zp3ZdgWtH0MKue5p5AGKHXJxXiVJEh1Vfgxn38rgFo-tSrOiriedI-Oi3R5i8w-3Nph6AhIbGKPDtMF7YPxkDU4_Ogio8x-bd6qxktBd7cU06ZH0Tqu0wnEKgeSbUH3La5hY8OvOxWaQQS9P0iYfnngZXtFEp1ljuqs475VAp1Q%26clink%3Dhttp%253A%252F%252Fsmartad.ee&dynamic_url=https%3A%2F%2Fserving.bepolite.eu%2Fevent%3Fkey%3DFYFWuDany3hwv6rfuoAYF93T_QRJ2hBZwmsMl3Whl_99ix5uY53jsKJJwc1ygGrsJod2k2p7ECyT7Xf8GZjjJQ3JhI1rZetSRMPn9hvkuS6U77_5qqmjl-sQxYFvVV5P_lO51mNc3a12xtzS21jn071PaUfEhNNCxerdZWPZj93zp3ZdgWtH0MKue5p5AGKHXJxXiVJEh1Vfgxn38rgFo-tSrOiriedI-Oi3R5i8w-3Nph6AhIbGKPDtMF7YPxkDU4_Ogio8x-bd6qxktBd7cU06ZH0Tqu0wnEKgeSbUH3La5hY8OvOxWaQQS9P0iYfnngZXtFEp1ljuqs475VAp1Q%26clink%3D&f=https%3A%2F%2Fbanner.hookusbookus.com%2Findex_1000x200.html%3Flanguage%3Det_ee%26utmSource%3Dallmedia&clink=https%3A%2F%2Fsmartad.ee&banner_id=2b832712c40e4d1885d21996092d5e9350dd7b0f4105441f8f6018cc3fcb090c&bg=transparent&w=1000&h=200&locale=Display%20Estonia-EST&info=https%3A%2F%2Fdigital.tv3.ee%2Fbepolite-id%2F%3Futm_src%3Dbanner
Certificate IssuerAmazon
Subject*.hookusbookus.com
FingerprintCD:CD:3C:03:66:21:F8:A9:21:BC:F8:C8:3C:DC:88:0A:C5:19:F1:7A
ValiditySun, 07 May 2023 00:00:00 GMT - Tue, 04 Jun 2024 23:59:59 GMT
File type JSON data\012- , Unicode text, UTF-8 text, with very long lines (25332), with no line terminators
Hash 2b3ce307cef5a143ed4b420e3e6f5182
2c7e9212edcba5ad5cea158386533e21d6555ff2
32447c7e27976a3b429b404acbe05149b73265677ff06ae72f404fcf7af43055
GET /package-feed?language=et_ee&utmSource=allmedia HTTP/1.1
Host: banner-server.hookusbookus.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://banner.hookusbookus.com
DNT: 1
Connection: keep-alive
Referer: https://banner.hookusbookus.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Sun, 17 Sep 2023 15:05:44 GMT
content-type: application/json
access-control-allow-origin: https://banner.hookusbookus.com
access-control-allow-methods: POST, PUT, GET, PATCH, OPTIONS, DELETE
access-control-max-age: 3600
access-control-allow-headers: origin, authorization, accept, content-type, x-requested-with, Pragma, Cache-Control, If-Modified-Since, X-Auth-Token, X-Client-Certificate
access-control-allow-credentials: true
access-control-expose-headers: X-Auth-Token, Content-Disposition, Content-Length
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: 0
x-frame-options: DENY
X-Firefox-Spdy: h2
serving.bepolite.eu/event?key=FYFWuDany3hwv6rfuoAYF93T_QRJ2hBZwmsMl3Whl_99ix5uY53jsKJJwc1ygGrsJod2k2p7ECyT7Xf8GZjjJQ3JhI1rZetSRMPn9hvkuS6U77_5qqmjl-sQxYFvVV5P_lO51mNc3a12xtzS21jn071PaUfEhNNCxerdZWPZj93zp3ZdgWtH0MKue5p5AGKHXJxXiVJEh1Vfgxn38rgFo-tSrOiriedI-Oi3R5i8w-2KEKyCRIfPP1ktkR_a1xBEN4Mp3hCHV2gL5wIlp7AQSx5xbztKZEP3IVdh-WxRkrPa5hY8OvOxWaQQS9P0iYfnf_8e5-90sra7UBdR4oM89g
200 OK 0 B URL GET HTTP/2 serving.bepolite.eu/event?key=FYFWuDany3hwv6rfuoAYF93T_QRJ2hBZwmsMl3Whl_99ix5uY53jsKJJwc1ygGrsJod2k2p7ECyT7Xf8GZjjJQ3JhI1rZetSRMPn9hvkuS6U77_5qqmjl-sQxYFvVV5P_lO51mNc3a12xtzS21jn071PaUfEhNNCxerdZWPZj93zp3ZdgWtH0MKue5p5AGKHXJxXiVJEh1Vfgxn38rgFo-tSrOiriedI-Oi3R5i8w-2KEKyCRIfPP1ktkR_a1xBEN4Mp3hCHV2gL5wIlp7AQSx5xbztKZEP3IVdh-WxRkrPa5hY8OvOxWaQQS9P0iYfnf_8e5-90sra7UBdR4oM89g
IP
ASN #3327 CITIC Telecom CPC Netherlands B.V.
Requested by https://www.upload.ee/files/15695061/heg1.exe.html?msg=sess_error
Certificate IssuerLet's Encrypt
Subjectstatic.bepolite.eu
FingerprintB7:1B:BB:35:5B:E5:6E:92:4D:DE:79:2E:0E:C8:1F:0D:CE:28:88:FD
ValidityMon, 04 Sep 2023 21:06:47 GMT - Sun, 03 Dec 2023 21:06:46 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /event?key=FYFWuDany3hwv6rfuoAYF93T_QRJ2hBZwmsMl3Whl_99ix5uY53jsKJJwc1ygGrsJod2k2p7ECyT7Xf8GZjjJQ3JhI1rZetSRMPn9hvkuS6U77_5qqmjl-sQxYFvVV5P_lO51mNc3a12xtzS21jn071PaUfEhNNCxerdZWPZj93zp3ZdgWtH0MKue5p5AGKHXJxXiVJEh1Vfgxn38rgFo-tSrOiriedI-Oi3R5i8w-2KEKyCRIfPP1ktkR_a1xBEN4Mp3hCHV2gL5wIlp7AQSx5xbztKZEP3IVdh-WxRkrPa5hY8OvOxWaQQS9P0iYfnf_8e5-90sra7UBdR4oM89g HTTP/1.1
Host: serving.bepolite.eu
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.upload.ee/
Cookie: bepolite_id=929806dd6c42aecd910bcbddad809e46
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
content-length: 0
date: Sun, 17 Sep 2023 15:05:33 GMT
p3p: CP='BePolite does not have a P3P policy'
x-varnish: 439638130
age: 0
accept-ranges: bytes
X-Firefox-Spdy: h2
pogothere.xyz/asd100.bin
200 OK 103 kB IP
Requested by https://www.upload.ee/files/15695061/heg1.exe.html?msg=sess_error
Certificate IssuerCloudflare, Inc.
Subjectsni.cloudflaressl.com
Fingerprint17:F9:2D:6F:B5:5E:5F:37:A6:FB:BE:61:4F:97:64:33:85:5C:3A:FB
ValidityTue, 28 Feb 2023 00:00:00 GMT - Tue, 27 Feb 2024 23:59:59 GMT
Size 103 kB (103208 bytes)
Hash 28c0b8b0d2ce17c56980890269a047c5
2e47f4254294ea697b59c94ecad87644039a248d
925b73c951dc7c807473f780b7753e095b8e7df5f1d6e219aee144d532b217bc
GET /asd100.bin HTTP/1.1
Host: pogothere.xyz
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://www.upload.ee/
Origin: https://www.upload.ee
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Sun, 17 Sep 2023 15:05:42 GMT
content-type: binary/octet-stream
access-control-allow-origin: https://www.upload.ee
access-control-allow-credentials: true
access-control-allow-methods: GET
access-control-allow-headers: X-Requested-With, content-type
cache-control: max-age=14400
cf-cache-status: HIT
age: 6852
last-modified: Sun, 17 Sep 2023 13:11:30 GMT
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=X9E6qcYeL4PoVK%2BMJ97sfOSyrkGqyUKj9yO8HKHqsEkj3fV251usQfVn%2FIniGzj1tcDAqYmfj390ktK5qv6GXLGjqvzX9aHkKkI7fJ02Q9lmrebqBl4Zoxh%2BckEQv9wx"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 80823fbaeed148cd-LHR
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
dskwugy0u6y9l.cloudfront.net/hotelliveeb/images/general/1/BUqiDJaVFSzS3FKZH4Jb.jpg
200 OK 61 kB URL GET HTTP/2 dskwugy0u6y9l.cloudfront.net/hotelliveeb/images/general/1/BUqiDJaVFSzS3FKZH4Jb.jpg
IP
Requested by https://banner.hookusbookus.com/index_1000x200.html?language=et_ee&utmSource=allmedia&click_url=https%3A%2F%2Fserving.bepolite.eu%2Fevent%3Fkey%3DFYFWuDany3hwv6rfuoAYF93T_QRJ2hBZwmsMl3Whl_99ix5uY53jsKJJwc1ygGrsJod2k2p7ECyT7Xf8GZjjJQ3JhI1rZetSRMPn9hvkuS6U77_5qqmjl-sQxYFvVV5P_lO51mNc3a12xtzS21jn071PaUfEhNNCxerdZWPZj93zp3ZdgWtH0MKue5p5AGKHXJxXiVJEh1Vfgxn38rgFo-tSrOiriedI-Oi3R5i8w-3Nph6AhIbGKPDtMF7YPxkDU4_Ogio8x-bd6qxktBd7cU06ZH0Tqu0wnEKgeSbUH3La5hY8OvOxWaQQS9P0iYfnngZXtFEp1ljuqs475VAp1Q%26clink%3Dhttp%253A%252F%252Fsmartad.ee&dynamic_url=https%3A%2F%2Fserving.bepolite.eu%2Fevent%3Fkey%3DFYFWuDany3hwv6rfuoAYF93T_QRJ2hBZwmsMl3Whl_99ix5uY53jsKJJwc1ygGrsJod2k2p7ECyT7Xf8GZjjJQ3JhI1rZetSRMPn9hvkuS6U77_5qqmjl-sQxYFvVV5P_lO51mNc3a12xtzS21jn071PaUfEhNNCxerdZWPZj93zp3ZdgWtH0MKue5p5AGKHXJxXiVJEh1Vfgxn38rgFo-tSrOiriedI-Oi3R5i8w-3Nph6AhIbGKPDtMF7YPxkDU4_Ogio8x-bd6qxktBd7cU06ZH0Tqu0wnEKgeSbUH3La5hY8OvOxWaQQS9P0iYfnngZXtFEp1ljuqs475VAp1Q%26clink%3D&f=https%3A%2F%2Fbanner.hookusbookus.com%2Findex_1000x200.html%3Flanguage%3Det_ee%26utmSource%3Dallmedia&clink=https%3A%2F%2Fsmartad.ee&banner_id=2b832712c40e4d1885d21996092d5e9350dd7b0f4105441f8f6018cc3fcb090c&bg=transparent&w=1000&h=200&locale=Display%20Estonia-EST&info=https%3A%2F%2Fdigital.tv3.ee%2Fbepolite-id%2F%3Futm_src%3Dbanner
Certificate IssuerAmazon
Subject*.cloudfront.net
FingerprintBA:0F:CD:B3:EA:19:B2:9D:99:9B:51:2D:16:33:6B:D0:3F:31:A2:AB
ValidityThu, 08 Dec 2022 00:00:00 GMT - Thu, 07 Dec 2023 23:59:59 GMT
File type JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 346x198, components 3\012- data
Hash ae20017cb814683d3e74045dac714bae
1edaf029fb4bd033faa11e712e8aa0f500559902
8e1a0c042ea2ee4c9c9be94d2b24c898dbe1d8dd1c65240b2801f710b017517e
GET /hotelliveeb/images/general/1/BUqiDJaVFSzS3FKZH4Jb.jpg HTTP/1.1
Host: dskwugy0u6y9l.cloudfront.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://banner.hookusbookus.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
content-type: image/jpeg
content-length: 60703
date: Sat, 16 Sep 2023 15:30:38 GMT
last-modified: Mon, 20 Dec 2021 05:01:39 GMT
etag: "ae20017cb814683d3e74045dac714bae"
accept-ranges: bytes
server: AmazonS3
x-cache: Hit from cloudfront
via: 1.1 96c778ce6156d12f24b8b6cdaa0cbf66.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-C1
x-amz-cf-id: d_8MXFWSeYmfTBrEbN8_h3fKUcx5KzjukjiA-WgxWNSQslYICR5CsQ==
age: 84913
X-Firefox-Spdy: h2
pogothere.xyz/
200 OK 61 kB IP
Requested by https://www.upload.ee/files/15695061/heg1.exe.html?msg=sess_error
Certificate IssuerCloudflare, Inc.
Subjectsni.cloudflaressl.com
Fingerprint17:F9:2D:6F:B5:5E:5F:37:A6:FB:BE:61:4F:97:64:33:85:5C:3A:FB
ValidityTue, 28 Feb 2023 00:00:00 GMT - Tue, 27 Feb 2024 23:59:59 GMT
File type ASCII text, with no line terminators
Hash 722556d828fb042f59ce20338f97adc7
394f5b590905346ce57d8a6dc18ef1d6db6dc639
7694af08ddf4fd83dcbe71493875dc6e9e1692f989d7bf306776e6c48082647c
GET / HTTP/1.1
Host: pogothere.xyz
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://www.upload.ee/
Origin: https://www.upload.ee
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Sun, 17 Sep 2023 15:05:42 GMT
content-type: text/plain
set-cookie: csu=96096090108139@1@1694963142; Max-Age=31104000; Secure; SameSite=None
access-control-allow-origin: https://www.upload.ee
access-control-allow-credentials: true
access-control-allow-methods: GET
access-control-allow-headers: X-Requested-With, content-type
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=TcN1qOqfYqKVtARdYLVABexggjmW6wGul8iaoTnhV1BkYRO9JeAWjkUN0JEDbWzCE5LPoX2FXooiJWNbqoq%2B3%2FA7GNUwMgNf528dKL5CWhUbthg3Na5AVLwZke2iRw4P"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 80823fbb0f0a48cd-LHR
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
dskwugy0u6y9l.cloudfront.net/hotelliveeb/images/general/1/JdZmoWeiiQlpfMAuIIeC.jpg
61 kB URL dskwugy0u6y9l.cloudfront.net/hotelliveeb/images/general/1/JdZmoWeiiQlpfMAuIIeC.jpg
IP
Certificate IssuerAmazon
Subject*.cloudfront.net
FingerprintBA:0F:CD:B3:EA:19:B2:9D:99:9B:51:2D:16:33:6B:D0:3F:31:A2:AB
ValidityThu, 08 Dec 2022 00:00:00 GMT - Thu, 07 Dec 2023 23:59:59 GMT
File type JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 346x195, components 3\012- data
Hash dd86bfb4bf775c862d2c4ce6c31b29b5
94119b0ecc2ae1f9fa98a98eb6c416622ef14547
de5103951b90a9ed1ba44af9919079bed54e32ab4c61d849d19c672ef26e0bca
GET /hotelliveeb/images/general/1/JdZmoWeiiQlpfMAuIIeC.jpg HTTP/1.1
Host: dskwugy0u6y9l.cloudfront.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://banner.hookusbookus.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
content-type: image/jpeg
content-length: 60807
date: Sat, 16 Sep 2023 15:12:32 GMT
last-modified: Mon, 20 Dec 2021 05:01:37 GMT
etag: "dd86bfb4bf775c862d2c4ce6c31b29b5"
accept-ranges: bytes
server: AmazonS3
x-cache: Hit from cloudfront
via: 1.1 96c778ce6156d12f24b8b6cdaa0cbf66.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-C1
x-amz-cf-id: zf-wtUpjLg2-c_zQZ-cMYCsX5pM9ieLk_RRZD-zqzosA5qcW8etKkg==
age: 86005
X-Firefox-Spdy: h2
dskwugy0u6y9l.cloudfront.net/hotelliveeb/images/general/1/WvgxKP0SMkf1q8doIfVx.jpg
55 kB URL GET dskwugy0u6y9l.cloudfront.net/hotelliveeb/images/general/1/WvgxKP0SMkf1q8doIfVx.jpg
IP
Requested by https://banner.hookusbookus.com/index_300x600.html?language=et_ee&utmSource=allmedia&click_url=https%3A%2F%2Fserving.bepolite.eu%2Fevent%3Fkey%3DFYFWuDany3hwv6rfuoAYF93T_QRJ2hBZwmsMl3Whl_99ix5uY53jsKJJwc1ygGrsJod2k2p7ECyT7Xf8GZjjJQ3JhI1rZetSRMPn9hvkuS6U77_5qqmjl-sQxYFvVV5P_lO51mNc3a12xtzS21jn071PaUfEhNNCxerdZWPZj93zp3ZdgWtH0MKue5p5AGKHXJxXiVJEh1Vfgxn38rgFo-tSrOiriedI-Oi3R5i8w-2KEKyCRIfPP1ktkR_a1xBEN4Mp3hCHV2gL5wIlp7AQSx5xbztKZEP3IVdh-WxRkrPa5hY8OvOxWaQQS9P0iYfnngZXtFEp1ljuqs475VAp1Q%26clink%3Dhttp%253A%252F%252Fsmartad.ee&dynamic_url=https%3A%2F%2Fserving.bepolite.eu%2Fevent%3Fkey%3DFYFWuDany3hwv6rfuoAYF93T_QRJ2hBZwmsMl3Whl_99ix5uY53jsKJJwc1ygGrsJod2k2p7ECyT7Xf8GZjjJQ3JhI1rZetSRMPn9hvkuS6U77_5qqmjl-sQxYFvVV5P_lO51mNc3a12xtzS21jn071PaUfEhNNCxerdZWPZj93zp3ZdgWtH0MKue5p5AGKHXJxXiVJEh1Vfgxn38rgFo-tSrOiriedI-Oi3R5i8w-2KEKyCRIfPP1ktkR_a1xBEN4Mp3hCHV2gL5wIlp7AQSx5xbztKZEP3IVdh-WxRkrPa5hY8OvOxWaQQS9P0iYfnngZXtFEp1ljuqs475VAp1Q%26clink%3D&f=https%3A%2F%2Fbanner.hookusbookus.com%2Findex_300x600.html%3Flanguage%3Det_ee%26utmSource%3Dallmedia&clink=https%3A%2F%2Fsmartad.ee&banner_id=3b881495c84042deb0d0288185da231350dd7b0f4105441f8f6018cc3fcb090c&bg=black&w=300&h=600&locale=Display%20Estonia-EST&info=https%3A%2F%2Fdigital.tv3.ee%2Fbepolite-id%2F%3Futm_src%3Dbanner
Certificate IssuerAmazon
Subject*.cloudfront.net
FingerprintBA:0F:CD:B3:EA:19:B2:9D:99:9B:51:2D:16:33:6B:D0:3F:31:A2:AB
ValidityThu, 08 Dec 2022 00:00:00 GMT - Thu, 07 Dec 2023 23:59:59 GMT
File type JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 300x230, components 3\012- data
Hash f78794f15a38b390907d0d2792bb5c46
a1f9f0df4a365570b950a8b3337fc7c637d5a3a3
143e196eb854308bbe9e4a937ab5878287c42325e5878cc8ae4d91d4c2c930a6
GET /hotelliveeb/images/general/1/WvgxKP0SMkf1q8doIfVx.jpg HTTP/1.1
Host: dskwugy0u6y9l.cloudfront.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://banner.hookusbookus.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
content-type: image/jpeg
content-length: 55100
date: Sun, 17 Sep 2023 10:51:06 GMT
last-modified: Mon, 30 May 2022 08:30:07 GMT
etag: "f78794f15a38b390907d0d2792bb5c46"
accept-ranges: bytes
server: AmazonS3
x-cache: Hit from cloudfront
via: 1.1 96c778ce6156d12f24b8b6cdaa0cbf66.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-C1
x-amz-cf-id: LQI97roEG6T-6XTv1ewekxemJnDfP9Uy0UNxNN4fScuAoihHytC_xA==
age: 15291
X-Firefox-Spdy: h2
accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fwww.youtube.com%2Ffavicon.ico&hl=en&ifkv=AYZoVhfuAQ3jr_Ji4pJZ0oBH0hV4HLdWmQ7qd-hUL4GTol4N75HhEM_Af4IPThrPx5TSOMyVAGP6Bw&passive=true&service=youtube&uilel=3&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S-1090100075%3A1694963142979203&theme=glif
403 Forbidden 0 B URL GET HTTP/3 accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fwww.youtube.com%2Ffavicon.ico&hl=en&ifkv=AYZoVhfuAQ3jr_Ji4pJZ0oBH0hV4HLdWmQ7qd-hUL4GTol4N75HhEM_Af4IPThrPx5TSOMyVAGP6Bw&passive=true&service=youtube&uilel=3&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S-1090100075%3A1694963142979203&theme=glif
IP
Requested by https://www.upload.ee/files/15695061/heg1.exe.html?msg=sess_error
Certificate IssuerGoogle Trust Services LLC
Subject*.google.com
Fingerprint5A:48:5B:27:A7:FB:0B:D6:63:83:8E:8E:80:DB:29:B7:2C:72:A8:8E
ValidityMon, 14 Aug 2023 08:16:28 GMT - Mon, 06 Nov 2023 08:16:27 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /v3/signin/identifier?continue=https%3A%2F%2Fwww.youtube.com%2Ffavicon.ico&hl=en&ifkv=AYZoVhfuAQ3jr_Ji4pJZ0oBH0hV4HLdWmQ7qd-hUL4GTol4N75HhEM_Af4IPThrPx5TSOMyVAGP6Bw&passive=true&service=youtube&uilel=3&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S-1090100075%3A1694963142979203&theme=glif HTTP/1.1
Host: accounts.google.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://www.upload.ee/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 403 Forbidden
content-type: text/html; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: Mon, 01 Jan 1990 00:00:00 GMT
date: Sun, 17 Sep 2023 15:05:43 GMT
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
strict-transport-security: max-age=31536000; includeSubDomains
content-security-policy: script-src 'nonce-CPtlNjb9NyBZTmOnNBNgXg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /v3/signin/_/AccountsSignInUi/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /v3/signin/_/AccountsSignInUi/cspreport/allowlist, require-trusted-types-for 'script';report-uri /v3/signin/_/AccountsSignInUi/cspreport
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
report-to: {"group":"AccountsSignInUi","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/AccountsSignInUi"}]}
cross-origin-opener-policy-report-only: same-origin; report-to="AccountsSignInUi"
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
content-encoding: gzip
server: ESF
x-xss-protection: 0
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
dskwugy0u6y9l.cloudfront.net/hotelliveeb/images/general/1/hhyZnnkdGWGsUmdp9mS6.jpg
200 OK 61 kB URL GET HTTP/2 dskwugy0u6y9l.cloudfront.net/hotelliveeb/images/general/1/hhyZnnkdGWGsUmdp9mS6.jpg
IP
Requested by https://banner.hookusbookus.com/index_300x600.html?language=et_ee&utmSource=allmedia&click_url=https%3A%2F%2Fserving.bepolite.eu%2Fevent%3Fkey%3DFYFWuDany3hwv6rfuoAYF93T_QRJ2hBZwmsMl3Whl_99ix5uY53jsKJJwc1ygGrsJod2k2p7ECyT7Xf8GZjjJQ3JhI1rZetSRMPn9hvkuS6U77_5qqmjl-sQxYFvVV5P_lO51mNc3a12xtzS21jn071PaUfEhNNCxerdZWPZj93zp3ZdgWtH0MKue5p5AGKHXJxXiVJEh1Vfgxn38rgFo-tSrOiriedI-Oi3R5i8w-2KEKyCRIfPP1ktkR_a1xBEN4Mp3hCHV2gL5wIlp7AQSx5xbztKZEP3IVdh-WxRkrPa5hY8OvOxWaQQS9P0iYfnngZXtFEp1ljuqs475VAp1Q%26clink%3Dhttp%253A%252F%252Fsmartad.ee&dynamic_url=https%3A%2F%2Fserving.bepolite.eu%2Fevent%3Fkey%3DFYFWuDany3hwv6rfuoAYF93T_QRJ2hBZwmsMl3Whl_99ix5uY53jsKJJwc1ygGrsJod2k2p7ECyT7Xf8GZjjJQ3JhI1rZetSRMPn9hvkuS6U77_5qqmjl-sQxYFvVV5P_lO51mNc3a12xtzS21jn071PaUfEhNNCxerdZWPZj93zp3ZdgWtH0MKue5p5AGKHXJxXiVJEh1Vfgxn38rgFo-tSrOiriedI-Oi3R5i8w-2KEKyCRIfPP1ktkR_a1xBEN4Mp3hCHV2gL5wIlp7AQSx5xbztKZEP3IVdh-WxRkrPa5hY8OvOxWaQQS9P0iYfnngZXtFEp1ljuqs475VAp1Q%26clink%3D&f=https%3A%2F%2Fbanner.hookusbookus.com%2Findex_300x600.html%3Flanguage%3Det_ee%26utmSource%3Dallmedia&clink=https%3A%2F%2Fsmartad.ee&banner_id=3b881495c84042deb0d0288185da231350dd7b0f4105441f8f6018cc3fcb090c&bg=black&w=300&h=600&locale=Display%20Estonia-EST&info=https%3A%2F%2Fdigital.tv3.ee%2Fbepolite-id%2F%3Futm_src%3Dbanner
Certificate IssuerAmazon
Subject*.cloudfront.net
FingerprintBA:0F:CD:B3:EA:19:B2:9D:99:9B:51:2D:16:33:6B:D0:3F:31:A2:AB
ValidityThu, 08 Dec 2022 00:00:00 GMT - Thu, 07 Dec 2023 23:59:59 GMT
File type JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 300x230, components 3\012- data
Hash 52bbefedf429d0ff18f023a82c94de8e
3007a62ce15cc003042761c47b6f45185986493a
f6936909ce8a048a2873d23f012a54cea4fc71994b6356fd0ee6cc9323225811
GET /hotelliveeb/images/general/1/hhyZnnkdGWGsUmdp9mS6.jpg HTTP/1.1
Host: dskwugy0u6y9l.cloudfront.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://banner.hookusbookus.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
content-type: image/jpeg
content-length: 61131
date: Sun, 17 Sep 2023 10:55:56 GMT
last-modified: Mon, 20 Dec 2021 05:01:17 GMT
etag: "52bbefedf429d0ff18f023a82c94de8e"
accept-ranges: bytes
server: AmazonS3
x-cache: Hit from cloudfront
via: 1.1 96c778ce6156d12f24b8b6cdaa0cbf66.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-C1
x-amz-cf-id: Bb1vz-W6r6l1l0VasjUw9lYZCz3vH8R1Xgi08lpcSyffXbc_kB32NA==
age: 14995
X-Firefox-Spdy: h2
banner.hookusbookus.com/assets/image/svg/hb-logo.svg
200 OK 15 kB URL GET HTTP/2 banner.hookusbookus.com/assets/image/svg/hb-logo.svg
IP
Requested by https://banner.hookusbookus.com/index_1000x200.html?language=et_ee&utmSource=allmedia&click_url=https%3A%2F%2Fserving.bepolite.eu%2Fevent%3Fkey%3DFYFWuDany3hwv6rfuoAYF93T_QRJ2hBZwmsMl3Whl_99ix5uY53jsKJJwc1ygGrsJod2k2p7ECyT7Xf8GZjjJQ3JhI1rZetSRMPn9hvkuS6U77_5qqmjl-sQxYFvVV5P_lO51mNc3a12xtzS21jn071PaUfEhNNCxerdZWPZj93zp3ZdgWtH0MKue5p5AGKHXJxXiVJEh1Vfgxn38rgFo-tSrOiriedI-Oi3R5i8w-3Nph6AhIbGKPDtMF7YPxkDU4_Ogio8x-bd6qxktBd7cU06ZH0Tqu0wnEKgeSbUH3La5hY8OvOxWaQQS9P0iYfnngZXtFEp1ljuqs475VAp1Q%26clink%3Dhttp%253A%252F%252Fsmartad.ee&dynamic_url=https%3A%2F%2Fserving.bepolite.eu%2Fevent%3Fkey%3DFYFWuDany3hwv6rfuoAYF93T_QRJ2hBZwmsMl3Whl_99ix5uY53jsKJJwc1ygGrsJod2k2p7ECyT7Xf8GZjjJQ3JhI1rZetSRMPn9hvkuS6U77_5qqmjl-sQxYFvVV5P_lO51mNc3a12xtzS21jn071PaUfEhNNCxerdZWPZj93zp3ZdgWtH0MKue5p5AGKHXJxXiVJEh1Vfgxn38rgFo-tSrOiriedI-Oi3R5i8w-3Nph6AhIbGKPDtMF7YPxkDU4_Ogio8x-bd6qxktBd7cU06ZH0Tqu0wnEKgeSbUH3La5hY8OvOxWaQQS9P0iYfnngZXtFEp1ljuqs475VAp1Q%26clink%3D&f=https%3A%2F%2Fbanner.hookusbookus.com%2Findex_1000x200.html%3Flanguage%3Det_ee%26utmSource%3Dallmedia&clink=https%3A%2F%2Fsmartad.ee&banner_id=2b832712c40e4d1885d21996092d5e9350dd7b0f4105441f8f6018cc3fcb090c&bg=transparent&w=1000&h=200&locale=Display%20Estonia-EST&info=https%3A%2F%2Fdigital.tv3.ee%2Fbepolite-id%2F%3Futm_src%3Dbanner
Certificate IssuerAmazon
Subject*.hookusbookus.com
FingerprintCD:CD:3C:03:66:21:F8:A9:21:BC:F8:C8:3C:DC:88:0A:C5:19:F1:7A
ValiditySun, 07 May 2023 00:00:00 GMT - Tue, 04 Jun 2024 23:59:59 GMT
File type SVG Scalable Vector Graphics image\012- , ASCII text, with very long lines (15333), with no line terminators
Hash bf6baf947f924bf8d67e947a025def06
9ac9fccb0351b41c1545714153ed5fa2c4bfef3a
64efdaebd020c39ec366f473c831cb51e8cd5d5b1afde13a9695d1f2dae4e60e
GET /assets/image/svg/hb-logo.svg HTTP/1.1
Host: banner.hookusbookus.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://banner.hookusbookus.com/assets/css/index_1000x200.css
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Sun, 17 Sep 2023 15:05:44 GMT
content-type: image/svg+xml
server: nginx/1.15.12
last-modified: Mon, 05 Jul 2021 19:56:59 GMT
vary: Accept-Encoding
etag: W/"60e3640b-3be5"
content-encoding: gzip
X-Firefox-Spdy: h2
accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fwww.google.com%2Ffavicon.ico&hl=en&ifkv=AYZoVhe2UvOEOqeQsZ1Hw5xhnbnDLmekHA0cUq7uSMI9eODKYYdP0dhRt9xRmYFgNUN_8vokkvmL_A&passive=true&service=mail&uilel=3&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S-1039891409%3A1694963142936039&theme=glif
403 Forbidden 0 B URL GET HTTP/3 accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fwww.google.com%2Ffavicon.ico&hl=en&ifkv=AYZoVhe2UvOEOqeQsZ1Hw5xhnbnDLmekHA0cUq7uSMI9eODKYYdP0dhRt9xRmYFgNUN_8vokkvmL_A&passive=true&service=mail&uilel=3&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S-1039891409%3A1694963142936039&theme=glif
IP
Requested by https://www.upload.ee/files/15695061/heg1.exe.html?msg=sess_error
Certificate IssuerGoogle Trust Services LLC
Subject*.google.com
Fingerprint5A:48:5B:27:A7:FB:0B:D6:63:83:8E:8E:80:DB:29:B7:2C:72:A8:8E
ValidityMon, 14 Aug 2023 08:16:28 GMT - Mon, 06 Nov 2023 08:16:27 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /v3/signin/identifier?continue=https%3A%2F%2Fwww.google.com%2Ffavicon.ico&hl=en&ifkv=AYZoVhe2UvOEOqeQsZ1Hw5xhnbnDLmekHA0cUq7uSMI9eODKYYdP0dhRt9xRmYFgNUN_8vokkvmL_A&passive=true&service=mail&uilel=3&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S-1039891409%3A1694963142936039&theme=glif HTTP/1.1
Host: accounts.google.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://www.upload.ee/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 403 Forbidden
content-type: text/html; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: Mon, 01 Jan 1990 00:00:00 GMT
date: Sun, 17 Sep 2023 15:05:43 GMT
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
strict-transport-security: max-age=31536000; includeSubDomains
content-security-policy: script-src 'nonce-B6MRknHLl5o3egeXMefiWQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /v3/signin/_/AccountsSignInUi/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /v3/signin/_/AccountsSignInUi/cspreport/allowlist, require-trusted-types-for 'script';report-uri /v3/signin/_/AccountsSignInUi/cspreport
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
report-to: {"group":"AccountsSignInUi","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/AccountsSignInUi"}]}
cross-origin-opener-policy-report-only: same-origin; report-to="AccountsSignInUi"
content-encoding: gzip
server: ESF
x-xss-protection: 0
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
banner.hookusbookus.com/index_300x600.html?language=et_ee&utmSource=allmedia&click_url=https%3A%2F%2Fserving.bepolite.eu%2Fevent%3Fkey%3DFYFWuDany3hwv6rfuoAYF93T_QRJ2hBZwmsMl3Whl_99ix5uY53jsKJJwc1ygGrsJod2k2p7ECyT7Xf8GZjjJQ3JhI1rZetSRMPn9hvkuS6U77_5qqmjl-sQxYFvVV5P_lO51mNc3a12xtzS21jn071PaUfEhNNCxerdZWPZj93zp3ZdgWtH0MKue5p5AGKHXJxXiVJEh1Vfgxn38rgFo-tSrOiriedI-Oi3R5i8w-2KEKyCRIfPP1ktkR_a1xBEN4Mp3hCHV2gL5wIlp7AQSx5xbztKZEP3IVdh-WxRkrPa5hY8OvOxWaQQS9P0iYfnngZXtFEp1ljuqs475VAp1Q%26clink%3Dhttp%253A%252F%252Fsmartad.ee&dynamic_url=https%3A%2F%2Fserving.bepolite.eu%2Fevent%3Fkey%3DFYFWuDany3hwv6rfuoAYF93T_QRJ2hBZwmsMl3Whl_99ix5uY53jsKJJwc1ygGrsJod2k2p7ECyT7Xf8GZjjJQ3JhI1rZetSRMPn9hvkuS6U77_5qqmjl-sQxYFvVV5P_lO51mNc3a12xtzS21jn071PaUfEhNNCxerdZWPZj93zp3ZdgWtH0MKue5p5AGKHXJxXiVJEh1Vfgxn38rgFo-tSrOiriedI-Oi3R5i8w-2KEKyCRIfPP1ktkR_a1xBEN4Mp3hCHV2gL5wIlp7AQSx5xbztKZEP3IVdh-WxRkrPa5hY8OvOxWaQQS9P0iYfnngZXtFEp1ljuqs475VAp1Q%26clink%3D&f=https%3A%2F%2Fbanner.hookusbookus.com%2Findex_300x600.html%3Flanguage%3Det_ee%26utmSource%3Dallmedia&clink=https%3A%2F%2Fsmartad.ee&banner_id=3b881495c84042deb0d0288185da231350dd7b0f4105441f8f6018cc3fcb090c&bg=black&w=300&h=600&locale=Display%20Estonia-EST&info=https%3A%2F%2Fdigital.tv3.ee%2Fbepolite-id%2F%3Futm_src%3Dbanner
200 OK 6.0 kB URL GET HTTP/2 banner.hookusbookus.com/index_300x600.html?language=et_ee&utmSource=allmedia&click_url=https%3A%2F%2Fserving.bepolite.eu%2Fevent%3Fkey%3DFYFWuDany3hwv6rfuoAYF93T_QRJ2hBZwmsMl3Whl_99ix5uY53jsKJJwc1ygGrsJod2k2p7ECyT7Xf8GZjjJQ3JhI1rZetSRMPn9hvkuS6U77_5qqmjl-sQxYFvVV5P_lO51mNc3a12xtzS21jn071PaUfEhNNCxerdZWPZj93zp3ZdgWtH0MKue5p5AGKHXJxXiVJEh1Vfgxn38rgFo-tSrOiriedI-Oi3R5i8w-2KEKyCRIfPP1ktkR_a1xBEN4Mp3hCHV2gL5wIlp7AQSx5xbztKZEP3IVdh-WxRkrPa5hY8OvOxWaQQS9P0iYfnngZXtFEp1ljuqs475VAp1Q%26clink%3Dhttp%253A%252F%252Fsmartad.ee&dynamic_url=https%3A%2F%2Fserving.bepolite.eu%2Fevent%3Fkey%3DFYFWuDany3hwv6rfuoAYF93T_QRJ2hBZwmsMl3Whl_99ix5uY53jsKJJwc1ygGrsJod2k2p7ECyT7Xf8GZjjJQ3JhI1rZetSRMPn9hvkuS6U77_5qqmjl-sQxYFvVV5P_lO51mNc3a12xtzS21jn071PaUfEhNNCxerdZWPZj93zp3ZdgWtH0MKue5p5AGKHXJxXiVJEh1Vfgxn38rgFo-tSrOiriedI-Oi3R5i8w-2KEKyCRIfPP1ktkR_a1xBEN4Mp3hCHV2gL5wIlp7AQSx5xbztKZEP3IVdh-WxRkrPa5hY8OvOxWaQQS9P0iYfnngZXtFEp1ljuqs475VAp1Q%26clink%3D&f=https%3A%2F%2Fbanner.hookusbookus.com%2Findex_300x600.html%3Flanguage%3Det_ee%26utmSource%3Dallmedia&clink=https%3A%2F%2Fsmartad.ee&banner_id=3b881495c84042deb0d0288185da231350dd7b0f4105441f8f6018cc3fcb090c&bg=black&w=300&h=600&locale=Display%20Estonia-EST&info=https%3A%2F%2Fdigital.tv3.ee%2Fbepolite-id%2F%3Futm_src%3Dbanner
IP
Requested by https://www.upload.ee/files/15695061/heg1.exe.html?msg=sess_error
Certificate IssuerAmazon
Subject*.hookusbookus.com
FingerprintCD:CD:3C:03:66:21:F8:A9:21:BC:F8:C8:3C:DC:88:0A:C5:19:F1:7A
ValiditySun, 07 May 2023 00:00:00 GMT - Tue, 04 Jun 2024 23:59:59 GMT
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, Unicode text, UTF-8 text, with very long lines (6183), with no line terminators
Hash e6203b2e0919f42103d8a3367bbc9b32
08d251797a13b125ec05294116373d90493045dd
e893c3c55f767327f9d5723610d23852fc9f34827dda3bd918575f75f5ef6e0b
GET /index_300x600.html?language=et_ee&utmSource=allmedia&click_url=https%3A%2F%2Fserving.bepolite.eu%2Fevent%3Fkey%3DFYFWuDany3hwv6rfuoAYF93T_QRJ2hBZwmsMl3Whl_99ix5uY53jsKJJwc1ygGrsJod2k2p7ECyT7Xf8GZjjJQ3JhI1rZetSRMPn9hvkuS6U77_5qqmjl-sQxYFvVV5P_lO51mNc3a12xtzS21jn071PaUfEhNNCxerdZWPZj93zp3ZdgWtH0MKue5p5AGKHXJxXiVJEh1Vfgxn38rgFo-tSrOiriedI-Oi3R5i8w-2KEKyCRIfPP1ktkR_a1xBEN4Mp3hCHV2gL5wIlp7AQSx5xbztKZEP3IVdh-WxRkrPa5hY8OvOxWaQQS9P0iYfnngZXtFEp1ljuqs475VAp1Q%26clink%3Dhttp%253A%252F%252Fsmartad.ee&dynamic_url=https%3A%2F%2Fserving.bepolite.eu%2Fevent%3Fkey%3DFYFWuDany3hwv6rfuoAYF93T_QRJ2hBZwmsMl3Whl_99ix5uY53jsKJJwc1ygGrsJod2k2p7ECyT7Xf8GZjjJQ3JhI1rZetSRMPn9hvkuS6U77_5qqmjl-sQxYFvVV5P_lO51mNc3a12xtzS21jn071PaUfEhNNCxerdZWPZj93zp3ZdgWtH0MKue5p5AGKHXJxXiVJEh1Vfgxn38rgFo-tSrOiriedI-Oi3R5i8w-2KEKyCRIfPP1ktkR_a1xBEN4Mp3hCHV2gL5wIlp7AQSx5xbztKZEP3IVdh-WxRkrPa5hY8OvOxWaQQS9P0iYfnngZXtFEp1ljuqs475VAp1Q%26clink%3D&f=https%3A%2F%2Fbanner.hookusbookus.com%2Findex_300x600.html%3Flanguage%3Det_ee%26utmSource%3Dallmedia&clink=https%3A%2F%2Fsmartad.ee&banner_id=3b881495c84042deb0d0288185da231350dd7b0f4105441f8f6018cc3fcb090c&bg=black&w=300&h=600&locale=Display%20Estonia-EST&info=https%3A%2F%2Fdigital.tv3.ee%2Fbepolite-id%2F%3Futm_src%3Dbanner HTTP/1.1
Host: banner.hookusbookus.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.upload.ee/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Sun, 17 Sep 2023 15:05:44 GMT
content-type: text/html
server: nginx/1.15.12
last-modified: Tue, 24 Jan 2023 14:19:47 GMT
vary: Accept-Encoding
etag: W/"63cfe903-1761"
content-encoding: gzip
X-Firefox-Spdy: h2
banner.hookusbookus.com/assets/image/svg/hb-logo.svg
200 OK 15 kB URL GET HTTP/2 banner.hookusbookus.com/assets/image/svg/hb-logo.svg
IP
Requested by https://banner.hookusbookus.com/index_300x600.html?language=et_ee&utmSource=allmedia&click_url=https%3A%2F%2Fserving.bepolite.eu%2Fevent%3Fkey%3DFYFWuDany3hwv6rfuoAYF93T_QRJ2hBZwmsMl3Whl_99ix5uY53jsKJJwc1ygGrsJod2k2p7ECyT7Xf8GZjjJQ3JhI1rZetSRMPn9hvkuS6U77_5qqmjl-sQxYFvVV5P_lO51mNc3a12xtzS21jn071PaUfEhNNCxerdZWPZj93zp3ZdgWtH0MKue5p5AGKHXJxXiVJEh1Vfgxn38rgFo-tSrOiriedI-Oi3R5i8w-2KEKyCRIfPP1ktkR_a1xBEN4Mp3hCHV2gL5wIlp7AQSx5xbztKZEP3IVdh-WxRkrPa5hY8OvOxWaQQS9P0iYfnngZXtFEp1ljuqs475VAp1Q%26clink%3Dhttp%253A%252F%252Fsmartad.ee&dynamic_url=https%3A%2F%2Fserving.bepolite.eu%2Fevent%3Fkey%3DFYFWuDany3hwv6rfuoAYF93T_QRJ2hBZwmsMl3Whl_99ix5uY53jsKJJwc1ygGrsJod2k2p7ECyT7Xf8GZjjJQ3JhI1rZetSRMPn9hvkuS6U77_5qqmjl-sQxYFvVV5P_lO51mNc3a12xtzS21jn071PaUfEhNNCxerdZWPZj93zp3ZdgWtH0MKue5p5AGKHXJxXiVJEh1Vfgxn38rgFo-tSrOiriedI-Oi3R5i8w-2KEKyCRIfPP1ktkR_a1xBEN4Mp3hCHV2gL5wIlp7AQSx5xbztKZEP3IVdh-WxRkrPa5hY8OvOxWaQQS9P0iYfnngZXtFEp1ljuqs475VAp1Q%26clink%3D&f=https%3A%2F%2Fbanner.hookusbookus.com%2Findex_300x600.html%3Flanguage%3Det_ee%26utmSource%3Dallmedia&clink=https%3A%2F%2Fsmartad.ee&banner_id=3b881495c84042deb0d0288185da231350dd7b0f4105441f8f6018cc3fcb090c&bg=black&w=300&h=600&locale=Display%20Estonia-EST&info=https%3A%2F%2Fdigital.tv3.ee%2Fbepolite-id%2F%3Futm_src%3Dbanner
Certificate IssuerAmazon
Subject*.hookusbookus.com
FingerprintCD:CD:3C:03:66:21:F8:A9:21:BC:F8:C8:3C:DC:88:0A:C5:19:F1:7A
ValiditySun, 07 May 2023 00:00:00 GMT - Tue, 04 Jun 2024 23:59:59 GMT
File type SVG Scalable Vector Graphics image\012- , ASCII text, with very long lines (15333), with no line terminators
Hash bf6baf947f924bf8d67e947a025def06
9ac9fccb0351b41c1545714153ed5fa2c4bfef3a
64efdaebd020c39ec366f473c831cb51e8cd5d5b1afde13a9695d1f2dae4e60e
GET /assets/image/svg/hb-logo.svg HTTP/1.1
Host: banner.hookusbookus.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://banner.hookusbookus.com/index_300x600.html?language=et_ee&utmSource=allmedia&click_url=https%3A%2F%2Fserving.bepolite.eu%2Fevent%3Fkey%3DFYFWuDany3hwv6rfuoAYF93T_QRJ2hBZwmsMl3Whl_99ix5uY53jsKJJwc1ygGrsJod2k2p7ECyT7Xf8GZjjJQ3JhI1rZetSRMPn9hvkuS6U77_5qqmjl-sQxYFvVV5P_lO51mNc3a12xtzS21jn071PaUfEhNNCxerdZWPZj93zp3ZdgWtH0MKue5p5AGKHXJxXiVJEh1Vfgxn38rgFo-tSrOiriedI-Oi3R5i8w-2KEKyCRIfPP1ktkR_a1xBEN4Mp3hCHV2gL5wIlp7AQSx5xbztKZEP3IVdh-WxRkrPa5hY8OvOxWaQQS9P0iYfnngZXtFEp1ljuqs475VAp1Q%26clink%3Dhttp%253A%252F%252Fsmartad.ee&dynamic_url=https%3A%2F%2Fserving.bepolite.eu%2Fevent%3Fkey%3DFYFWuDany3hwv6rfuoAYF93T_QRJ2hBZwmsMl3Whl_99ix5uY53jsKJJwc1ygGrsJod2k2p7ECyT7Xf8GZjjJQ3JhI1rZetSRMPn9hvkuS6U77_5qqmjl-sQxYFvVV5P_lO51mNc3a12xtzS21jn071PaUfEhNNCxerdZWPZj93zp3ZdgWtH0MKue5p5AGKHXJxXiVJEh1Vfgxn38rgFo-tSrOiriedI-Oi3R5i8w-2KEKyCRIfPP1ktkR_a1xBEN4Mp3hCHV2gL5wIlp7AQSx5xbztKZEP3IVdh-WxRkrPa5hY8OvOxWaQQS9P0iYfnngZXtFEp1ljuqs475VAp1Q%26clink%3D&f=https%3A%2F%2Fbanner.hookusbookus.com%2Findex_300x600.html%3Flanguage%3Det_ee%26utmSource%3Dallmedia&clink=https%3A%2F%2Fsmartad.ee&banner_id=3b881495c84042deb0d0288185da231350dd7b0f4105441f8f6018cc3fcb090c&bg=black&w=300&h=600&locale=Display%20Estonia-EST&info=https%3A%2F%2Fdigital.tv3.ee%2Fbepolite-id%2F%3Futm_src%3Dbanner
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Sun, 17 Sep 2023 15:05:44 GMT
content-type: image/svg+xml
server: nginx/1.15.12
last-modified: Mon, 05 Jul 2021 19:56:59 GMT
vary: Accept-Encoding
etag: W/"60e3640b-3be5"
content-encoding: gzip
X-Firefox-Spdy: h2
serving.bepolite.eu/event?key=FYFWuDany3hwv6rfuoAYF93T_QRJ2hBZwmsMl3Whl_99ix5uY53jsKJJwc1ygGrsJod2k2p7ECyT7Xf8GZjjJQ3JhI1rZetSRMPn9hvkuS6U77_5qqmjl-sQxYFvVV5P_lO51mNc3a12xtzS21jn071PaUfEhNNCxerdZWPZj93zp3ZdgWtH0MKue5p5AGKHXJxXiVJEh1Vfgxn38rgFo-tSrOiriedI-Oi3R5i8w-3Nph6AhIbGKPDtMF7YPxkDU4_Ogio8x-bd6qxktBd7cU06ZH0Tqu0wnEKgeSbUH3La5hY8OvOxWaQQS9P0iYfnPQFkqynusZJvi-LzBjp4mA
200 OK 0 B URL GET HTTP/2 serving.bepolite.eu/event?key=FYFWuDany3hwv6rfuoAYF93T_QRJ2hBZwmsMl3Whl_99ix5uY53jsKJJwc1ygGrsJod2k2p7ECyT7Xf8GZjjJQ3JhI1rZetSRMPn9hvkuS6U77_5qqmjl-sQxYFvVV5P_lO51mNc3a12xtzS21jn071PaUfEhNNCxerdZWPZj93zp3ZdgWtH0MKue5p5AGKHXJxXiVJEh1Vfgxn38rgFo-tSrOiriedI-Oi3R5i8w-3Nph6AhIbGKPDtMF7YPxkDU4_Ogio8x-bd6qxktBd7cU06ZH0Tqu0wnEKgeSbUH3La5hY8OvOxWaQQS9P0iYfnPQFkqynusZJvi-LzBjp4mA
IP
ASN #3327 CITIC Telecom CPC Netherlands B.V.
Requested by https://www.upload.ee/files/15695061/heg1.exe.html?msg=sess_error
Certificate IssuerLet's Encrypt
Subjectstatic.bepolite.eu
FingerprintB7:1B:BB:35:5B:E5:6E:92:4D:DE:79:2E:0E:C8:1F:0D:CE:28:88:FD
ValidityMon, 04 Sep 2023 21:06:47 GMT - Sun, 03 Dec 2023 21:06:46 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /event?key=FYFWuDany3hwv6rfuoAYF93T_QRJ2hBZwmsMl3Whl_99ix5uY53jsKJJwc1ygGrsJod2k2p7ECyT7Xf8GZjjJQ3JhI1rZetSRMPn9hvkuS6U77_5qqmjl-sQxYFvVV5P_lO51mNc3a12xtzS21jn071PaUfEhNNCxerdZWPZj93zp3ZdgWtH0MKue5p5AGKHXJxXiVJEh1Vfgxn38rgFo-tSrOiriedI-Oi3R5i8w-3Nph6AhIbGKPDtMF7YPxkDU4_Ogio8x-bd6qxktBd7cU06ZH0Tqu0wnEKgeSbUH3La5hY8OvOxWaQQS9P0iYfnPQFkqynusZJvi-LzBjp4mA HTTP/1.1
Host: serving.bepolite.eu
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.upload.ee/
Cookie: bepolite_id=929806dd6c42aecd910bcbddad809e46
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
content-length: 0
date: Sun, 17 Sep 2023 15:05:35 GMT
p3p: CP='BePolite does not have a P3P policy'
x-varnish: 440123735
age: 0
accept-ranges: bytes
X-Firefox-Spdy: h2
eownouncillors.info/popunder.gif
200 OK 35 B URL GET HTTP/3 eownouncillors.info/popunder.gif
IP
Requested by https://www.upload.ee/files/15695061/heg1.exe.html?msg=sess_error
Certificate IssuerGoogle Trust Services LLC
Subjecteownouncillors.info
Fingerprint15:95:EB:48:9F:45:AB:B4:6E:35:F9:99:AE:3A:73:6D:04:C7:13:FC
ValidityMon, 04 Sep 2023 06:52:49 GMT - Sun, 03 Dec 2023 06:52:48 GMT
File type GIF image data, version 89a, 1 x 1\012- data
Hash 28d6814f309ea289f847c69cf91194c6
0f4e929dd5bb2564f7ab9c76338e04e292a42ace
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
GET /popunder.gif HTTP/1.1
Host: eownouncillors.info
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.upload.ee/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Sun, 17 Sep 2023 15:05:43 GMT
content-type: image/gif
access-control-allow-origin: *
pragma: public
cache-control: public, max-age=604800, immutable
cf-cache-status: HIT
age: 87894
last-modified: Sat, 16 Sep 2023 14:40:49 GMT
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=niB%2FdA7JEGhyneZkD3uoeGjoSaRhfwMdBlg5lNxPu4bR%2B4dVIfvjAxkeMFXTuONWUe4jLNFCBQdQ8d0V6luMeAXJ77MOBMnZ6QjMiFGMnPrObGdqre%2FSqIZ1JpTtpMugQRhEsBmp"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 80823fbdec3eb527-OSL
alt-svc: h3=":443"; ma=86400
banner.hookusbookus.com/index_1000x200.html?language=et_ee&utmSource=allmedia&click_url=https%3A%2F%2Fserving.bepolite.eu%2Fevent%3Fkey%3DFYFWuDany3hwv6rfuoAYF93T_QRJ2hBZwmsMl3Whl_99ix5uY53jsKJJwc1ygGrsJod2k2p7ECyT7Xf8GZjjJQ3JhI1rZetSRMPn9hvkuS6U77_5qqmjl-sQxYFvVV5P_lO51mNc3a12xtzS21jn071PaUfEhNNCxerdZWPZj93zp3ZdgWtH0MKue5p5AGKHXJxXiVJEh1Vfgxn38rgFo-tSrOiriedI-Oi3R5i8w-3Nph6AhIbGKPDtMF7YPxkDU4_Ogio8x-bd6qxktBd7cU06ZH0Tqu0wnEKgeSbUH3La5hY8OvOxWaQQS9P0iYfnngZXtFEp1ljuqs475VAp1Q%26clink%3Dhttp%253A%252F%252Fsmartad.ee&dynamic_url=https%3A%2F%2Fserving.bepolite.eu%2Fevent%3Fkey%3DFYFWuDany3hwv6rfuoAYF93T_QRJ2hBZwmsMl3Whl_99ix5uY53jsKJJwc1ygGrsJod2k2p7ECyT7Xf8GZjjJQ3JhI1rZetSRMPn9hvkuS6U77_5qqmjl-sQxYFvVV5P_lO51mNc3a12xtzS21jn071PaUfEhNNCxerdZWPZj93zp3ZdgWtH0MKue5p5AGKHXJxXiVJEh1Vfgxn38rgFo-tSrOiriedI-Oi3R5i8w-3Nph6AhIbGKPDtMF7YPxkDU4_Ogio8x-bd6qxktBd7cU06ZH0Tqu0wnEKgeSbUH3La5hY8OvOxWaQQS9P0iYfnngZXtFEp1ljuqs475VAp1Q%26clink%3D&f=https%3A%2F%2Fbanner.hookusbookus.com%2Findex_1000x200.html%3Flanguage%3Det_ee%26utmSource%3Dallmedia&clink=https%3A%2F%2Fsmartad.ee&banner_id=2b832712c40e4d1885d21996092d5e9350dd7b0f4105441f8f6018cc3fcb090c&bg=transparent&w=1000&h=200&locale=Display%20Estonia-EST&info=https%3A%2F%2Fdigital.tv3.ee%2Fbepolite-id%2F%3Futm_src%3Dbanner
200 OK 6.0 kB URL GET HTTP/2 banner.hookusbookus.com/index_1000x200.html?language=et_ee&utmSource=allmedia&click_url=https%3A%2F%2Fserving.bepolite.eu%2Fevent%3Fkey%3DFYFWuDany3hwv6rfuoAYF93T_QRJ2hBZwmsMl3Whl_99ix5uY53jsKJJwc1ygGrsJod2k2p7ECyT7Xf8GZjjJQ3JhI1rZetSRMPn9hvkuS6U77_5qqmjl-sQxYFvVV5P_lO51mNc3a12xtzS21jn071PaUfEhNNCxerdZWPZj93zp3ZdgWtH0MKue5p5AGKHXJxXiVJEh1Vfgxn38rgFo-tSrOiriedI-Oi3R5i8w-3Nph6AhIbGKPDtMF7YPxkDU4_Ogio8x-bd6qxktBd7cU06ZH0Tqu0wnEKgeSbUH3La5hY8OvOxWaQQS9P0iYfnngZXtFEp1ljuqs475VAp1Q%26clink%3Dhttp%253A%252F%252Fsmartad.ee&dynamic_url=https%3A%2F%2Fserving.bepolite.eu%2Fevent%3Fkey%3DFYFWuDany3hwv6rfuoAYF93T_QRJ2hBZwmsMl3Whl_99ix5uY53jsKJJwc1ygGrsJod2k2p7ECyT7Xf8GZjjJQ3JhI1rZetSRMPn9hvkuS6U77_5qqmjl-sQxYFvVV5P_lO51mNc3a12xtzS21jn071PaUfEhNNCxerdZWPZj93zp3ZdgWtH0MKue5p5AGKHXJxXiVJEh1Vfgxn38rgFo-tSrOiriedI-Oi3R5i8w-3Nph6AhIbGKPDtMF7YPxkDU4_Ogio8x-bd6qxktBd7cU06ZH0Tqu0wnEKgeSbUH3La5hY8OvOxWaQQS9P0iYfnngZXtFEp1ljuqs475VAp1Q%26clink%3D&f=https%3A%2F%2Fbanner.hookusbookus.com%2Findex_1000x200.html%3Flanguage%3Det_ee%26utmSource%3Dallmedia&clink=https%3A%2F%2Fsmartad.ee&banner_id=2b832712c40e4d1885d21996092d5e9350dd7b0f4105441f8f6018cc3fcb090c&bg=transparent&w=1000&h=200&locale=Display%20Estonia-EST&info=https%3A%2F%2Fdigital.tv3.ee%2Fbepolite-id%2F%3Futm_src%3Dbanner
IP
Requested by https://www.upload.ee/files/15695061/heg1.exe.html?msg=sess_error
Certificate IssuerAmazon
Subject*.hookusbookus.com
FingerprintCD:CD:3C:03:66:21:F8:A9:21:BC:F8:C8:3C:DC:88:0A:C5:19:F1:7A
ValiditySun, 07 May 2023 00:00:00 GMT - Tue, 04 Jun 2024 23:59:59 GMT
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, Unicode text, UTF-8 text, with very long lines (6210), with no line terminators
Hash b2c258a8d77db021c8f33f8e84dba71b
c453e30dac638f4e1b897309fe32db795d540f80
2d1065201a188a85c1a7d0a3ee130f5a8dc4e60db8fe221fb2081e77222e5a9f
GET /index_1000x200.html?language=et_ee&utmSource=allmedia&click_url=https%3A%2F%2Fserving.bepolite.eu%2Fevent%3Fkey%3DFYFWuDany3hwv6rfuoAYF93T_QRJ2hBZwmsMl3Whl_99ix5uY53jsKJJwc1ygGrsJod2k2p7ECyT7Xf8GZjjJQ3JhI1rZetSRMPn9hvkuS6U77_5qqmjl-sQxYFvVV5P_lO51mNc3a12xtzS21jn071PaUfEhNNCxerdZWPZj93zp3ZdgWtH0MKue5p5AGKHXJxXiVJEh1Vfgxn38rgFo-tSrOiriedI-Oi3R5i8w-3Nph6AhIbGKPDtMF7YPxkDU4_Ogio8x-bd6qxktBd7cU06ZH0Tqu0wnEKgeSbUH3La5hY8OvOxWaQQS9P0iYfnngZXtFEp1ljuqs475VAp1Q%26clink%3Dhttp%253A%252F%252Fsmartad.ee&dynamic_url=https%3A%2F%2Fserving.bepolite.eu%2Fevent%3Fkey%3DFYFWuDany3hwv6rfuoAYF93T_QRJ2hBZwmsMl3Whl_99ix5uY53jsKJJwc1ygGrsJod2k2p7ECyT7Xf8GZjjJQ3JhI1rZetSRMPn9hvkuS6U77_5qqmjl-sQxYFvVV5P_lO51mNc3a12xtzS21jn071PaUfEhNNCxerdZWPZj93zp3ZdgWtH0MKue5p5AGKHXJxXiVJEh1Vfgxn38rgFo-tSrOiriedI-Oi3R5i8w-3Nph6AhIbGKPDtMF7YPxkDU4_Ogio8x-bd6qxktBd7cU06ZH0Tqu0wnEKgeSbUH3La5hY8OvOxWaQQS9P0iYfnngZXtFEp1ljuqs475VAp1Q%26clink%3D&f=https%3A%2F%2Fbanner.hookusbookus.com%2Findex_1000x200.html%3Flanguage%3Det_ee%26utmSource%3Dallmedia&clink=https%3A%2F%2Fsmartad.ee&banner_id=2b832712c40e4d1885d21996092d5e9350dd7b0f4105441f8f6018cc3fcb090c&bg=transparent&w=1000&h=200&locale=Display%20Estonia-EST&info=https%3A%2F%2Fdigital.tv3.ee%2Fbepolite-id%2F%3Futm_src%3Dbanner HTTP/1.1
Host: banner.hookusbookus.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.upload.ee/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Sun, 17 Sep 2023 15:05:44 GMT
content-type: text/html
server: nginx/1.15.12
last-modified: Tue, 24 Jan 2023 14:19:47 GMT
vary: Accept-Encoding
etag: W/"63cfe903-1781"
content-encoding: gzip
X-Firefox-Spdy: h2
banner.hookusbookus.com/assets/css/index_300x600.css
200 OK 7.2 kB URL GET HTTP/2 banner.hookusbookus.com/assets/css/index_300x600.css
IP
Requested by https://banner.hookusbookus.com/index_300x600.html?language=et_ee&utmSource=allmedia&click_url=https%3A%2F%2Fserving.bepolite.eu%2Fevent%3Fkey%3DFYFWuDany3hwv6rfuoAYF93T_QRJ2hBZwmsMl3Whl_99ix5uY53jsKJJwc1ygGrsJod2k2p7ECyT7Xf8GZjjJQ3JhI1rZetSRMPn9hvkuS6U77_5qqmjl-sQxYFvVV5P_lO51mNc3a12xtzS21jn071PaUfEhNNCxerdZWPZj93zp3ZdgWtH0MKue5p5AGKHXJxXiVJEh1Vfgxn38rgFo-tSrOiriedI-Oi3R5i8w-2KEKyCRIfPP1ktkR_a1xBEN4Mp3hCHV2gL5wIlp7AQSx5xbztKZEP3IVdh-WxRkrPa5hY8OvOxWaQQS9P0iYfnngZXtFEp1ljuqs475VAp1Q%26clink%3Dhttp%253A%252F%252Fsmartad.ee&dynamic_url=https%3A%2F%2Fserving.bepolite.eu%2Fevent%3Fkey%3DFYFWuDany3hwv6rfuoAYF93T_QRJ2hBZwmsMl3Whl_99ix5uY53jsKJJwc1ygGrsJod2k2p7ECyT7Xf8GZjjJQ3JhI1rZetSRMPn9hvkuS6U77_5qqmjl-sQxYFvVV5P_lO51mNc3a12xtzS21jn071PaUfEhNNCxerdZWPZj93zp3ZdgWtH0MKue5p5AGKHXJxXiVJEh1Vfgxn38rgFo-tSrOiriedI-Oi3R5i8w-2KEKyCRIfPP1ktkR_a1xBEN4Mp3hCHV2gL5wIlp7AQSx5xbztKZEP3IVdh-WxRkrPa5hY8OvOxWaQQS9P0iYfnngZXtFEp1ljuqs475VAp1Q%26clink%3D&f=https%3A%2F%2Fbanner.hookusbookus.com%2Findex_300x600.html%3Flanguage%3Det_ee%26utmSource%3Dallmedia&clink=https%3A%2F%2Fsmartad.ee&banner_id=3b881495c84042deb0d0288185da231350dd7b0f4105441f8f6018cc3fcb090c&bg=black&w=300&h=600&locale=Display%20Estonia-EST&info=https%3A%2F%2Fdigital.tv3.ee%2Fbepolite-id%2F%3Futm_src%3Dbanner
Certificate IssuerAmazon
Subject*.hookusbookus.com
FingerprintCD:CD:3C:03:66:21:F8:A9:21:BC:F8:C8:3C:DC:88:0A:C5:19:F1:7A
ValiditySun, 07 May 2023 00:00:00 GMT - Tue, 04 Jun 2024 23:59:59 GMT
File type ASCII text, with very long lines (7402), with no line terminators
Hash ef4576b025213d57cd958c234d61a8a1
5dd8d741efe63291e503bb6bf23e603c810b9030
69478abb1501f6c8fb03f774621b5f0275d59f55b3fc4f24d95bade9e277efdb
GET /assets/css/index_300x600.css HTTP/1.1
Host: banner.hookusbookus.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://banner.hookusbookus.com/index_300x600.html?language=et_ee&utmSource=allmedia&click_url=https%3A%2F%2Fserving.bepolite.eu%2Fevent%3Fkey%3DFYFWuDany3hwv6rfuoAYF93T_QRJ2hBZwmsMl3Whl_99ix5uY53jsKJJwc1ygGrsJod2k2p7ECyT7Xf8GZjjJQ3JhI1rZetSRMPn9hvkuS6U77_5qqmjl-sQxYFvVV5P_lO51mNc3a12xtzS21jn071PaUfEhNNCxerdZWPZj93zp3ZdgWtH0MKue5p5AGKHXJxXiVJEh1Vfgxn38rgFo-tSrOiriedI-Oi3R5i8w-2KEKyCRIfPP1ktkR_a1xBEN4Mp3hCHV2gL5wIlp7AQSx5xbztKZEP3IVdh-WxRkrPa5hY8OvOxWaQQS9P0iYfnngZXtFEp1ljuqs475VAp1Q%26clink%3Dhttp%253A%252F%252Fsmartad.ee&dynamic_url=https%3A%2F%2Fserving.bepolite.eu%2Fevent%3Fkey%3DFYFWuDany3hwv6rfuoAYF93T_QRJ2hBZwmsMl3Whl_99ix5uY53jsKJJwc1ygGrsJod2k2p7ECyT7Xf8GZjjJQ3JhI1rZetSRMPn9hvkuS6U77_5qqmjl-sQxYFvVV5P_lO51mNc3a12xtzS21jn071PaUfEhNNCxerdZWPZj93zp3ZdgWtH0MKue5p5AGKHXJxXiVJEh1Vfgxn38rgFo-tSrOiriedI-Oi3R5i8w-2KEKyCRIfPP1ktkR_a1xBEN4Mp3hCHV2gL5wIlp7AQSx5xbztKZEP3IVdh-WxRkrPa5hY8OvOxWaQQS9P0iYfnngZXtFEp1ljuqs475VAp1Q%26clink%3D&f=https%3A%2F%2Fbanner.hookusbookus.com%2Findex_300x600.html%3Flanguage%3Det_ee%26utmSource%3Dallmedia&clink=https%3A%2F%2Fsmartad.ee&banner_id=3b881495c84042deb0d0288185da231350dd7b0f4105441f8f6018cc3fcb090c&bg=black&w=300&h=600&locale=Display%20Estonia-EST&info=https%3A%2F%2Fdigital.tv3.ee%2Fbepolite-id%2F%3Futm_src%3Dbanner
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Sun, 17 Sep 2023 15:05:44 GMT
content-type: text/css
server: nginx/1.15.12
last-modified: Mon, 05 Jul 2021 19:56:59 GMT
vary: Accept-Encoding
etag: W/"60e3640b-1c4f"
content-encoding: gzip
X-Firefox-Spdy: h2
static.bepolite.eu/scripts/saresponsive.js
200 OK 177 kB URL GET HTTP/2 static.bepolite.eu/scripts/saresponsive.js
IP
ASN #3327 CITIC Telecom CPC Netherlands B.V.
Requested by https://www.upload.ee/files/15695061/heg1.exe.html?msg=sess_error
Certificate IssuerLet's Encrypt
Subjectstatic.bepolite.eu
FingerprintB7:1B:BB:35:5B:E5:6E:92:4D:DE:79:2E:0E:C8:1F:0D:CE:28:88:FD
ValidityMon, 04 Sep 2023 21:06:47 GMT - Sun, 03 Dec 2023 21:06:46 GMT
Size 177 kB (177010 bytes)
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /scripts/saresponsive.js HTTP/1.1
Host: static.bepolite.eu
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.upload.ee/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
content-type: application/javascript
accept-ranges: bytes
etag: "3195357889"
last-modified: Thu, 14 Sep 2023 19:59:43 GMT
content-length: 177010
date: Sun, 17 Sep 2023 15:05:33 GMT
cache-control: must-revalidate, private
expires: -1
p3p: CP='BePolite does not have a P3P policy'
x-varnish: 440321231
age: 0
X-Firefox-Spdy: h2
dskwugy0u6y9l.cloudfront.net/hotelliveeb/images/general/1/7sIRHZVsYjhTLoQfwnHk.jpg
421 Misdirected Request 71 kB URL GET HTTP/2 dskwugy0u6y9l.cloudfront.net/hotelliveeb/images/general/1/7sIRHZVsYjhTLoQfwnHk.jpg
IP
Requested by https://banner.hookusbookus.com/index_300x600.html?language=et_ee&utmSource=allmedia&click_url=https%3A%2F%2Fserving.bepolite.eu%2Fevent%3Fkey%3DFYFWuDany3hwv6rfuoAYF93T_QRJ2hBZwmsMl3Whl_99ix5uY53jsKJJwc1ygGrsJod2k2p7ECyT7Xf8GZjjJQ3JhI1rZetSRMPn9hvkuS6U77_5qqmjl-sQxYFvVV5P_lO51mNc3a12xtzS21jn071PaUfEhNNCxerdZWPZj93zp3ZdgWtH0MKue5p5AGKHXJxXiVJEh1Vfgxn38rgFo-tSrOiriedI-Oi3R5i8w-2KEKyCRIfPP1ktkR_a1xBEN4Mp3hCHV2gL5wIlp7AQSx5xbztKZEP3IVdh-WxRkrPa5hY8OvOxWaQQS9P0iYfnngZXtFEp1ljuqs475VAp1Q%26clink%3Dhttp%253A%252F%252Fsmartad.ee&dynamic_url=https%3A%2F%2Fserving.bepolite.eu%2Fevent%3Fkey%3DFYFWuDany3hwv6rfuoAYF93T_QRJ2hBZwmsMl3Whl_99ix5uY53jsKJJwc1ygGrsJod2k2p7ECyT7Xf8GZjjJQ3JhI1rZetSRMPn9hvkuS6U77_5qqmjl-sQxYFvVV5P_lO51mNc3a12xtzS21jn071PaUfEhNNCxerdZWPZj93zp3ZdgWtH0MKue5p5AGKHXJxXiVJEh1Vfgxn38rgFo-tSrOiriedI-Oi3R5i8w-2KEKyCRIfPP1ktkR_a1xBEN4Mp3hCHV2gL5wIlp7AQSx5xbztKZEP3IVdh-WxRkrPa5hY8OvOxWaQQS9P0iYfnngZXtFEp1ljuqs475VAp1Q%26clink%3D&f=https%3A%2F%2Fbanner.hookusbookus.com%2Findex_300x600.html%3Flanguage%3Det_ee%26utmSource%3Dallmedia&clink=https%3A%2F%2Fsmartad.ee&banner_id=3b881495c84042deb0d0288185da231350dd7b0f4105441f8f6018cc3fcb090c&bg=black&w=300&h=600&locale=Display%20Estonia-EST&info=https%3A%2F%2Fdigital.tv3.ee%2Fbepolite-id%2F%3Futm_src%3Dbanner
Certificate IssuerAmazon
Subject*.cloudfront.net
FingerprintBA:0F:CD:B3:EA:19:B2:9D:99:9B:51:2D:16:33:6B:D0:3F:31:A2:AB
ValidityThu, 08 Dec 2022 00:00:00 GMT - Thu, 07 Dec 2023 23:59:59 GMT
File type JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 300x230, components 3\012- data
Hash b9c2ea2f74718e60952202d98e335b5a
f31b685ba8b5076a30685213e88752d9121a3038
ce1b765529b6c323d2617cf71aebcb0a66427d174bf120ee2e51347899e0b99f
GET /hotelliveeb/images/general/1/7sIRHZVsYjhTLoQfwnHk.jpg HTTP/1.1
Host: dskwugy0u6y9l.cloudfront.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://banner.hookusbookus.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 421 Misdirected Request
server: CloudFront
date: Sun, 17 Sep 2023 15:05:44 GMT
content-type: text/html
content-length: 1003
x-cache: Error from cloudfront
via: 1.1 d4fd24ae65d4d2b97cfdea8d2f0c21a6.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-C1
x-amz-cf-id: sLC9Jfyavd4bNFL93Vb3C_xFj8sfXyRD9ybbN8Cu4ZAyVvAhHpJzxQ==
X-Firefox-Spdy: h2
banner.hookusbookus.com/assets/image/svg/hb-logo.svg
200 OK 15 kB URL GET HTTP/2 banner.hookusbookus.com/assets/image/svg/hb-logo.svg
IP
Requested by https://banner.hookusbookus.com/index_300x600.html?language=et_ee&utmSource=allmedia&click_url=https%3A%2F%2Fserving.bepolite.eu%2Fevent%3Fkey%3DFYFWuDany3hwv6rfuoAYF93T_QRJ2hBZwmsMl3Whl_99ix5uY53jsKJJwc1ygGrsJod2k2p7ECyT7Xf8GZjjJQ3JhI1rZetSRMPn9hvkuS6U77_5qqmjl-sQxYFvVV5P_lO51mNc3a12xtzS21jn071PaUfEhNNCxerdZWPZj93zp3ZdgWtH0MKue5p5AGKHXJxXiVJEh1Vfgxn38rgFo-tSrOiriedI-Oi3R5i8w-2KEKyCRIfPP1ktkR_a1xBEN4Mp3hCHV2gL5wIlp7AQSx5xbztKZEP3IVdh-WxRkrPa5hY8OvOxWaQQS9P0iYfnngZXtFEp1ljuqs475VAp1Q%26clink%3Dhttp%253A%252F%252Fsmartad.ee&dynamic_url=https%3A%2F%2Fserving.bepolite.eu%2Fevent%3Fkey%3DFYFWuDany3hwv6rfuoAYF93T_QRJ2hBZwmsMl3Whl_99ix5uY53jsKJJwc1ygGrsJod2k2p7ECyT7Xf8GZjjJQ3JhI1rZetSRMPn9hvkuS6U77_5qqmjl-sQxYFvVV5P_lO51mNc3a12xtzS21jn071PaUfEhNNCxerdZWPZj93zp3ZdgWtH0MKue5p5AGKHXJxXiVJEh1Vfgxn38rgFo-tSrOiriedI-Oi3R5i8w-2KEKyCRIfPP1ktkR_a1xBEN4Mp3hCHV2gL5wIlp7AQSx5xbztKZEP3IVdh-WxRkrPa5hY8OvOxWaQQS9P0iYfnngZXtFEp1ljuqs475VAp1Q%26clink%3D&f=https%3A%2F%2Fbanner.hookusbookus.com%2Findex_300x600.html%3Flanguage%3Det_ee%26utmSource%3Dallmedia&clink=https%3A%2F%2Fsmartad.ee&banner_id=3b881495c84042deb0d0288185da231350dd7b0f4105441f8f6018cc3fcb090c&bg=black&w=300&h=600&locale=Display%20Estonia-EST&info=https%3A%2F%2Fdigital.tv3.ee%2Fbepolite-id%2F%3Futm_src%3Dbanner
Certificate IssuerAmazon
Subject*.hookusbookus.com
FingerprintCD:CD:3C:03:66:21:F8:A9:21:BC:F8:C8:3C:DC:88:0A:C5:19:F1:7A
ValiditySun, 07 May 2023 00:00:00 GMT - Tue, 04 Jun 2024 23:59:59 GMT
File type SVG Scalable Vector Graphics image\012- , ASCII text, with very long lines (15333), with no line terminators
Hash bf6baf947f924bf8d67e947a025def06
9ac9fccb0351b41c1545714153ed5fa2c4bfef3a
64efdaebd020c39ec366f473c831cb51e8cd5d5b1afde13a9695d1f2dae4e60e
GET /assets/image/svg/hb-logo.svg HTTP/1.1
Host: banner.hookusbookus.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://banner.hookusbookus.com/index_300x600.html?language=et_ee&utmSource=allmedia&click_url=https%3A%2F%2Fserving.bepolite.eu%2Fevent%3Fkey%3DFYFWuDany3hwv6rfuoAYF93T_QRJ2hBZwmsMl3Whl_99ix5uY53jsKJJwc1ygGrsJod2k2p7ECyT7Xf8GZjjJQ3JhI1rZetSRMPn9hvkuS6U77_5qqmjl-sQxYFvVV5P_lO51mNc3a12xtzS21jn071PaUfEhNNCxerdZWPZj93zp3ZdgWtH0MKue5p5AGKHXJxXiVJEh1Vfgxn38rgFo-tSrOiriedI-Oi3R5i8w-2KEKyCRIfPP1ktkR_a1xBEN4Mp3hCHV2gL5wIlp7AQSx5xbztKZEP3IVdh-WxRkrPa5hY8OvOxWaQQS9P0iYfnngZXtFEp1ljuqs475VAp1Q%26clink%3Dhttp%253A%252F%252Fsmartad.ee&dynamic_url=https%3A%2F%2Fserving.bepolite.eu%2Fevent%3Fkey%3DFYFWuDany3hwv6rfuoAYF93T_QRJ2hBZwmsMl3Whl_99ix5uY53jsKJJwc1ygGrsJod2k2p7ECyT7Xf8GZjjJQ3JhI1rZetSRMPn9hvkuS6U77_5qqmjl-sQxYFvVV5P_lO51mNc3a12xtzS21jn071PaUfEhNNCxerdZWPZj93zp3ZdgWtH0MKue5p5AGKHXJxXiVJEh1Vfgxn38rgFo-tSrOiriedI-Oi3R5i8w-2KEKyCRIfPP1ktkR_a1xBEN4Mp3hCHV2gL5wIlp7AQSx5xbztKZEP3IVdh-WxRkrPa5hY8OvOxWaQQS9P0iYfnngZXtFEp1ljuqs475VAp1Q%26clink%3D&f=https%3A%2F%2Fbanner.hookusbookus.com%2Findex_300x600.html%3Flanguage%3Det_ee%26utmSource%3Dallmedia&clink=https%3A%2F%2Fsmartad.ee&banner_id=3b881495c84042deb0d0288185da231350dd7b0f4105441f8f6018cc3fcb090c&bg=black&w=300&h=600&locale=Display%20Estonia-EST&info=https%3A%2F%2Fdigital.tv3.ee%2Fbepolite-id%2F%3Futm_src%3Dbanner
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Sun, 17 Sep 2023 15:05:44 GMT
content-type: image/svg+xml
server: nginx/1.15.12
last-modified: Mon, 05 Jul 2021 19:56:59 GMT
vary: Accept-Encoding
etag: W/"60e3640b-3be5"
content-encoding: gzip
X-Firefox-Spdy: h2
serving.bepolite.eu/event?key=FYFWuDany3hwv6rfuoAYF93T_QRJ2hBZwmsMl3Whl_99ix5uY53jsKJJwc1ygGrsJod2k2p7ECyT7Xf8GZjjJQ3JhI1rZetSRMPn9hvkuS6U77_5qqmjl-sQxYFvVV5P_lO51mNc3a12xtzS21jn071PaUfEhNNCxerdZWPZj93zp3ZdgWtH0MKue5p5AGKHXJxXiVJEh1Vfgxn38rgFo-tSrOiriedI-Oi3R5i8w-3Nph6AhIbGKPDtMF7YPxkDU4_Ogio8x-bd6qxktBd7cU06ZH0Tqu0wnEKgeSbUH3La5hY8OvOxWaQQS9P0iYfnf_8e5-90sra7UBdR4oM89g
200 OK 0 B URL GET HTTP/2 serving.bepolite.eu/event?key=FYFWuDany3hwv6rfuoAYF93T_QRJ2hBZwmsMl3Whl_99ix5uY53jsKJJwc1ygGrsJod2k2p7ECyT7Xf8GZjjJQ3JhI1rZetSRMPn9hvkuS6U77_5qqmjl-sQxYFvVV5P_lO51mNc3a12xtzS21jn071PaUfEhNNCxerdZWPZj93zp3ZdgWtH0MKue5p5AGKHXJxXiVJEh1Vfgxn38rgFo-tSrOiriedI-Oi3R5i8w-3Nph6AhIbGKPDtMF7YPxkDU4_Ogio8x-bd6qxktBd7cU06ZH0Tqu0wnEKgeSbUH3La5hY8OvOxWaQQS9P0iYfnf_8e5-90sra7UBdR4oM89g
IP
ASN #3327 CITIC Telecom CPC Netherlands B.V.
Requested by https://www.upload.ee/files/15695061/heg1.exe.html?msg=sess_error
Certificate IssuerLet's Encrypt
Subjectstatic.bepolite.eu
FingerprintB7:1B:BB:35:5B:E5:6E:92:4D:DE:79:2E:0E:C8:1F:0D:CE:28:88:FD
ValidityMon, 04 Sep 2023 21:06:47 GMT - Sun, 03 Dec 2023 21:06:46 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /event?key=FYFWuDany3hwv6rfuoAYF93T_QRJ2hBZwmsMl3Whl_99ix5uY53jsKJJwc1ygGrsJod2k2p7ECyT7Xf8GZjjJQ3JhI1rZetSRMPn9hvkuS6U77_5qqmjl-sQxYFvVV5P_lO51mNc3a12xtzS21jn071PaUfEhNNCxerdZWPZj93zp3ZdgWtH0MKue5p5AGKHXJxXiVJEh1Vfgxn38rgFo-tSrOiriedI-Oi3R5i8w-3Nph6AhIbGKPDtMF7YPxkDU4_Ogio8x-bd6qxktBd7cU06ZH0Tqu0wnEKgeSbUH3La5hY8OvOxWaQQS9P0iYfnf_8e5-90sra7UBdR4oM89g HTTP/1.1
Host: serving.bepolite.eu
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.upload.ee/
Cookie: bepolite_id=929806dd6c42aecd910bcbddad809e46
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
content-length: 0
date: Sun, 17 Sep 2023 15:05:34 GMT
p3p: CP='BePolite does not have a P3P policy'
x-varnish: 440834939
age: 0
accept-ranges: bytes
X-Firefox-Spdy: h2
51.91.30.159
142.250.74.131
3.127.166.206
212.47.222.20
188.114.96.1
0.0.0.0