www.upload.ee/download/15560170/a97cd721e2d81d84aedb/Fab.Generic.Hook.10082023-TheRadziu.rar
459 B URL www.upload.ee/download/15560170/a97cd721e2d81d84aedb/Fab.Generic.Hook.10082023-TheRadziu.rar
IP
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document, ASCII text, with very long lines (459), with no line terminators
Hash 8810d275a503cc9ec3653d830d3aec1b
498e2f690632c2165d1a0441bdb2ed3a09d77b02
2e20435ab56d936e18e630416e9ebf68e1325c1ab482e5cbcc3163235f27759a
GET /download/15560170/a97cd721e2d81d84aedb/Fab.Generic.Hook.10082023-TheRadziu.rar HTTP/1.1
Host: www.upload.ee
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 404 Not Found
Server: nginx
Date: Sun, 10 Sep 2023 19:13:43 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 459
Connection: keep-alive
Keep-Alive: timeout=5
Strict-Transport-Security: max-age=31536000
X-XSS-Protection: 1
P3P: CP="CAO PSA OUR"
www.upload.ee/download/15560170/a97cd721e2d81d84aedb/Fab.Generic.Hook.10082023-TheRadziu.rar
459 B URL www.upload.ee/download/15560170/a97cd721e2d81d84aedb/Fab.Generic.Hook.10082023-TheRadziu.rar
IP
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document, ASCII text, with very long lines (459), with no line terminators
Hash 8810d275a503cc9ec3653d830d3aec1b
498e2f690632c2165d1a0441bdb2ed3a09d77b02
2e20435ab56d936e18e630416e9ebf68e1325c1ab482e5cbcc3163235f27759a
GET /download/15560170/a97cd721e2d81d84aedb/Fab.Generic.Hook.10082023-TheRadziu.rar HTTP/1.1
Host: www.upload.ee
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 404 Not Found
Server: nginx
Date: Sun, 10 Sep 2023 19:13:43 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 459
Connection: keep-alive
Keep-Alive: timeout=5
Strict-Transport-Security: max-age=31536000
X-XSS-Protection: 1
P3P: CP="CAO PSA OUR"
www.upload.ee/files/15560170/Fab.Generic.Hook.10082023-TheRadziu.rar.html?msg=sess_error
9.0 kB URL www.upload.ee/files/15560170/Fab.Generic.Hook.10082023-TheRadziu.rar.html?msg=sess_error
IP
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (4526)
Hash 1b27a0da7d4f5fdce4dbaeaf1242c700
f0c669ec6192afece7f971d869fcfd5fc588f177
58c3837155989d33e29d0be9edbafbfb7514a1cb86bddff889b76322aa5f06c5
GET /files/15560170/Fab.Generic.Hook.10082023-TheRadziu.rar.html?msg=sess_error HTTP/1.1
Host: www.upload.ee
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.upload.ee/download/15560170/a97cd721e2d81d84aedb/Fab.Generic.Hook.10082023-TheRadziu.rar
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Sun, 10 Sep 2023 19:13:43 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 9016
Connection: keep-alive
Keep-Alive: timeout=20
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Last-Modified: Sun, 10 Sep 2023 22:13:43 +0300
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Strict-Transport-Security: max-age=31536000
X-XSS-Protection: 1
P3P: CP="CAO PSA OUR"
Set-Cookie: lng=eng; expires=Sun, 08-Oct-2023 19:13:43 GMT; path=/; domain=www.upload.ee; secure; httponly; SameSite=None
Content-Encoding: gzip
www.upload.ee/static/ubr__style.css
200 OK 2.9 kB URL GET HTTP/1.1 www.upload.ee/static/ubr__style.css
IP
Requested by https://www.upload.ee/files/15560170/Fab.Generic.Hook.10082023-TheRadziu.rar.html?msg=sess_error
Certificate IssuerDigiCert, Inc.
Subjectwww.upload.ee
Fingerprint50:32:93:34:C8:04:2F:84:49:77:0D:C4:DD:CA:79:C9:CB:3E:C0:F4
ValidityThu, 02 Mar 2023 00:00:00 GMT - Mon, 01 Apr 2024 23:59:59 GMT
File type ASCII text, with very long lines (591), with CRLF line terminators
Hash 3ba04e290212b44bcca8f10a60a4e879
a9b021c9019bdbb28250836039b2372a1b4d0f0f
f618b1c7be10c3203620d44c6f323be5b61ac10e67588d96cb69988b3173c7d2
GET /static/ubr__style.css HTTP/1.1
Host: www.upload.ee
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.upload.ee/files/15560170/Fab.Generic.Hook.10082023-TheRadziu.rar.html?msg=sess_error
Cookie: lng=eng
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Sun, 10 Sep 2023 19:13:43 GMT
Content-Type: text/css
Last-Modified: Fri, 04 Oct 2013 10:02:27 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Keep-Alive: timeout=20
ETag: W/"524e9233-25a0"
Expires: Sun, 17 Sep 2023 19:13:43 GMT
Cache-Control: max-age=604800
Vary: Accept-Encoding
Content-Encoding: gzip
www.googletagmanager.com/gtag/js?id=UA-6703115-1
51 kB URL www.googletagmanager.com/gtag/js?id=UA-6703115-1
IP
File type ASCII text, with very long lines (2271)
Hash a0f6e0ff439ab09d208e2ab75b5b4c67
06099d04356ddf6df26395b82ca3e86846b565fd
f7b7d15e0698f866909bb9a53a85a144fe118f3993192a18c8b43ff0b3f45deb
GET /gtag/js?id=UA-6703115-1 HTTP/1.1
Host: www.googletagmanager.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.upload.ee/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
content-encoding: br
vary: Accept-Encoding
date: Sun, 10 Sep 2023 19:13:44 GMT
expires: Sun, 10 Sep 2023 19:13:44 GMT
cache-control: private, max-age=900
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
server: Google Tag Manager
content-length: 51093
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
www.upload.ee/js/js__file_upload.js
200 OK 27 kB URL GET HTTP/1.1 www.upload.ee/js/js__file_upload.js
IP
Requested by https://www.upload.ee/files/15560170/Fab.Generic.Hook.10082023-TheRadziu.rar.html?msg=sess_error
Certificate IssuerDigiCert, Inc.
Subjectwww.upload.ee
Fingerprint50:32:93:34:C8:04:2F:84:49:77:0D:C4:DD:CA:79:C9:CB:3E:C0:F4
ValidityThu, 02 Mar 2023 00:00:00 GMT - Mon, 01 Apr 2024 23:59:59 GMT
File type Unicode text, UTF-8 text, with very long lines (1853)
Hash 617f6d5a2744bc8c02e3d2c67544bd68
f57c068257c8bc85644d3be1e845c36506cd4625
62a3bb4d9d2b5a55b6d821a75d7b155fac47def3c241e4f1215d17e022f02658
GET /js/js__file_upload.js HTTP/1.1
Host: www.upload.ee
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.upload.ee/files/15560170/Fab.Generic.Hook.10082023-TheRadziu.rar.html?msg=sess_error
Cookie: lng=eng
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Sun, 10 Sep 2023 19:13:43 GMT
Content-Type: application/javascript
Content-Length: 27351
Last-Modified: Thu, 07 May 2020 19:13:28 GMT
Connection: keep-alive
Keep-Alive: timeout=20
ETag: "5eb45dd8-6ad7"
Expires: Sun, 17 Sep 2023 19:13:43 GMT
Cache-Control: max-age=604800
Vary: Accept-Encoding
Accept-Ranges: bytes
www.upload.ee/images/arrow.gif
200 OK 59 B URL GET HTTP/1.1 www.upload.ee/images/arrow.gif
IP
Requested by https://www.upload.ee/files/15560170/Fab.Generic.Hook.10082023-TheRadziu.rar.html?msg=sess_error
Certificate IssuerDigiCert, Inc.
Subjectwww.upload.ee
Fingerprint50:32:93:34:C8:04:2F:84:49:77:0D:C4:DD:CA:79:C9:CB:3E:C0:F4
ValidityThu, 02 Mar 2023 00:00:00 GMT - Mon, 01 Apr 2024 23:59:59 GMT
File type GIF image data, version 89a, 6 x 9\012- data
Hash 6675f814b94f13f91f1383707b250e36
31452650e8fce2095613a2010799bdb7548bdd51
061d01a0b85f948c6ec464870ecec4654c4bd2ff15cacda941bbbf16225ec411
GET /images/arrow.gif HTTP/1.1
Host: www.upload.ee
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.upload.ee/files/15560170/Fab.Generic.Hook.10082023-TheRadziu.rar.html?msg=sess_error
Cookie: lng=eng
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Sun, 10 Sep 2023 19:13:44 GMT
Content-Type: image/gif
Content-Length: 59
Last-Modified: Sun, 14 Apr 2013 07:15:01 GMT
Connection: keep-alive
Keep-Alive: timeout=20
ETag: "516a5775-3b"
Expires: Sun, 17 Sep 2023 19:13:44 GMT
Cache-Control: max-age=604800
Accept-Ranges: bytes
www.upload.ee/images/dl_.png
200 OK 1.9 kB URL GET HTTP/1.1 www.upload.ee/images/dl_.png
IP
Requested by https://www.upload.ee/files/15560170/Fab.Generic.Hook.10082023-TheRadziu.rar.html?msg=sess_error
Certificate IssuerDigiCert, Inc.
Subjectwww.upload.ee
Fingerprint50:32:93:34:C8:04:2F:84:49:77:0D:C4:DD:CA:79:C9:CB:3E:C0:F4
ValidityThu, 02 Mar 2023 00:00:00 GMT - Mon, 01 Apr 2024 23:59:59 GMT
File type PNG image data, 154 x 32, 8-bit colormap, non-interlaced\012- data
Hash f3e8f284a4e98cdb91b6abfc142d94a4
fa9e618c2f56bea752ddd7e45a372c5539dadda9
2f13919383f54ca21e5b87f5644df8a875b99815c821dcbbabea352d854c6882
GET /images/dl_.png HTTP/1.1
Host: www.upload.ee
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.upload.ee/files/15560170/Fab.Generic.Hook.10082023-TheRadziu.rar.html?msg=sess_error
Cookie: lng=eng
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Sun, 10 Sep 2023 19:13:44 GMT
Content-Type: image/png
Content-Length: 1900
Last-Modified: Thu, 01 Dec 2016 09:37:27 GMT
Connection: keep-alive
Keep-Alive: timeout=20
ETag: "583fef57-76c"
Expires: Sun, 17 Sep 2023 19:13:44 GMT
Cache-Control: max-age=604800
Accept-Ranges: bytes
www.googletagmanager.com/gtag/js?id=G-LT9YQX0N49&l=dataLayer&cx=c
200 OK 85 kB URL GET HTTP/3 www.googletagmanager.com/gtag/js?id=G-LT9YQX0N49&l=dataLayer&cx=c
IP
Requested by https://www.upload.ee/files/15560170/Fab.Generic.Hook.10082023-TheRadziu.rar.html?msg=sess_error
Certificate IssuerGoogle Trust Services LLC
Subject*.google-analytics.com
FingerprintE6:F7:82:C1:10:AC:08:76:A1:97:70:B7:56:B7:EF:92:30:BA:1E:12
ValidityMon, 14 Aug 2023 08:16:28 GMT - Mon, 06 Nov 2023 08:16:27 GMT
File type ASCII text, with very long lines (3034)
Hash dd91b713610f890b0c8552771e765841
c12599daffa2490a7ac8a5c1b98cfdaeda7d0f3f
86de4854bd2b166de010fcf16140d50b8722669038587844b288ebd78238f28b
GET /gtag/js?id=G-LT9YQX0N49&l=dataLayer&cx=c HTTP/1.1
Host: www.googletagmanager.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.upload.ee/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
content-encoding: br
vary: Accept-Encoding
date: Sun, 10 Sep 2023 19:13:44 GMT
expires: Sun, 10 Sep 2023 19:13:44 GMT
cache-control: private, max-age=900
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
server: Google Tag Manager
content-length: 85393
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
du0pud0sdlmzf.cloudfront.net/?dupud=997369
118 kB URL du0pud0sdlmzf.cloudfront.net/?dupud=997369
IP
File type Unicode text, UTF-8 text, with very long lines (15948)
Size 118 kB (117792 bytes)
Hash 80a1b8bc455a0d82856b3ec356aedaf0
5e0510ce9d0e3c527e2e211e90da0a8be93ac2b5
70116ef68c68bc9060256cc372ea4ab86380347a2deff727bb6b91e1f30f1bff
GET /?dupud=997369 HTTP/1.1
Host: du0pud0sdlmzf.cloudfront.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.upload.ee/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
content-length: 117792
date: Sun, 10 Sep 2023 19:13:44 GMT
access-control-allow-origin: *
cache-control: no-store, no-cache, proxy-revalidate, must-revalidate, private, no-transform
content-encoding: gzip
pragma: no-cache
x-cache: Miss from cloudfront
via: 1.1 aac54e3fe9825ce24d51e0204433c2c0.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-C1
x-amz-cf-id: fcGuJq6pp5oG14RCE5BnON29gf1OguPzWQVl57S2KRb463wBINRzDQ==
X-Firefox-Spdy: h2
empafnyfiexpectt.info/MTRoM2QeCwtAWWQEMnczeXoZUCx7RDlkAAJRWnEha3wMAwVabU5HDVUJUQpTBQRQFRRYUFUCXBdHHFIQREdVAkJYWg5cWRdCVQJKARpaHVAXQVUCQkVECVRZABIYRxBdCVkFXQUHXwBWAwBcA1c
204 No Content 0 B URL GET HTTP/2 empafnyfiexpectt.info/MTRoM2QeCwtAWWQEMnczeXoZUCx7RDlkAAJRWnEha3wMAwVabU5HDVUJUQpTBQRQFRRYUFUCXBdHHFIQREdVAkJYWg5cWRdCVQJKARpaHVAXQVUCQkVECVRZABIYRxBdCVkFXQUHXwBWAwBcA1c
IP
Requested by https://www.upload.ee/files/15560170/Fab.Generic.Hook.10082023-TheRadziu.rar.html?msg=sess_error
Certificate IssuerLet's Encrypt
Subjectempafnyfiexpectt.info
Fingerprint0A:3C:72:5A:AE:C9:CE:C3:ED:9D:55:D4:4A:C3:28:A5:31:C0:1B:2B
ValidityMon, 04 Sep 2023 06:52:14 GMT - Sun, 03 Dec 2023 06:52:13 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /MTRoM2QeCwtAWWQEMnczeXoZUCx7RDlkAAJRWnEha3wMAwVabU5HDVUJUQpTBQRQFRRYUFUCXBdHHFIQREdVAkJYWg5cWRdCVQJKARpaHVAXQVUCQkVECVRZABIYRxBdCVkFXQUHXwBWAwBcA1c HTTP/1.1
Host: empafnyfiexpectt.info
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.upload.ee/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 204 No Content
date: Sun, 10 Sep 2023 19:13:44 GMT
access-control-allow-origin: *
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=XPlPSFn2JY%2BPh0PqvgkQU2%2FAS5GdZr6TS35ORSrzk1vi%2FCwA4H76PX9jqJz%2BC5h8WeHAUxfgTYq%2Fd7s60rqjbLiP64rnqAE4bP6RDUgpwJZBU109q39OAFcxwsVnIJSIX8qIxODwnHQ%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 8049fd6c9f8d5693-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
aticalfelixstownrus.info/Skl6VzcrKxk6CCt0GHFCOCVHcgUMbEgRUz95CiJTejoeO1owL1Q0WyU8HjFFJScOeVkvPV9lcS4HPBZPBA84D2d7cCk1Bwt8LAZbOg0tNHEIHisEeCEDGAdcGD0oOVMiHSgFVR0dMxJ5eC4pHXJ+eT4WZXgePhFRH3tKBHkccCI1Zhx7LxF2MwotBm8bCjg1eD0xIBlyPXsrAnJ5HRBmcg8gLAFVHDEYHFt6cSIBYXsLEg5yDSQ7BW4tDBkcdhwhPBZUGQwtHnUdDRY2fR8iKA5QGyY5Bn4aCBcGYggxMwVuLQ89HV8MIxkWYS0NImN1AhEvEG4MZCAFentxX2VxDAgjAHUnCDsVcAsPIxZ2GBAdBgUdDCNmYiBwMBJgADAjBnYMLx0FBRgIFj8RIDoVOUd3PjlmTg4jFzUHLRA
200 OK 1.2 kB URL GET HTTP/2 aticalfelixstownrus.info/Skl6VzcrKxk6CCt0GHFCOCVHcgUMbEgRUz95CiJTejoeO1owL1Q0WyU8HjFFJScOeVkvPV9lcS4HPBZPBA84D2d7cCk1Bwt8LAZbOg0tNHEIHisEeCEDGAdcGD0oOVMiHSgFVR0dMxJ5eC4pHXJ+eT4WZXgePhFRH3tKBHkccCI1Zhx7LxF2MwotBm8bCjg1eD0xIBlyPXsrAnJ5HRBmcg8gLAFVHDEYHFt6cSIBYXsLEg5yDSQ7BW4tDBkcdhwhPBZUGQwtHnUdDRY2fR8iKA5QGyY5Bn4aCBcGYggxMwVuLQ89HV8MIxkWYS0NImN1AhEvEG4MZCAFentxX2VxDAgjAHUnCDsVcAsPIxZ2GBAdBgUdDCNmYiBwMBJgADAjBnYMLx0FBRgIFj8RIDoVOUd3PjlmTg4jFzUHLRA
IP
Requested by https://www.upload.ee/files/15560170/Fab.Generic.Hook.10082023-TheRadziu.rar.html?msg=sess_error
Certificate IssuerAmazon
Subjectaticalfelixstownrus.info
FingerprintD6:60:E2:3A:1A:81:0A:24:51:1B:33:FA:52:EB:2F:F6:58:B1:D6:DB
ValidityMon, 04 Sep 2023 00:00:00 GMT - Wed, 02 Oct 2024 23:59:59 GMT
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (3017), with no line terminators
Hash 5442177e8a82cf0b7f0577330608f673
8cfb4dcb4d74d5e89544dc118b54d14199ac0251
2de0e58218420fc788a0466d42b73939ae898c71f2a2df0a06698f4f61b7a234
GET /Skl6VzcrKxk6CCt0GHFCOCVHcgUMbEgRUz95CiJTejoeO1owL1Q0WyU8HjFFJScOeVkvPV9lcS4HPBZPBA84D2d7cCk1Bwt8LAZbOg0tNHEIHisEeCEDGAdcGD0oOVMiHSgFVR0dMxJ5eC4pHXJ+eT4WZXgePhFRH3tKBHkccCI1Zhx7LxF2MwotBm8bCjg1eD0xIBlyPXsrAnJ5HRBmcg8gLAFVHDEYHFt6cSIBYXsLEg5yDSQ7BW4tDBkcdhwhPBZUGQwtHnUdDRY2fR8iKA5QGyY5Bn4aCBcGYggxMwVuLQ89HV8MIxkWYS0NImN1AhEvEG4MZCAFentxX2VxDAgjAHUnCDsVcAsPIxZ2GBAdBgUdDCNmYiBwMBJgADAjBnYMLx0FBRgIFj8RIDoVOUd3PjlmTg4jFzUHLRA HTTP/1.1
Host: aticalfelixstownrus.info
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.upload.ee/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
content-type: text/html
content-length: 1169
date: Sun, 10 Sep 2023 19:13:44 GMT
server: openresty/1.17.8.2
cache-control: no-store, no-cache, must-revalidate, no-transform
pragma: no-cache
p3p: CP="NID DSP ALL COR"
content-encoding: gzip
accept-ch: DPR, Width, Viewport-Width, Device-Memory, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List
x-cache: Miss from cloudfront
via: 1.1 bfeae0ecbffe44ad98e5cd0ae83bdb4a.cloudfront.net (CloudFront)
x-amz-cf-pop: ARN56-P1
x-amz-cf-id: Tt5h4KtKpMZlmsOK5ZyoPQUHf9p1QBm9BgE7xmNROWqpS_HqTC3V6Q==
X-Firefox-Spdy: h2
empafnyfiexpectt.info/a09YdmtEcDsFVj0aICQ5Lyc/Ejw9OBtEWl8VEDclMQdpGQ8qe34CAg9yYU9cWHlhUBsCK2VHTRg7OQIeGHJpUAIFKTdLTR1yaVhYX2FrQkVbaS1LWk07KBcMVn5+Bh8fI2VHXVJ7a0FYWX1sRVNa
0 B URL empafnyfiexpectt.info/a09YdmtEcDsFVj0aICQ5Lyc/Ejw9OBtEWl8VEDclMQdpGQ8qe34CAg9yYU9cWHlhUBsCK2VHTRg7OQIeGHJpUAIFKTdLTR1yaVhYX2FrQkVbaS1LWk07KBcMVn5+Bh8fI2VHXVJ7a0FYWX1sRVNa
IP
Certificate IssuerLet's Encrypt
Subjectempafnyfiexpectt.info
Fingerprint0A:3C:72:5A:AE:C9:CE:C3:ED:9D:55:D4:4A:C3:28:A5:31:C0:1B:2B
ValidityMon, 04 Sep 2023 06:52:14 GMT - Sun, 03 Dec 2023 06:52:13 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /a09YdmtEcDsFVj0aICQ5Lyc/Ejw9OBtEWl8VEDclMQdpGQ8qe34CAg9yYU9cWHlhUBsCK2VHTRg7OQIeGHJpUAIFKTdLTR1yaVhYX2FrQkVbaS1LWk07KBcMVn5+Bh8fI2VHXVJ7a0FYWX1sRVNa HTTP/1.1
Host: empafnyfiexpectt.info
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.upload.ee/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 204 No Content
date: Sun, 10 Sep 2023 19:13:44 GMT
access-control-allow-origin: *
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=m%2BfxpjTLIvYmvjH6G%2FdNLJWFK%2BM%2FmDDPnP1wIbruyVd33GOx%2B6mRJlNHo3AgiNccmLllMp5S%2F9b6owOhI1dYKvREqc75WICLS6nk7fhqy6tlqD2eL8ZLtG6KJZQp4VeLw0Uft6VhunI%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 8049fd6c9f815693-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
empafnyfiexpectt.info/bWtjbGdCVAAfWgkABysyBlIrDz8vGQYpA14PDiZVPCMhXj01BEUYDglWWlVQWVpXShcED15dQR4fAhgSHlZSSg4DDQxRQRtWUkJUWUVQWEldTRZRVksfEw0AUFpFHBMZB15dUVRfUFtUX1lXWFZV
0 B URL empafnyfiexpectt.info/bWtjbGdCVAAfWgkABysyBlIrDz8vGQYpA14PDiZVPCMhXj01BEUYDglWWlVQWVpXShcED15dQR4fAhgSHlZSSg4DDQxRQRtWUkJUWUVQWEldTRZRVksfEw0AUFpFHBMZB15dUVRfUFtUX1lXWFZV
IP
Certificate IssuerLet's Encrypt
Subjectempafnyfiexpectt.info
Fingerprint0A:3C:72:5A:AE:C9:CE:C3:ED:9D:55:D4:4A:C3:28:A5:31:C0:1B:2B
ValidityMon, 04 Sep 2023 06:52:14 GMT - Sun, 03 Dec 2023 06:52:13 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /bWtjbGdCVAAfWgkABysyBlIrDz8vGQYpA14PDiZVPCMhXj01BEUYDglWWlVQWVpXShcED15dQR4fAhgSHlZSSg4DDQxRQRtWUkJUWUVQWEldTRZRVksfEw0AUFpFHBMZB15dUVRfUFtUX1lXWFZV HTTP/1.1
Host: empafnyfiexpectt.info
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.upload.ee/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 204 No Content
date: Sun, 10 Sep 2023 19:13:44 GMT
access-control-allow-origin: *
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=kVR%2FG%2Bq4Gz4hvA6EsLFub%2Be5rgQ3I4MMrggwuQ9%2BEJmWyH3FRPspfT6oXK7DEnNPV%2Bvk0jZCOU8vdoIAGFkOpyh4ZpYhNV4dTqa%2BDilxZ%2FcMSRP6tBr%2FTjnF4OqDtmCpTdRQsoibeZM%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 8049fd6c9f8b5693-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
aticalfelixstownrus.info/YXpybjEAGBEDDgBHEEhEExZPSwMnX0AoVRRKAhtVUQkWAlwbHFwNXQ4PFghDDhQGQF8EDldcdyU0JThzMkgeOXIIQgY4WiQ3ODZrMD40JEgHLDM6dRszGSwBNyMwBngLHghWSCwdQwt9NQk8OgEkHDg2azs/BQVWKytGJ2AYKx4tVgkvKBdeLyxDBgADKEMocggKQCx3JB44FEICLxpWQjERSy9zKQ0fLFpZNz49Uig/NA15BxERKGApNEU/ZFAvESkEAB5CLEsEDSQNchsrCDpwBSw9Nn8HGx4gAAMWAl1gKTRFKQEvOxEJQTg4JBZHBEozP2dSVzcddScjPSJcVBgRX1UZHx4FdzcyNFhlIB4kJEgoGCcvfBQ3Qhl5KEkwWGYjDiQ0S1QvMC8XCwkdAEFcPSskczsJCwpaKQA0
200 OK 1.2 kB URL GET HTTP/2 aticalfelixstownrus.info/YXpybjEAGBEDDgBHEEhEExZPSwMnX0AoVRRKAhtVUQkWAlwbHFwNXQ4PFghDDhQGQF8EDldcdyU0JThzMkgeOXIIQgY4WiQ3ODZrMD40JEgHLDM6dRszGSwBNyMwBngLHghWSCwdQwt9NQk8OgEkHDg2azs/BQVWKytGJ2AYKx4tVgkvKBdeLyxDBgADKEMocggKQCx3JB44FEICLxpWQjERSy9zKQ0fLFpZNz49Uig/NA15BxERKGApNEU/ZFAvESkEAB5CLEsEDSQNchsrCDpwBSw9Nn8HGx4gAAMWAl1gKTRFKQEvOxEJQTg4JBZHBEozP2dSVzcddScjPSJcVBgRX1UZHx4FdzcyNFhlIB4kJEgoGCcvfBQ3Qhl5KEkwWGYjDiQ0S1QvMC8XCwkdAEFcPSskczsJCwpaKQA0
IP
Requested by https://www.upload.ee/files/15560170/Fab.Generic.Hook.10082023-TheRadziu.rar.html?msg=sess_error
Certificate IssuerAmazon
Subjectaticalfelixstownrus.info
FingerprintD6:60:E2:3A:1A:81:0A:24:51:1B:33:FA:52:EB:2F:F6:58:B1:D6:DB
ValidityMon, 04 Sep 2023 00:00:00 GMT - Wed, 02 Oct 2024 23:59:59 GMT
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (3020), with no line terminators
Hash 29dac5ae3c944622b2326279de58825b
dc35adf6e8522e8add1a94ab699904924f3e92f4
cee2a9c873975b2ebea08ed24ec159a42a3d743f6d74541d1ce291efff0f7593
GET /YXpybjEAGBEDDgBHEEhEExZPSwMnX0AoVRRKAhtVUQkWAlwbHFwNXQ4PFghDDhQGQF8EDldcdyU0JThzMkgeOXIIQgY4WiQ3ODZrMD40JEgHLDM6dRszGSwBNyMwBngLHghWSCwdQwt9NQk8OgEkHDg2azs/BQVWKytGJ2AYKx4tVgkvKBdeLyxDBgADKEMocggKQCx3JB44FEICLxpWQjERSy9zKQ0fLFpZNz49Uig/NA15BxERKGApNEU/ZFAvESkEAB5CLEsEDSQNchsrCDpwBSw9Nn8HGx4gAAMWAl1gKTRFKQEvOxEJQTg4JBZHBEozP2dSVzcddScjPSJcVBgRX1UZHx4FdzcyNFhlIB4kJEgoGCcvfBQ3Qhl5KEkwWGYjDiQ0S1QvMC8XCwkdAEFcPSskczsJCwpaKQA0 HTTP/1.1
Host: aticalfelixstownrus.info
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.upload.ee/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
content-type: text/html
content-length: 1172
date: Sun, 10 Sep 2023 19:13:44 GMT
server: openresty/1.17.8.2
cache-control: no-store, no-cache, must-revalidate, no-transform
pragma: no-cache
p3p: CP="NID DSP ALL COR"
content-encoding: gzip
accept-ch: DPR, Width, Viewport-Width, Device-Memory, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List
x-cache: Miss from cloudfront
via: 1.1 bfeae0ecbffe44ad98e5cd0ae83bdb4a.cloudfront.net (CloudFront)
x-amz-cf-pop: ARN56-P1
x-amz-cf-id: EpHhejvwfTIo9KdaZ4NJLS0wOIt3xPqN889YsKLeGnfHBCjigDDDyA==
X-Firefox-Spdy: h2
aticalfelixstownrus.info/akFEUWoLIyc8VQt8JncfGC15dFgsZHYXDh9xNCQOWjIgPQcQJ2oyBgU0IDcYBS8wfwQPNWFjLDIWLjJYPDsJZD0sJjwVKV8kETwFIRgzECkwNjBpMj8UcAk5BQohODwmAikfXCwEN2guWS08AxMoFQdjCTwPKAszJwBxaT8GJnQVBxkTEiskOBszHDsjLQ4/PQYqMAYAMCMSYiMoCQUYMzA5Hj4oEnUyEAcZEgYDPz0gBTULOi10Jz4SDygQEyMRBRANLCMsGCwsEx4+KFoQLBcHBnMGYwkhJQUyDAkmAiA/LAx0Bi4/EgYTLyggIwgtMDYOICgCbAo9KxA5IQMuIBcKBFI+GxwHGCgmIGQrWTkHElgzZy4iBQQxeR0YEhEQHSkSJnwe
1.2 kB URL aticalfelixstownrus.info/akFEUWoLIyc8VQt8JncfGC15dFgsZHYXDh9xNCQOWjIgPQcQJ2oyBgU0IDcYBS8wfwQPNWFjLDIWLjJYPDsJZD0sJjwVKV8kETwFIRgzECkwNjBpMj8UcAk5BQohODwmAikfXCwEN2guWS08AxMoFQdjCTwPKAszJwBxaT8GJnQVBxkTEiskOBszHDsjLQ4/PQYqMAYAMCMSYiMoCQUYMzA5Hj4oEnUyEAcZEgYDPz0gBTULOi10Jz4SDygQEyMRBRANLCMsGCwsEx4+KFoQLBcHBnMGYwkhJQUyDAkmAiA/LAx0Bi4/EgYTLyggIwgtMDYOICgCbAo9KxA5IQMuIBcKBFI+GxwHGCgmIGQrWTkHElgzZy4iBQQxeR0YEhEQHSkSJnwe
IP
Certificate IssuerAmazon
Subjectaticalfelixstownrus.info
FingerprintD6:60:E2:3A:1A:81:0A:24:51:1B:33:FA:52:EB:2F:F6:58:B1:D6:DB
ValidityMon, 04 Sep 2023 00:00:00 GMT - Wed, 02 Oct 2024 23:59:59 GMT
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (2996), with no line terminators
Hash 4777715528ac16e02c606df7ed029510
31ca658b75aab2c3a0b510169ad97e0029111573
037697e2088802145705bca5a930591b874c8e1ef0f58ab85044ac70aad12943
GET /akFEUWoLIyc8VQt8JncfGC15dFgsZHYXDh9xNCQOWjIgPQcQJ2oyBgU0IDcYBS8wfwQPNWFjLDIWLjJYPDsJZD0sJjwVKV8kETwFIRgzECkwNjBpMj8UcAk5BQohODwmAikfXCwEN2guWS08AxMoFQdjCTwPKAszJwBxaT8GJnQVBxkTEiskOBszHDsjLQ4/PQYqMAYAMCMSYiMoCQUYMzA5Hj4oEnUyEAcZEgYDPz0gBTULOi10Jz4SDygQEyMRBRANLCMsGCwsEx4+KFoQLBcHBnMGYwkhJQUyDAkmAiA/LAx0Bi4/EgYTLyggIwgtMDYOICgCbAo9KxA5IQMuIBcKBFI+GxwHGCgmIGQrWTkHElgzZy4iBQQxeR0YEhEQHSkSJnwe HTTP/1.1
Host: aticalfelixstownrus.info
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.upload.ee/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
content-type: text/html
content-length: 1155
date: Sun, 10 Sep 2023 19:13:44 GMT
server: openresty/1.17.8.2
cache-control: no-store, no-cache, must-revalidate, no-transform
pragma: no-cache
p3p: CP="NID DSP ALL COR"
content-encoding: gzip
accept-ch: DPR, Width, Viewport-Width, Device-Memory, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List
x-cache: Miss from cloudfront
via: 1.1 bfeae0ecbffe44ad98e5cd0ae83bdb4a.cloudfront.net (CloudFront)
x-amz-cf-pop: ARN56-P1
x-amz-cf-id: sOh8KW6O1_GKB3FampbSENuLAzGNmOSlqrFa9ur3UyoflGUQ3vx2mw==
X-Firefox-Spdy: h2
www.upload.ee/favicon.ico
200 OK 1.2 kB URL GET HTTP/1.1 www.upload.ee/favicon.ico
IP
Requested by https://www.upload.ee/files/15560170/Fab.Generic.Hook.10082023-TheRadziu.rar.html?msg=sess_error
Certificate IssuerDigiCert, Inc.
Subjectwww.upload.ee
Fingerprint50:32:93:34:C8:04:2F:84:49:77:0D:C4:DD:CA:79:C9:CB:3E:C0:F4
ValidityThu, 02 Mar 2023 00:00:00 GMT - Mon, 01 Apr 2024 23:59:59 GMT
File type MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel\012- data
Hash f299cf2e651c19e48d27900ced493ccb
c2d1086d517d7a26292e0d7b32da7c55b166c23b
115c8eb4840245f7aed0cb2a17fa7e91b86f79bb2f223a25af8cc533e1dedff1
GET /favicon.ico HTTP/1.1
Host: www.upload.ee
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.upload.ee/files/15560170/Fab.Generic.Hook.10082023-TheRadziu.rar.html?msg=sess_error
Cookie: lng=eng; _ga_LT9YQX0N49=GS1.1.1694373224.1.0.1694373224.0.0.0; _ga=GA1.1.183555524.1694373224
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Sun, 10 Sep 2023 19:13:44 GMT
Content-Type: image/x-icon
Content-Length: 1150
Last-Modified: Tue, 16 Dec 2008 17:17:25 GMT
Connection: keep-alive
Keep-Alive: timeout=20
ETag: "4947e2a5-47e"
Expires: Sun, 17 Sep 2023 19:13:44 GMT
Cache-Control: max-age=604800
Accept-Ranges: bytes
accounts.google.com/ServiceLogin?passive=true&continue=https%3A%2F%2Fwww.google.com%2Ffavicon.ico&uilel=3&hl=en&service=mail
302 Found 0 B URL GET HTTP/2 accounts.google.com/ServiceLogin?passive=true&continue=https%3A%2F%2Fwww.google.com%2Ffavicon.ico&uilel=3&hl=en&service=mail
IP
Requested by https://www.upload.ee/files/15560170/Fab.Generic.Hook.10082023-TheRadziu.rar.html?msg=sess_error
Certificate IssuerGoogle Trust Services LLC
Subjectaccounts.google.com
Fingerprint75:5C:17:06:78:FB:DD:37:D1:56:96:14:FC:26:4B:66:26:5F:D9:9D
ValidityMon, 14 Aug 2023 08:23:05 GMT - Mon, 06 Nov 2023 08:23:04 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /ServiceLogin?passive=true&continue=https%3A%2F%2Fwww.google.com%2Ffavicon.ico&uilel=3&hl=en&service=mail HTTP/1.1
Host: accounts.google.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.upload.ee/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 302 Found
content-type: application/binary
set-cookie: __Host-GAPS=1:8IRJVymQRvQVZnK7WBdUVyEi2xMQgg:D3gjX2gg9sShBb-2; Expires=Tue, 09-Sep-2025 19:13:44 GMT; Path=/; Secure; HttpOnly; Priority=HIGH
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: Mon, 01 Jan 1990 00:00:00 GMT
date: Sun, 10 Sep 2023 19:13:44 GMT
location: https://accounts.google.com/InteractiveLogin?continue=https://www.google.com/favicon.ico&hl=en&passive=true&service=mail&uilel=3&ifkv=AYZoVhfFZcG8o9sox-UhcnSdelXibJepQd5kr1RNijRxtRjFQ2vdys87PephauMst9WOdpLNtUmEKA
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: unsafe-none
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
content-security-policy: require-trusted-types-for 'script';report-uri /_/AccountsSigninPassiveLoginHttp/cspreport, script-src 'nonce-hoJIOwjYZFxX9rMk_V8i9g' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/AccountsSigninPassiveLoginHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/AccountsSigninPassiveLoginHttp/cspreport/allowlist
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
server: ESF
content-length: 0
x-xss-protection: 0
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
accounts.google.com/ServiceLogin?passive=true&continue=https%3A%2F%2Fwww.youtube.com%2Ffavicon.ico&uilel=3&hl=en&service=youtube
302 Found 0 B URL GET HTTP/2 accounts.google.com/ServiceLogin?passive=true&continue=https%3A%2F%2Fwww.youtube.com%2Ffavicon.ico&uilel=3&hl=en&service=youtube
IP
Requested by https://www.upload.ee/files/15560170/Fab.Generic.Hook.10082023-TheRadziu.rar.html?msg=sess_error
Certificate IssuerGoogle Trust Services LLC
Subjectaccounts.google.com
Fingerprint75:5C:17:06:78:FB:DD:37:D1:56:96:14:FC:26:4B:66:26:5F:D9:9D
ValidityMon, 14 Aug 2023 08:23:05 GMT - Mon, 06 Nov 2023 08:23:04 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /ServiceLogin?passive=true&continue=https%3A%2F%2Fwww.youtube.com%2Ffavicon.ico&uilel=3&hl=en&service=youtube HTTP/1.1
Host: accounts.google.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.upload.ee/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 302 Found
content-type: application/binary
set-cookie: __Host-GAPS=1:NxR2fZC67IeUV8Pd5x4-2mjS2K7TZw:SWnUgMreqjxDeykz; Expires=Tue, 09-Sep-2025 19:13:44 GMT; Path=/; Secure; HttpOnly; Priority=HIGH
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: Mon, 01 Jan 1990 00:00:00 GMT
date: Sun, 10 Sep 2023 19:13:44 GMT
location: https://accounts.google.com/InteractiveLogin?continue=https://www.youtube.com/favicon.ico&hl=en&passive=true&service=youtube&uilel=3&ifkv=AYZoVhcvFQfcbzW-BsugQJQn_C10fLdnVuhtYiQm4ZdMsJCPRKaB1SFh1HUbk3A4P1qrT9ZZGCYl_w
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-opener-policy: unsafe-none
cross-origin-resource-policy: cross-origin
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
content-security-policy: script-src 'nonce-1abq43VOvUGH-wWTSIqZfA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/AccountsSigninPassiveLoginHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/AccountsSigninPassiveLoginHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/AccountsSigninPassiveLoginHttp/cspreport
server: ESF
content-length: 0
x-xss-protection: 0
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
aticalfelixstownrus.info/utx?cb=QXm5DFMv29oM&top=www.upload.ee&tid=997414
0 B URL aticalfelixstownrus.info/utx?cb=QXm5DFMv29oM&top=www.upload.ee&tid=997414
IP
Certificate IssuerAmazon
Subjectaticalfelixstownrus.info
FingerprintD6:60:E2:3A:1A:81:0A:24:51:1B:33:FA:52:EB:2F:F6:58:B1:D6:DB
ValidityMon, 04 Sep 2023 00:00:00 GMT - Wed, 02 Oct 2024 23:59:59 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /utx?cb=QXm5DFMv29oM&top=www.upload.ee&tid=997414 HTTP/1.1
Host: aticalfelixstownrus.info
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://www.upload.ee
DNT: 1
Connection: keep-alive
Referer: https://www.upload.ee/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 204 No Content
date: Sun, 10 Sep 2023 19:13:44 GMT
server: openresty/1.17.8.2
access-control-allow-credentials: true
access-control-allow-origin: https://www.upload.ee
cache-control: no-store, no-cache, must-revalidate, no-transform
pragma: no-cache
p3p: CP="NID DSP ALL COR"
set-cookie: ut=x; Expires=Sun, 10 Sep 2023 19:14:44 GMT; Max-Age=60
accept-ch: DPR, Width, Viewport-Width, Device-Memory, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List
x-cache: Miss from cloudfront
via: 1.1 bfeae0ecbffe44ad98e5cd0ae83bdb4a.cloudfront.net (CloudFront)
x-amz-cf-pop: ARN56-P1
x-amz-cf-id: RjwxW-qR6wbn0T2QYWXsYH_2Z3zSbz9ZZ7FIElWYBaPK5R4LMf-M-g==
X-Firefox-Spdy: h2
aticalfelixstownrus.info/utx?cb=tetkeFB4QMkX&top=www.upload.ee&tid=997369
204 No Content 0 B URL GET HTTP/2 aticalfelixstownrus.info/utx?cb=tetkeFB4QMkX&top=www.upload.ee&tid=997369
IP
Requested by https://www.upload.ee/files/15560170/Fab.Generic.Hook.10082023-TheRadziu.rar.html?msg=sess_error
Certificate IssuerAmazon
Subjectaticalfelixstownrus.info
FingerprintD6:60:E2:3A:1A:81:0A:24:51:1B:33:FA:52:EB:2F:F6:58:B1:D6:DB
ValidityMon, 04 Sep 2023 00:00:00 GMT - Wed, 02 Oct 2024 23:59:59 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /utx?cb=tetkeFB4QMkX&top=www.upload.ee&tid=997369 HTTP/1.1
Host: aticalfelixstownrus.info
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://www.upload.ee
DNT: 1
Connection: keep-alive
Referer: https://www.upload.ee/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 204 No Content
date: Sun, 10 Sep 2023 19:13:44 GMT
server: openresty/1.17.8.2
access-control-allow-credentials: true
access-control-allow-origin: https://www.upload.ee
cache-control: no-store, no-cache, must-revalidate, no-transform
pragma: no-cache
p3p: CP="NID DSP ALL COR"
set-cookie: ut=x; Expires=Sun, 10 Sep 2023 19:14:44 GMT; Max-Age=60
accept-ch: DPR, Width, Viewport-Width, Device-Memory, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List
x-cache: Miss from cloudfront
via: 1.1 bfeae0ecbffe44ad98e5cd0ae83bdb4a.cloudfront.net (CloudFront)
x-amz-cf-pop: ARN56-P1
x-amz-cf-id: spyR2M01XJ8dHF29sa09xhc9EYJLds_gMD6h4F5fp0YIlUqoGdfE4A==
X-Firefox-Spdy: h2
accounts.google.com/InteractiveLogin?continue=https://www.google.com/favicon.ico&hl=en&passive=true&service=mail&uilel=3&ifkv=AYZoVhfFZcG8o9sox-UhcnSdelXibJepQd5kr1RNijRxtRjFQ2vdys87PephauMst9WOdpLNtUmEKA
302 Found 399 B URL GET HTTP/2 accounts.google.com/InteractiveLogin?continue=https://www.google.com/favicon.ico&hl=en&passive=true&service=mail&uilel=3&ifkv=AYZoVhfFZcG8o9sox-UhcnSdelXibJepQd5kr1RNijRxtRjFQ2vdys87PephauMst9WOdpLNtUmEKA
IP
Requested by https://www.upload.ee/files/15560170/Fab.Generic.Hook.10082023-TheRadziu.rar.html?msg=sess_error
Certificate IssuerGoogle Trust Services LLC
Subjectaccounts.google.com
Fingerprint75:5C:17:06:78:FB:DD:37:D1:56:96:14:FC:26:4B:66:26:5F:D9:9D
ValidityMon, 14 Aug 2023 08:23:05 GMT - Mon, 06 Nov 2023 08:23:04 GMT
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document, ASCII text, with very long lines (394)
Hash a6aee9e7b1efd5df2953eb5cff4e805e
04c1d88297e7e5b67ba2b8fb71cb1c3a3848ca0d
5924da3c0caef1290e67440c76abf86cb9be8f7aee663fbf1d50743073bb70a2
GET /InteractiveLogin?continue=https://www.google.com/favicon.ico&hl=en&passive=true&service=mail&uilel=3&ifkv=AYZoVhfFZcG8o9sox-UhcnSdelXibJepQd5kr1RNijRxtRjFQ2vdys87PephauMst9WOdpLNtUmEKA HTTP/1.1
Host: accounts.google.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://www.upload.ee/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 302 Found
content-type: text/html; charset=UTF-8
set-cookie: __Host-GAPS=1:ZrCDBRIDuM2_jHfr-WRV1Lq24oWJkg:GPqx_qyFY-nLzdns;Path=/;Expires=Tue, 09-Sep-2025 19:13:44 GMT;Secure;HttpOnly;Priority=HIGH
x-frame-options: DENY
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: Mon, 01 Jan 1990 00:00:00 GMT
date: Sun, 10 Sep 2023 19:13:44 GMT
location: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fwww.google.com%2Ffavicon.ico&hl=en&ifkv=AYZoVhdLkMN0vQNMr2aSuDK3Iovr9aRkAwERhfZo0Wb4U4HiIxrBoqDudU7HlkIq9Or8n_nn0k30nw&passive=true&service=mail&uilel=3&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S302281902%3A1694373224827514&theme=glif
strict-transport-security: max-age=31536000; includeSubDomains
report-to: {"group":"coop_gse_qebhlk","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gse_qebhlk"}]}
content-security-policy: require-trusted-types-for 'script';report-uri /cspreport, script-src 'nonce-v7OQ8weDV00wOz1A_twoHw' 'unsafe-inline' 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /cspreport
cross-origin-opener-policy-report-only: same-origin; report-to="coop_gse_qebhlk"
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-length: 399
server: GSE
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
accounts.google.com/InteractiveLogin?continue=https://www.youtube.com/favicon.ico&hl=en&passive=true&service=youtube&uilel=3&ifkv=AYZoVhcvFQfcbzW-BsugQJQn_C10fLdnVuhtYiQm4ZdMsJCPRKaB1SFh1HUbk3A4P1qrT9ZZGCYl_w
302 Found 406 B URL GET HTTP/3 accounts.google.com/InteractiveLogin?continue=https://www.youtube.com/favicon.ico&hl=en&passive=true&service=youtube&uilel=3&ifkv=AYZoVhcvFQfcbzW-BsugQJQn_C10fLdnVuhtYiQm4ZdMsJCPRKaB1SFh1HUbk3A4P1qrT9ZZGCYl_w
IP
Requested by https://www.upload.ee/files/15560170/Fab.Generic.Hook.10082023-TheRadziu.rar.html?msg=sess_error
Certificate IssuerGoogle Trust Services LLC
Subject*.google.com
Fingerprint5A:48:5B:27:A7:FB:0B:D6:63:83:8E:8E:80:DB:29:B7:2C:72:A8:8E
ValidityMon, 14 Aug 2023 08:16:28 GMT - Mon, 06 Nov 2023 08:16:27 GMT
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document, ASCII text, with very long lines (399)
Hash 26a677e6c01fd2009fab815b24169c34
6592972a89a054e77691902f268818dd943a8fa0
af2f1a6dce1197207e023fe0e23954b0d0ed167d79f5b0bcb2e407c16b25af95
GET /InteractiveLogin?continue=https://www.youtube.com/favicon.ico&hl=en&passive=true&service=youtube&uilel=3&ifkv=AYZoVhcvFQfcbzW-BsugQJQn_C10fLdnVuhtYiQm4ZdMsJCPRKaB1SFh1HUbk3A4P1qrT9ZZGCYl_w HTTP/1.1
Host: accounts.google.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://www.upload.ee/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 302 Found
content-type: text/html; charset=UTF-8
set-cookie: __Host-GAPS=1:FG3WWsF_n0sDhr-cwlOHhbWA_jyqGw:ee2G2Vm3DEdsONgV;Path=/;Expires=Tue, 09-Sep-2025 19:13:44 GMT;Secure;HttpOnly;Priority=HIGH
x-frame-options: DENY
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: Mon, 01 Jan 1990 00:00:00 GMT
date: Sun, 10 Sep 2023 19:13:44 GMT
location: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fwww.youtube.com%2Ffavicon.ico&hl=en&ifkv=AYZoVhdG3z5gPouCuzxyrsSJVg1wDLXip8P1t7ClbmvG8s8zPezvEHd5eDKdKjJRuudzG_-EMontaQ&passive=true&service=youtube&uilel=3&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S1644324714%3A1694373224835831&theme=glif
strict-transport-security: max-age=31536000; includeSubDomains
report-to: {"group":"coop_gse_qebhlk","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gse_qebhlk"}]}
content-security-policy: script-src 'nonce-RWGdoSMl4QywNT2W4zOzhQ' 'unsafe-inline' 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /cspreport, require-trusted-types-for 'script';report-uri /cspreport
cross-origin-opener-policy-report-only: same-origin; report-to="coop_gse_qebhlk"
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-length: 406
server: GSE
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
du0pud0sdlmzf.cloudfront.net/dNFAxNFBXP19Sb0A5VQlpDWcFBWQSOkJbPkRtRndhTRRbWTIEN2gSJE40DAR2WDFfU20SNV9XbQV2UFAyCWQXQCBbOwxZNEw2QUE3Tj1EEiVVbVxbKl08XVV1BhYEGmARYgEcKAVhFAcSEWIBWDlaJUkRYgQoCQIPAmQUBxIRYgFGJhFjcAVgDX4BHXUGYF-ZRM18/FAYWBmAABGAFYAARYgQ2WEY1Uj9JEWJyYQAFfgR2RAlh
584 B URL du0pud0sdlmzf.cloudfront.net/dNFAxNFBXP19Sb0A5VQlpDWcFBWQSOkJbPkRtRndhTRRbWTIEN2gSJE40DAR2WDFfU20SNV9XbQV2UFAyCWQXQCBbOwxZNEw2QUE3Tj1EEiVVbVxbKl08XVV1BhYEGmARYgEcKAVhFAcSEWIBWDlaJUkRYgQoCQIPAmQUBxIRYgFGJhFjcAVgDX4BHXUGYF-ZRM18/FAYWBmAABGAFYAARYgQ2WEY1Uj9JEWJyYQAFfgR2RAlh
IP
File type ASCII text, with very long lines (815), with no line terminators
Hash fc113e3e16ba73c23d7d31f5e47592a1
f61400c0b72763201ec43312a0dc4f34fb54f2a7
3906c22da091373d3e0070f1628a5afdfb88ccee4f02c4a51eb287cccc48bec1
GET /dNFAxNFBXP19Sb0A5VQlpDWcFBWQSOkJbPkRtRndhTRRbWTIEN2gSJE40DAR2WDFfU20SNV9XbQV2UFAyCWQXQCBbOwxZNEw2QUE3Tj1EEiVVbVxbKl08XVV1BhYEGmARYgEcKAVhFAcSEWIBWDlaJUkRYgQoCQIPAmQUBxIRYgFGJhFjcAVgDX4BHXUGYF-ZRM18/FAYWBmAABGAFYAARYgQ2WEY1Uj9JEWJyYQAFfgR2RAlh HTTP/1.1
Host: du0pud0sdlmzf.cloudfront.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://aticalfelixstownrus.info/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
content-length: 584
date: Sun, 10 Sep 2023 19:13:44 GMT
access-control-allow-origin: *
cache-control: max-age=31556926
content-encoding: gzip
x-cache: Miss from cloudfront
via: 1.1 aac54e3fe9825ce24d51e0204433c2c0.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-C1
x-amz-cf-id: qgNm10iJ2RMRG64Y_XNjF5P0jcpXypC4B2Wq6If8toGBTBtWvXB1kA==
X-Firefox-Spdy: h2
du0pud0sdlmzf.cloudfront.net/DNWVBS2lWCi8tVkEMJXZQDFJyfVATDzIkB0VYBhIjdz8yMg1eLTsNT0EfJXZZEwkgJQ4IQyQlCghUZyoNV1h1bR1FCip2BFEdJzscUh8sPk9ABHwmBk8MLScIEFcHfkcFQHN7QU1UcG5ad0BzewVcCzQzTAdVOXNfalN1blp3QHN7G0NAcgpYBVxve0AQV3-EsDFYOLm5bc1dxelkFVHF6TAdVJyIbUAMuM0wHI3B6WBtVZz5UBA
624 B URL du0pud0sdlmzf.cloudfront.net/DNWVBS2lWCi8tVkEMJXZQDFJyfVATDzIkB0VYBhIjdz8yMg1eLTsNT0EfJXZZEwkgJQ4IQyQlCghUZyoNV1h1bR1FCip2BFEdJzscUh8sPk9ABHwmBk8MLScIEFcHfkcFQHN7QU1UcG5ad0BzewVcCzQzTAdVOXNfalN1blp3QHN7G0NAcgpYBVxve0AQV3-EsDFYOLm5bc1dxelkFVHF6TAdVJyIbUAMuM0wHI3B6WBtVZz5UBA
IP
File type ASCII text, with very long lines (884), with no line terminators
Hash d870ea00a94d993d80afcccb0ce0eaf4
b7057718cba27d2cf22b62df798adb3dde24713a
c6d13eb0a787adaf495c188edd876b45c2d55006244c8bcee5abf7c73b7e19a6
GET /DNWVBS2lWCi8tVkEMJXZQDFJyfVATDzIkB0VYBhIjdz8yMg1eLTsNT0EfJXZZEwkgJQ4IQyQlCghUZyoNV1h1bR1FCip2BFEdJzscUh8sPk9ABHwmBk8MLScIEFcHfkcFQHN7QU1UcG5ad0BzewVcCzQzTAdVOXNfalN1blp3QHN7G0NAcgpYBVxve0AQV3-EsDFYOLm5bc1dxelkFVHF6TAdVJyIbUAMuM0wHI3B6WBtVZz5UBA HTTP/1.1
Host: du0pud0sdlmzf.cloudfront.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://aticalfelixstownrus.info/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
content-length: 624
date: Sun, 10 Sep 2023 19:13:44 GMT
access-control-allow-origin: *
cache-control: max-age=31556926
content-encoding: gzip
x-cache: Miss from cloudfront
via: 1.1 aac54e3fe9825ce24d51e0204433c2c0.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-C1
x-amz-cf-id: FqBcK_iPEatazAp4rpHDZc2KavZRJV62ZivwAMWy0FZm-iQkrxj5lA==
X-Firefox-Spdy: h2
du0pud0sdlmzf.cloudfront.net/XWjc2VzM5WFgxDC5eUmoKYwACZwt8XUU4XSoKeiVLCmN6FEs9D3lxRyBTC2cVNlZYMA58Ulg0DmsRVzNRZwMQIlJnWlktWjZbV3IBHAIYZxZoBx4vAmsSBRUWaAdaPl0vTxNlAyIPAAgFbhIFFRZoB0QhFml2B2cKdAcfcgFqUFM0WDUSBBEBagYGZwJqBh-NlAzxeRDJVNU8TZXVrBgd5A3xCC2Y
198 B URL du0pud0sdlmzf.cloudfront.net/XWjc2VzM5WFgxDC5eUmoKYwACZwt8XUU4XSoKeiVLCmN6FEs9D3lxRyBTC2cVNlZYMA58Ulg0DmsRVzNRZwMQIlJnWlktWjZbV3IBHAIYZxZoBx4vAmsSBRUWaAdaPl0vTxNlAyIPAAgFbhIFFRZoB0QhFml2B2cKdAcfcgFqUFM0WDUSBBEBagYGZwJqBh-NlAzxeRDJVNU8TZXVrBgd5A3xCC2Y
IP
File type ASCII text, with no line terminators
Hash d8c0008d48a4ab2cd757d8b6501ccfe7
4737f41093663cc0be3245bbb00fc12ce3d60257
34fbce6d9df6e8ad02a075d294e669e79816fbf727f40adec380f781a095d353
GET /XWjc2VzM5WFgxDC5eUmoKYwACZwt8XUU4XSoKeiVLCmN6FEs9D3lxRyBTC2cVNlZYMA58Ulg0DmsRVzNRZwMQIlJnWlktWjZbV3IBHAIYZxZoBx4vAmsSBRUWaAdaPl0vTxNlAyIPAAgFbhIFFRZoB0QhFml2B2cKdAcfcgFqUFM0WDUSBBEBagYGZwJqBh-NlAzxeRDJVNU8TZXVrBgd5A3xCC2Y HTTP/1.1
Host: du0pud0sdlmzf.cloudfront.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://aticalfelixstownrus.info/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
content-length: 198
date: Sun, 10 Sep 2023 19:13:44 GMT
access-control-allow-origin: *
cache-control: max-age=31556926
content-encoding: gzip
x-cache: Miss from cloudfront
via: 1.1 aac54e3fe9825ce24d51e0204433c2c0.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-C1
x-amz-cf-id: YZQHIvAmClRm6drDGwUVyJglobKWlE_nNZ0cQmzNE_VDHuD7MQxRxg==
X-Firefox-Spdy: h2
accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fwww.google.com%2Ffavicon.ico&hl=en&ifkv=AYZoVhdLkMN0vQNMr2aSuDK3Iovr9aRkAwERhfZo0Wb4U4HiIxrBoqDudU7HlkIq9Or8n_nn0k30nw&passive=true&service=mail&uilel=3&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S302281902%3A1694373224827514&theme=glif
403 Forbidden 806 B URL GET HTTP/3 accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fwww.google.com%2Ffavicon.ico&hl=en&ifkv=AYZoVhdLkMN0vQNMr2aSuDK3Iovr9aRkAwERhfZo0Wb4U4HiIxrBoqDudU7HlkIq9Or8n_nn0k30nw&passive=true&service=mail&uilel=3&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S302281902%3A1694373224827514&theme=glif
IP
Requested by https://www.upload.ee/files/15560170/Fab.Generic.Hook.10082023-TheRadziu.rar.html?msg=sess_error
Certificate IssuerGoogle Trust Services LLC
Subject*.google.com
Fingerprint5A:48:5B:27:A7:FB:0B:D6:63:83:8E:8E:80:DB:29:B7:2C:72:A8:8E
ValidityMon, 14 Aug 2023 08:16:28 GMT - Mon, 06 Nov 2023 08:16:27 GMT
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document, Unicode text, UTF-8 text, with very long lines (1644), with no line terminators
Hash b1e0b1f87e21bde84cfe57ad9d83a030
517163c12364c1645f7b1a3a0527f673eb3e4915
8498a73d695e2d88ed1160f4de68a1fd47fe0b740228223b2d642d89f4b0513c
GET /v3/signin/identifier?continue=https%3A%2F%2Fwww.google.com%2Ffavicon.ico&hl=en&ifkv=AYZoVhdLkMN0vQNMr2aSuDK3Iovr9aRkAwERhfZo0Wb4U4HiIxrBoqDudU7HlkIq9Or8n_nn0k30nw&passive=true&service=mail&uilel=3&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S302281902%3A1694373224827514&theme=glif HTTP/1.1
Host: accounts.google.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://www.upload.ee/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 403 Forbidden
content-type: text/html; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: Mon, 01 Jan 1990 00:00:00 GMT
date: Sun, 10 Sep 2023 19:13:44 GMT
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
strict-transport-security: max-age=31536000; includeSubDomains
content-security-policy: require-trusted-types-for 'script';report-uri /v3/signin/_/AccountsSignInUi/cspreport, script-src 'nonce-HkXh_HBxgwAYQhk5OcVolA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /v3/signin/_/AccountsSignInUi/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /v3/signin/_/AccountsSignInUi/cspreport/allowlist
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
content-encoding: gzip
server: ESF
x-xss-protection: 0
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
pogothere.xyz/asd100.bin
200 OK 104 kB IP
Requested by https://www.upload.ee/files/15560170/Fab.Generic.Hook.10082023-TheRadziu.rar.html?msg=sess_error
Certificate IssuerCloudflare, Inc.
Subjectsni.cloudflaressl.com
Fingerprint17:F9:2D:6F:B5:5E:5F:37:A6:FB:BE:61:4F:97:64:33:85:5C:3A:FB
ValidityTue, 28 Feb 2023 00:00:00 GMT - Tue, 27 Feb 2024 23:59:59 GMT
Size 104 kB (103743 bytes)
Hash 100a9e1512c4764a9dd109b30747cc2b
be4515172780b7a325a9f789f7ed3e1acfba1e3d
bccf53b718344915c3a0457fc2362166f87a66b4fa90f929387789bcdb8f4e04
GET /asd100.bin HTTP/1.1
Host: pogothere.xyz
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://www.upload.ee/
Origin: https://www.upload.ee
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Sun, 10 Sep 2023 19:13:44 GMT
content-type: binary/octet-stream
access-control-allow-origin: https://www.upload.ee
access-control-allow-credentials: true
access-control-allow-methods: GET
access-control-allow-headers: X-Requested-With, content-type
cache-control: max-age=14400
cf-cache-status: HIT
age: 2260
last-modified: Sun, 10 Sep 2023 18:36:04 GMT
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=S2t%2FW3dR5sxAV17%2FHzrodON3jig0oczxj8cPFENYyAl%2FAnvXfSEx4WSXDH25n%2B7EVHQFmvJK63H5w8mDpe5QtyDmjd%2FsBacsyMsGB%2Fq8cVmWsVvaPy6n%2B3ioZwF2Soui"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 8049fd6f0cc223bd-LHR
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
static.bepolite.eu/scripts/saresponsive.js
200 OK 175 kB URL GET HTTP/2 static.bepolite.eu/scripts/saresponsive.js
IP
ASN #3327 CITIC Telecom CPC Netherlands B.V.
Requested by https://www.upload.ee/files/15560170/Fab.Generic.Hook.10082023-TheRadziu.rar.html?msg=sess_error
Certificate IssuerLet's Encrypt
Subjectstatic.bepolite.eu
FingerprintB7:1B:BB:35:5B:E5:6E:92:4D:DE:79:2E:0E:C8:1F:0D:CE:28:88:FD
ValidityMon, 04 Sep 2023 21:06:47 GMT - Sun, 03 Dec 2023 21:06:46 GMT
File type ASCII text, with very long lines (32077), with CRLF line terminators
Size 175 kB (174934 bytes)
Hash 1bf7f467e8e0d7bbc53585aad8ea467c
9a438e3c801182c612d82ecbec28d6dc5a643b93
08af140297a6c256dcd10d0b815e41b80217789ebe5ac9558a24546432adddeb
GET /scripts/saresponsive.js HTTP/1.1
Host: static.bepolite.eu
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.upload.ee/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
content-type: application/javascript
accept-ranges: bytes
etag: "1331883970"
last-modified: Mon, 14 Aug 2023 20:11:50 GMT
content-length: 174934
date: Sun, 10 Sep 2023 19:13:39 GMT
cache-control: must-revalidate, private
expires: -1
p3p: CP='BePolite does not have a P3P policy'
x-varnish: 363561265
age: 0
X-Firefox-Spdy: h2
banner.hookusbookus.com/index_300x600.html?language=et_ee&utmSource=allmedia&click_url=https%3A%2F%2Fserving.bepolite.eu%2Fevent%3Fkey%3DFYFWuDany3hwv6rfuoAYF_I3Dac2g1H_tKyDb59iwG_kA2qWNDkOGsG9L7yF2N4rkocKqgGqp0m8aMS6hLpP_RG2RF8EHx_6d7Q6uK27xIXrGA8s6k23oeeYhhqoLly5hucnpoycddr9nEaa9hkF6xsjMRpq_w30KspY7s62Wq_zp3ZdgWtH0MKue5p5AGKHXJxXiVJEh1Vfgxn38rgFo-tSrOiriedI-Oi3R5i8w-2KEKyCRIfPP1ktkR_a1xBEN4Mp3hCHV2gL5wIlp7AQSx5xbztKZEP3IVdh-WxRkrPa5hY8OvOxWaQQS9P0iYfnngZXtFEp1ljuqs475VAp1Q%26clink%3Dhttp%253A%252F%252Fsmartad.ee&dynamic_url=https%3A%2F%2Fserving.bepolite.eu%2Fevent%3Fkey%3DFYFWuDany3hwv6rfuoAYF_I3Dac2g1H_tKyDb59iwG_kA2qWNDkOGsG9L7yF2N4rkocKqgGqp0m8aMS6hLpP_RG2RF8EHx_6d7Q6uK27xIXrGA8s6k23oeeYhhqoLly5hucnpoycddr9nEaa9hkF6xsjMRpq_w30KspY7s62Wq_zp3ZdgWtH0MKue5p5AGKHXJxXiVJEh1Vfgxn38rgFo-tSrOiriedI-Oi3R5i8w-2KEKyCRIfPP1ktkR_a1xBEN4Mp3hCHV2gL5wIlp7AQSx5xbztKZEP3IVdh-WxRkrPa5hY8OvOxWaQQS9P0iYfnngZXtFEp1ljuqs475VAp1Q%26clink%3D&f=https%3A%2F%2Fbanner.hookusbookus.com%2Findex_300x600.html%3Flanguage%3Det_ee%26utmSource%3Dallmedia&clink=https%3A%2F%2Fsmartad.ee&banner_id=3b881495c84042deb0d0288185da231350dd7b0f4105441f8f6018cc3fcb090c&bg=black&w=300&h=600&locale=Display%20Estonia-EST&info=https%3A%2F%2Fdigital.tv3.ee%2Fbepolite-id%2F%3Futm_src%3Dbanner
200 OK 1.9 kB URL GET HTTP/2 banner.hookusbookus.com/index_300x600.html?language=et_ee&utmSource=allmedia&click_url=https%3A%2F%2Fserving.bepolite.eu%2Fevent%3Fkey%3DFYFWuDany3hwv6rfuoAYF_I3Dac2g1H_tKyDb59iwG_kA2qWNDkOGsG9L7yF2N4rkocKqgGqp0m8aMS6hLpP_RG2RF8EHx_6d7Q6uK27xIXrGA8s6k23oeeYhhqoLly5hucnpoycddr9nEaa9hkF6xsjMRpq_w30KspY7s62Wq_zp3ZdgWtH0MKue5p5AGKHXJxXiVJEh1Vfgxn38rgFo-tSrOiriedI-Oi3R5i8w-2KEKyCRIfPP1ktkR_a1xBEN4Mp3hCHV2gL5wIlp7AQSx5xbztKZEP3IVdh-WxRkrPa5hY8OvOxWaQQS9P0iYfnngZXtFEp1ljuqs475VAp1Q%26clink%3Dhttp%253A%252F%252Fsmartad.ee&dynamic_url=https%3A%2F%2Fserving.bepolite.eu%2Fevent%3Fkey%3DFYFWuDany3hwv6rfuoAYF_I3Dac2g1H_tKyDb59iwG_kA2qWNDkOGsG9L7yF2N4rkocKqgGqp0m8aMS6hLpP_RG2RF8EHx_6d7Q6uK27xIXrGA8s6k23oeeYhhqoLly5hucnpoycddr9nEaa9hkF6xsjMRpq_w30KspY7s62Wq_zp3ZdgWtH0MKue5p5AGKHXJxXiVJEh1Vfgxn38rgFo-tSrOiriedI-Oi3R5i8w-2KEKyCRIfPP1ktkR_a1xBEN4Mp3hCHV2gL5wIlp7AQSx5xbztKZEP3IVdh-WxRkrPa5hY8OvOxWaQQS9P0iYfnngZXtFEp1ljuqs475VAp1Q%26clink%3D&f=https%3A%2F%2Fbanner.hookusbookus.com%2Findex_300x600.html%3Flanguage%3Det_ee%26utmSource%3Dallmedia&clink=https%3A%2F%2Fsmartad.ee&banner_id=3b881495c84042deb0d0288185da231350dd7b0f4105441f8f6018cc3fcb090c&bg=black&w=300&h=600&locale=Display%20Estonia-EST&info=https%3A%2F%2Fdigital.tv3.ee%2Fbepolite-id%2F%3Futm_src%3Dbanner
IP
Requested by https://www.upload.ee/files/15560170/Fab.Generic.Hook.10082023-TheRadziu.rar.html?msg=sess_error
Certificate IssuerAmazon
Subject*.hookusbookus.com
FingerprintCD:CD:3C:03:66:21:F8:A9:21:BC:F8:C8:3C:DC:88:0A:C5:19:F1:7A
ValiditySun, 07 May 2023 00:00:00 GMT - Tue, 04 Jun 2024 23:59:59 GMT
File type gzip compressed data, from Unix\012- data
Hash 273086ce8c5683ccaeb002d5ced7f104
3f71e54c72be9dc0a37f0d9f0d14d906d505c883
7a08afd923a3ac3a29f93c8a19fca4b2314aa11ac17c64896121cf385f7a65f4
GET /index_300x600.html?language=et_ee&utmSource=allmedia&click_url=https%3A%2F%2Fserving.bepolite.eu%2Fevent%3Fkey%3DFYFWuDany3hwv6rfuoAYF_I3Dac2g1H_tKyDb59iwG_kA2qWNDkOGsG9L7yF2N4rkocKqgGqp0m8aMS6hLpP_RG2RF8EHx_6d7Q6uK27xIXrGA8s6k23oeeYhhqoLly5hucnpoycddr9nEaa9hkF6xsjMRpq_w30KspY7s62Wq_zp3ZdgWtH0MKue5p5AGKHXJxXiVJEh1Vfgxn38rgFo-tSrOiriedI-Oi3R5i8w-2KEKyCRIfPP1ktkR_a1xBEN4Mp3hCHV2gL5wIlp7AQSx5xbztKZEP3IVdh-WxRkrPa5hY8OvOxWaQQS9P0iYfnngZXtFEp1ljuqs475VAp1Q%26clink%3Dhttp%253A%252F%252Fsmartad.ee&dynamic_url=https%3A%2F%2Fserving.bepolite.eu%2Fevent%3Fkey%3DFYFWuDany3hwv6rfuoAYF_I3Dac2g1H_tKyDb59iwG_kA2qWNDkOGsG9L7yF2N4rkocKqgGqp0m8aMS6hLpP_RG2RF8EHx_6d7Q6uK27xIXrGA8s6k23oeeYhhqoLly5hucnpoycddr9nEaa9hkF6xsjMRpq_w30KspY7s62Wq_zp3ZdgWtH0MKue5p5AGKHXJxXiVJEh1Vfgxn38rgFo-tSrOiriedI-Oi3R5i8w-2KEKyCRIfPP1ktkR_a1xBEN4Mp3hCHV2gL5wIlp7AQSx5xbztKZEP3IVdh-WxRkrPa5hY8OvOxWaQQS9P0iYfnngZXtFEp1ljuqs475VAp1Q%26clink%3D&f=https%3A%2F%2Fbanner.hookusbookus.com%2Findex_300x600.html%3Flanguage%3Det_ee%26utmSource%3Dallmedia&clink=https%3A%2F%2Fsmartad.ee&banner_id=3b881495c84042deb0d0288185da231350dd7b0f4105441f8f6018cc3fcb090c&bg=black&w=300&h=600&locale=Display%20Estonia-EST&info=https%3A%2F%2Fdigital.tv3.ee%2Fbepolite-id%2F%3Futm_src%3Dbanner HTTP/1.1
Host: banner.hookusbookus.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.upload.ee/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Sun, 10 Sep 2023 19:13:45 GMT
content-type: text/html
server: nginx/1.15.12
last-modified: Tue, 24 Jan 2023 14:19:47 GMT
vary: Accept-Encoding
etag: W/"63cfe903-1761"
content-encoding: gzip
X-Firefox-Spdy: h2
empafnyfiexpectt.info/popunder.gif
200 OK 85 kB URL GET HTTP/3 empafnyfiexpectt.info/popunder.gif
IP
Requested by https://www.upload.ee/files/15560170/Fab.Generic.Hook.10082023-TheRadziu.rar.html?msg=sess_error
Certificate IssuerLet's Encrypt
Subjectempafnyfiexpectt.info
Fingerprint0A:3C:72:5A:AE:C9:CE:C3:ED:9D:55:D4:4A:C3:28:A5:31:C0:1B:2B
ValidityMon, 04 Sep 2023 06:52:14 GMT - Sun, 03 Dec 2023 06:52:13 GMT
File type GIF image data, version 89a, 1 x 1\012- data
Hash 967e896b0d1222dc435048135a4b65b2
6f37680f52bb74cadcb69091cbf7b924d03b8d7b
a6cd0526401a5f0682d7c5af59e6e5789bff62d8b73f84d7d3202e58db7ac269
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /popunder.gif HTTP/1.1
Host: empafnyfiexpectt.info
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.upload.ee/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Sun, 10 Sep 2023 19:13:44 GMT
content-type: image/gif
access-control-allow-origin: *
pragma: public
cache-control: public, max-age=604800, immutable
cf-cache-status: HIT
age: 25226
last-modified: Sun, 10 Sep 2023 12:13:18 GMT
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=nGVgCDqVDJ13G9tKYXhW1eIZKKo05E5M0AoGqM8F8CnxSroGsbPJ8TYRVo2sli0UvIw6uK805x95tZWUBtEp5qEZFdVHyItx4GgwS%2FYcZ%2FD2UzM6acv1Blf7v5TsB3j8MpiJSggaGs8%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 8049fd6f7d09b4eb-OSL
alt-svc: h3=":443"; ma=86400
banner.hookusbookus.com/assets/fonts/greycliff-cf-bold.woff
200 OK 53 kB URL GET HTTP/2 banner.hookusbookus.com/assets/fonts/greycliff-cf-bold.woff
IP
Requested by https://banner.hookusbookus.com/index_300x600.html?language=et_ee&utmSource=allmedia&click_url=https%3A%2F%2Fserving.bepolite.eu%2Fevent%3Fkey%3DFYFWuDany3hwv6rfuoAYF_I3Dac2g1H_tKyDb59iwG_kA2qWNDkOGsG9L7yF2N4rkocKqgGqp0m8aMS6hLpP_RG2RF8EHx_6d7Q6uK27xIXrGA8s6k23oeeYhhqoLly5hucnpoycddr9nEaa9hkF6xsjMRpq_w30KspY7s62Wq_zp3ZdgWtH0MKue5p5AGKHXJxXiVJEh1Vfgxn38rgFo-tSrOiriedI-Oi3R5i8w-2KEKyCRIfPP1ktkR_a1xBEN4Mp3hCHV2gL5wIlp7AQSx5xbztKZEP3IVdh-WxRkrPa5hY8OvOxWaQQS9P0iYfnngZXtFEp1ljuqs475VAp1Q%26clink%3Dhttp%253A%252F%252Fsmartad.ee&dynamic_url=https%3A%2F%2Fserving.bepolite.eu%2Fevent%3Fkey%3DFYFWuDany3hwv6rfuoAYF_I3Dac2g1H_tKyDb59iwG_kA2qWNDkOGsG9L7yF2N4rkocKqgGqp0m8aMS6hLpP_RG2RF8EHx_6d7Q6uK27xIXrGA8s6k23oeeYhhqoLly5hucnpoycddr9nEaa9hkF6xsjMRpq_w30KspY7s62Wq_zp3ZdgWtH0MKue5p5AGKHXJxXiVJEh1Vfgxn38rgFo-tSrOiriedI-Oi3R5i8w-2KEKyCRIfPP1ktkR_a1xBEN4Mp3hCHV2gL5wIlp7AQSx5xbztKZEP3IVdh-WxRkrPa5hY8OvOxWaQQS9P0iYfnngZXtFEp1ljuqs475VAp1Q%26clink%3D&f=https%3A%2F%2Fbanner.hookusbookus.com%2Findex_300x600.html%3Flanguage%3Det_ee%26utmSource%3Dallmedia&clink=https%3A%2F%2Fsmartad.ee&banner_id=3b881495c84042deb0d0288185da231350dd7b0f4105441f8f6018cc3fcb090c&bg=black&w=300&h=600&locale=Display%20Estonia-EST&info=https%3A%2F%2Fdigital.tv3.ee%2Fbepolite-id%2F%3Futm_src%3Dbanner
Certificate IssuerAmazon
Subject*.hookusbookus.com
FingerprintCD:CD:3C:03:66:21:F8:A9:21:BC:F8:C8:3C:DC:88:0A:C5:19:F1:7A
ValiditySun, 07 May 2023 00:00:00 GMT - Tue, 04 Jun 2024 23:59:59 GMT
File type Web Open Font Format, TrueType, length 53208, version 1.500\012- data
Hash c03dece8ec0635406a35b888337dca8f
b72706815dccadd44dba1693ed8865b41782b14f
092416b2a5cbe9f6596ff7ee177db702262c64326231a3664a34a65c861601b1
GET /assets/fonts/greycliff-cf-bold.woff HTTP/1.1
Host: banner.hookusbookus.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
DNT: 1
Connection: keep-alive
Referer: https://banner.hookusbookus.com/assets/css/index_300x600.css
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
date: Sun, 10 Sep 2023 19:13:46 GMT
content-type: font/woff
content-length: 53208
server: nginx/1.15.12
last-modified: Thu, 22 Apr 2021 07:20:15 GMT
etag: "608123af-cfd8"
accept-ranges: bytes
X-Firefox-Spdy: h2
banner-server.hookusbookus.com/package-feed?language=et_ee&utmSource=allmedia
200 OK 84 kB URL GET HTTP/2 banner-server.hookusbookus.com/package-feed?language=et_ee&utmSource=allmedia
IP
Requested by https://banner.hookusbookus.com/index_300x600.html?language=et_ee&utmSource=allmedia&click_url=https%3A%2F%2Fserving.bepolite.eu%2Fevent%3Fkey%3DFYFWuDany3hwv6rfuoAYF_I3Dac2g1H_tKyDb59iwG_kA2qWNDkOGsG9L7yF2N4rkocKqgGqp0m8aMS6hLpP_RG2RF8EHx_6d7Q6uK27xIXrGA8s6k23oeeYhhqoLly5hucnpoycddr9nEaa9hkF6xsjMRpq_w30KspY7s62Wq_zp3ZdgWtH0MKue5p5AGKHXJxXiVJEh1Vfgxn38rgFo-tSrOiriedI-Oi3R5i8w-2KEKyCRIfPP1ktkR_a1xBEN4Mp3hCHV2gL5wIlp7AQSx5xbztKZEP3IVdh-WxRkrPa5hY8OvOxWaQQS9P0iYfnngZXtFEp1ljuqs475VAp1Q%26clink%3Dhttp%253A%252F%252Fsmartad.ee&dynamic_url=https%3A%2F%2Fserving.bepolite.eu%2Fevent%3Fkey%3DFYFWuDany3hwv6rfuoAYF_I3Dac2g1H_tKyDb59iwG_kA2qWNDkOGsG9L7yF2N4rkocKqgGqp0m8aMS6hLpP_RG2RF8EHx_6d7Q6uK27xIXrGA8s6k23oeeYhhqoLly5hucnpoycddr9nEaa9hkF6xsjMRpq_w30KspY7s62Wq_zp3ZdgWtH0MKue5p5AGKHXJxXiVJEh1Vfgxn38rgFo-tSrOiriedI-Oi3R5i8w-2KEKyCRIfPP1ktkR_a1xBEN4Mp3hCHV2gL5wIlp7AQSx5xbztKZEP3IVdh-WxRkrPa5hY8OvOxWaQQS9P0iYfnngZXtFEp1ljuqs475VAp1Q%26clink%3D&f=https%3A%2F%2Fbanner.hookusbookus.com%2Findex_300x600.html%3Flanguage%3Det_ee%26utmSource%3Dallmedia&clink=https%3A%2F%2Fsmartad.ee&banner_id=3b881495c84042deb0d0288185da231350dd7b0f4105441f8f6018cc3fcb090c&bg=black&w=300&h=600&locale=Display%20Estonia-EST&info=https%3A%2F%2Fdigital.tv3.ee%2Fbepolite-id%2F%3Futm_src%3Dbanner
Certificate IssuerAmazon
Subject*.hookusbookus.com
FingerprintCD:CD:3C:03:66:21:F8:A9:21:BC:F8:C8:3C:DC:88:0A:C5:19:F1:7A
ValiditySun, 07 May 2023 00:00:00 GMT - Tue, 04 Jun 2024 23:59:59 GMT
Hash 15b23a06865e18ae3d2e60aa9206b0cc
c28cd56c5c543aa69b1e3afc198cc77b84de56cc
9d1268139afe2883732b0368a36c219f2e4fb37ea81df7fa181ba19b8c618c28
GET /package-feed?language=et_ee&utmSource=allmedia HTTP/1.1
Host: banner-server.hookusbookus.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://banner.hookusbookus.com
DNT: 1
Connection: keep-alive
Referer: https://banner.hookusbookus.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Sun, 10 Sep 2023 19:13:46 GMT
content-type: application/json
access-control-allow-origin: https://banner.hookusbookus.com
access-control-allow-methods: POST, PUT, GET, PATCH, OPTIONS, DELETE
access-control-max-age: 3600
access-control-allow-headers: origin, authorization, accept, content-type, x-requested-with, Pragma, Cache-Control, If-Modified-Since, X-Auth-Token, X-Client-Certificate
access-control-allow-credentials: true
access-control-expose-headers: X-Auth-Token, Content-Disposition, Content-Length
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: 0
x-frame-options: DENY
X-Firefox-Spdy: h2
static.bepolite.eu/files/close-gray.png
1.5 kB URL static.bepolite.eu/files/close-gray.png
IP
ASN #3327 CITIC Telecom CPC Netherlands B.V.
Certificate IssuerLet's Encrypt
Subjectstatic.bepolite.eu
FingerprintB7:1B:BB:35:5B:E5:6E:92:4D:DE:79:2E:0E:C8:1F:0D:CE:28:88:FD
ValidityMon, 04 Sep 2023 21:06:47 GMT - Sun, 03 Dec 2023 21:06:46 GMT
File type PNG image data, 35 x 35, 8-bit/color RGBA, non-interlaced\012- data
Hash 41d9676ab94bece3f7a549b4769ddbe2
521f14490fc57fea51e2e5bf00e2299dce51561b
c2f89787bda82263fceb9ec11d398fa83a5f22abf248956df29bdee2987d2f34
GET /files/close-gray.png HTTP/1.1
Host: static.bepolite.eu
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.upload.ee/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
content-type: image/png
accept-ranges: bytes
etag: "3930991918"
last-modified: Fri, 08 Apr 2022 18:07:56 GMT
content-length: 1497
date: Sun, 10 Sep 2023 19:06:04 GMT
cache-control: must-revalidate, private
expires: -1
p3p: CP='BePolite does not have a P3P policy'
x-varnish: 341324555
age: 0
X-Firefox-Spdy: h2
serving.bepolite.eu/event?key=FYFWuDany3hwv6rfuoAYF_I3Dac2g1H_tKyDb59iwG_kA2qWNDkOGsG9L7yF2N4rkocKqgGqp0m8aMS6hLpP_RG2RF8EHx_6d7Q6uK27xIXrGA8s6k23oeeYhhqoLly5hucnpoycddr9nEaa9hkF6xsjMRpq_w30KspY7s62Wq_zp3ZdgWtH0MKue5p5AGKHXJxXiVJEh1Vfgxn38rgFo-tSrOiriedI-Oi3R5i8w-2KEKyCRIfPP1ktkR_a1xBEN4Mp3hCHV2gL5wIlp7AQSx5xbztKZEP3IVdh-WxRkrPa5hY8OvOxWaQQS9P0iYfnf_8e5-90sra7UBdR4oM89g
0 B URL serving.bepolite.eu/event?key=FYFWuDany3hwv6rfuoAYF_I3Dac2g1H_tKyDb59iwG_kA2qWNDkOGsG9L7yF2N4rkocKqgGqp0m8aMS6hLpP_RG2RF8EHx_6d7Q6uK27xIXrGA8s6k23oeeYhhqoLly5hucnpoycddr9nEaa9hkF6xsjMRpq_w30KspY7s62Wq_zp3ZdgWtH0MKue5p5AGKHXJxXiVJEh1Vfgxn38rgFo-tSrOiriedI-Oi3R5i8w-2KEKyCRIfPP1ktkR_a1xBEN4Mp3hCHV2gL5wIlp7AQSx5xbztKZEP3IVdh-WxRkrPa5hY8OvOxWaQQS9P0iYfnf_8e5-90sra7UBdR4oM89g
IP
ASN #3327 CITIC Telecom CPC Netherlands B.V.
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /event?key=FYFWuDany3hwv6rfuoAYF_I3Dac2g1H_tKyDb59iwG_kA2qWNDkOGsG9L7yF2N4rkocKqgGqp0m8aMS6hLpP_RG2RF8EHx_6d7Q6uK27xIXrGA8s6k23oeeYhhqoLly5hucnpoycddr9nEaa9hkF6xsjMRpq_w30KspY7s62Wq_zp3ZdgWtH0MKue5p5AGKHXJxXiVJEh1Vfgxn38rgFo-tSrOiriedI-Oi3R5i8w-2KEKyCRIfPP1ktkR_a1xBEN4Mp3hCHV2gL5wIlp7AQSx5xbztKZEP3IVdh-WxRkrPa5hY8OvOxWaQQS9P0iYfnf_8e5-90sra7UBdR4oM89g HTTP/1.1
Host: serving.bepolite.eu
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.upload.ee/
Cookie: bepolite_id=fa8834dc0a241d1c7b84ec42da0c0659
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
content-length: 0
date: Sun, 10 Sep 2023 19:13:40 GMT
p3p: CP='BePolite does not have a P3P policy'
x-varnish: 363496100
age: 0
accept-ranges: bytes
X-Firefox-Spdy: h2
pogothere.xyz/
200 OK 56 kB IP
Requested by https://www.upload.ee/files/15560170/Fab.Generic.Hook.10082023-TheRadziu.rar.html?msg=sess_error
Certificate IssuerCloudflare, Inc.
Subjectsni.cloudflaressl.com
Fingerprint17:F9:2D:6F:B5:5E:5F:37:A6:FB:BE:61:4F:97:64:33:85:5C:3A:FB
ValidityTue, 28 Feb 2023 00:00:00 GMT - Tue, 27 Feb 2024 23:59:59 GMT
File type ASCII text, with no line terminators
Hash f2a7d9c8a3ae4b4be63144b5bc0042f2
56af9da3fe556541ffc6439c9dfd48341530dd0b
d4c54d007dbfdb56244e2fef258b126e4e56a84996853029cd1a469382c915cb
GET / HTTP/1.1
Host: pogothere.xyz
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://www.upload.ee/
Origin: https://www.upload.ee
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Sun, 10 Sep 2023 19:13:44 GMT
content-type: text/plain
set-cookie: csu=1253997215357818@1@1694373224; Max-Age=31104000; Secure; SameSite=None
access-control-allow-origin: https://www.upload.ee
access-control-allow-credentials: true
access-control-allow-methods: GET
access-control-allow-headers: X-Requested-With, content-type
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Eb6KuMcRMs1izTiQC3i8Ag2%2FDZxTiYtXI%2FKP8SrNZN6cV0zQ6r4hOCWU6z5dMgzd5rVNun5uffJ9GxFOQ8%2FnYOjXyJgTMosb2HIWl%2BCROCQZYaz0uMq10qI8wYUJioDi"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 8049fd6f0cb723bd-LHR
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
dskwugy0u6y9l.cloudfront.net/hotelliveeb/images/general/1/orfv6s0keAKkS5RjClkt.jpg
68 kB URL dskwugy0u6y9l.cloudfront.net/hotelliveeb/images/general/1/orfv6s0keAKkS5RjClkt.jpg
IP
File type JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 300x230, components 3\012- data
Hash d9ee5ee699a3b8d0be40690d8bf01252
49f3d4125fa40665faed26abac334e492de58874
46bbeb9cce2c6f835091fdf046c22e32e6a0697e4a35fa869f5ef2c3e533cca6
GET /hotelliveeb/images/general/1/orfv6s0keAKkS5RjClkt.jpg HTTP/1.1
Host: dskwugy0u6y9l.cloudfront.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://banner.hookusbookus.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
content-type: image/jpeg
content-length: 67835
last-modified: Thu, 13 Apr 2023 06:00:09 GMT
x-amz-server-side-encryption: AES256
accept-ranges: bytes
server: AmazonS3
date: Sun, 10 Sep 2023 17:49:47 GMT
etag: "d9ee5ee699a3b8d0be40690d8bf01252"
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 9ede9483eb891e14681c7c693b47c862.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-C1
x-amz-cf-id: _5fDgAoFiSHv9sOtg25f7UR-cDBgQ1kCAgwcSqkzuq2Qt6zN6f-H4g==
age: 5052
X-Firefox-Spdy: h2
accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fwww.youtube.com%2Ffavicon.ico&hl=en&ifkv=AYZoVhdG3z5gPouCuzxyrsSJVg1wDLXip8P1t7ClbmvG8s8zPezvEHd5eDKdKjJRuudzG_-EMontaQ&passive=true&service=youtube&uilel=3&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S1644324714%3A1694373224835831&theme=glif
403 Forbidden 0 B URL GET HTTP/3 accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fwww.youtube.com%2Ffavicon.ico&hl=en&ifkv=AYZoVhdG3z5gPouCuzxyrsSJVg1wDLXip8P1t7ClbmvG8s8zPezvEHd5eDKdKjJRuudzG_-EMontaQ&passive=true&service=youtube&uilel=3&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S1644324714%3A1694373224835831&theme=glif
IP
Requested by https://www.upload.ee/files/15560170/Fab.Generic.Hook.10082023-TheRadziu.rar.html?msg=sess_error
Certificate IssuerGoogle Trust Services LLC
Subject*.google.com
Fingerprint5A:48:5B:27:A7:FB:0B:D6:63:83:8E:8E:80:DB:29:B7:2C:72:A8:8E
ValidityMon, 14 Aug 2023 08:16:28 GMT - Mon, 06 Nov 2023 08:16:27 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /v3/signin/identifier?continue=https%3A%2F%2Fwww.youtube.com%2Ffavicon.ico&hl=en&ifkv=AYZoVhdG3z5gPouCuzxyrsSJVg1wDLXip8P1t7ClbmvG8s8zPezvEHd5eDKdKjJRuudzG_-EMontaQ&passive=true&service=youtube&uilel=3&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S1644324714%3A1694373224835831&theme=glif HTTP/1.1
Host: accounts.google.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://www.upload.ee/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 403 Forbidden
content-type: text/html; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: Mon, 01 Jan 1990 00:00:00 GMT
date: Sun, 10 Sep 2023 19:13:44 GMT
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
strict-transport-security: max-age=31536000; includeSubDomains
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
content-security-policy: script-src 'nonce-YF40PIIQdM3ZL8VDw0oDkw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /v3/signin/_/AccountsSignInUi/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /v3/signin/_/AccountsSignInUi/cspreport/allowlist, require-trusted-types-for 'script';report-uri /v3/signin/_/AccountsSignInUi/cspreport
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
content-encoding: gzip
server: ESF
x-xss-protection: 0
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
dskwugy0u6y9l.cloudfront.net/hotelliveeb/images/general/1/I3Qfj8e7MckxIXbz78mw.jpg
200 OK 56 kB URL GET HTTP/2 dskwugy0u6y9l.cloudfront.net/hotelliveeb/images/general/1/I3Qfj8e7MckxIXbz78mw.jpg
IP
Requested by https://banner.hookusbookus.com/index_300x600.html?language=et_ee&utmSource=allmedia&click_url=https%3A%2F%2Fserving.bepolite.eu%2Fevent%3Fkey%3DFYFWuDany3hwv6rfuoAYF_I3Dac2g1H_tKyDb59iwG_kA2qWNDkOGsG9L7yF2N4rkocKqgGqp0m8aMS6hLpP_RG2RF8EHx_6d7Q6uK27xIXrGA8s6k23oeeYhhqoLly5hucnpoycddr9nEaa9hkF6xsjMRpq_w30KspY7s62Wq_zp3ZdgWtH0MKue5p5AGKHXJxXiVJEh1Vfgxn38rgFo-tSrOiriedI-Oi3R5i8w-2KEKyCRIfPP1ktkR_a1xBEN4Mp3hCHV2gL5wIlp7AQSx5xbztKZEP3IVdh-WxRkrPa5hY8OvOxWaQQS9P0iYfnngZXtFEp1ljuqs475VAp1Q%26clink%3Dhttp%253A%252F%252Fsmartad.ee&dynamic_url=https%3A%2F%2Fserving.bepolite.eu%2Fevent%3Fkey%3DFYFWuDany3hwv6rfuoAYF_I3Dac2g1H_tKyDb59iwG_kA2qWNDkOGsG9L7yF2N4rkocKqgGqp0m8aMS6hLpP_RG2RF8EHx_6d7Q6uK27xIXrGA8s6k23oeeYhhqoLly5hucnpoycddr9nEaa9hkF6xsjMRpq_w30KspY7s62Wq_zp3ZdgWtH0MKue5p5AGKHXJxXiVJEh1Vfgxn38rgFo-tSrOiriedI-Oi3R5i8w-2KEKyCRIfPP1ktkR_a1xBEN4Mp3hCHV2gL5wIlp7AQSx5xbztKZEP3IVdh-WxRkrPa5hY8OvOxWaQQS9P0iYfnngZXtFEp1ljuqs475VAp1Q%26clink%3D&f=https%3A%2F%2Fbanner.hookusbookus.com%2Findex_300x600.html%3Flanguage%3Det_ee%26utmSource%3Dallmedia&clink=https%3A%2F%2Fsmartad.ee&banner_id=3b881495c84042deb0d0288185da231350dd7b0f4105441f8f6018cc3fcb090c&bg=black&w=300&h=600&locale=Display%20Estonia-EST&info=https%3A%2F%2Fdigital.tv3.ee%2Fbepolite-id%2F%3Futm_src%3Dbanner
Certificate IssuerAmazon
Subject*.cloudfront.net
FingerprintBA:0F:CD:B3:EA:19:B2:9D:99:9B:51:2D:16:33:6B:D0:3F:31:A2:AB
ValidityThu, 08 Dec 2022 00:00:00 GMT - Thu, 07 Dec 2023 23:59:59 GMT
File type JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 300x230, components 3\012- data
Hash cddd4b220dbfd2c4641572afbcc3bbf9
2bf3de058bcb45d5a133c9e768a4e8fcdb6ec6c8
54c4a1b842c44277f35ff895c7be82711edf0591dd660744d3e18c3a62f236ce
GET /hotelliveeb/images/general/1/I3Qfj8e7MckxIXbz78mw.jpg HTTP/1.1
Host: dskwugy0u6y9l.cloudfront.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://banner.hookusbookus.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
content-type: image/jpeg
content-length: 55749
date: Sat, 09 Sep 2023 19:39:29 GMT
last-modified: Mon, 20 Dec 2021 05:01:30 GMT
etag: "cddd4b220dbfd2c4641572afbcc3bbf9"
accept-ranges: bytes
server: AmazonS3
x-cache: Hit from cloudfront
via: 1.1 9ede9483eb891e14681c7c693b47c862.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-C1
x-amz-cf-id: ye3nif1G7Ywr9J7I1nNkvBVKSEqVq_umvgL065MidPNvLzPUY0i1tw==
age: 84864
X-Firefox-Spdy: h2
empafnyfiexpectt.info/cURqbHdeewkfSiB3PBUWOSxYODIrJzlfAzMWWxQ5Ei84ICA0cEwYHhV5U1VAQnJTSgcYIFddUQIwCxgCAnlZXEdAYgMCER55WlxHQGIcUUZfd15CREVqWkoCTHVMGAcQI1ddUQEwHgBKQHJTWERGd1heQkJ3Xg
204 No Content 0 B URL POST HTTP/3 empafnyfiexpectt.info/cURqbHdeewkfSiB3PBUWOSxYODIrJzlfAzMWWxQ5Ei84ICA0cEwYHhV5U1VAQnJTSgcYIFddUQIwCxgCAnlZXEdAYgMCER55WlxHQGIcUUZfd15CREVqWkoCTHVMGAcQI1ddUQEwHgBKQHJTWERGd1heQkJ3Xg
IP
Requested by https://www.upload.ee/files/15560170/Fab.Generic.Hook.10082023-TheRadziu.rar.html?msg=sess_error
Certificate IssuerLet's Encrypt
Subjectempafnyfiexpectt.info
Fingerprint0A:3C:72:5A:AE:C9:CE:C3:ED:9D:55:D4:4A:C3:28:A5:31:C0:1B:2B
ValidityMon, 04 Sep 2023 06:52:14 GMT - Sun, 03 Dec 2023 06:52:13 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
POST /cURqbHdeewkfSiB3PBUWOSxYODIrJzlfAzMWWxQ5Ei84ICA0cEwYHhV5U1VAQnJTSgcYIFddUQIwCxgCAnlZXEdAYgMCER55WlxHQGIcUUZfd15CREVqWkoCTHVMGAcQI1ddUQEwHgBKQHJTWERGd1heQkJ3Xg HTTP/1.1
Host: empafnyfiexpectt.info
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://www.upload.ee
DNT: 1
Connection: keep-alive
Referer: https://www.upload.ee/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Content-Length: 0
HTTP/3 204 No Content
date: Sun, 10 Sep 2023 19:13:45 GMT
access-control-allow-origin: *
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=gNT1ssf2bq%2F%2Fz7zBrwkYUoSuw%2B6BvJGIGVpXaTbl%2Bnixp%2FxZD0lgiJE%2BStKC5uv90Q3gYOvYiwUD2%2Fzj21%2Fu%2Fuo00P%2FY6nL66kdY8OnoIIT3XKGrsEQDvxf2DoNmXP1RAk91UqaZrN8%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 8049fd72688cb4eb-OSL
alt-svc: h3=":443"; ma=86400
banner.hookusbookus.com/assets/css/index_300x600.css
200 OK 7.2 kB URL GET HTTP/2 banner.hookusbookus.com/assets/css/index_300x600.css
IP
Requested by https://banner.hookusbookus.com/index_300x600.html?language=et_ee&utmSource=allmedia&click_url=https%3A%2F%2Fserving.bepolite.eu%2Fevent%3Fkey%3DFYFWuDany3hwv6rfuoAYF_I3Dac2g1H_tKyDb59iwG_kA2qWNDkOGsG9L7yF2N4rkocKqgGqp0m8aMS6hLpP_RG2RF8EHx_6d7Q6uK27xIXrGA8s6k23oeeYhhqoLly5hucnpoycddr9nEaa9hkF6xsjMRpq_w30KspY7s62Wq_zp3ZdgWtH0MKue5p5AGKHXJxXiVJEh1Vfgxn38rgFo-tSrOiriedI-Oi3R5i8w-2KEKyCRIfPP1ktkR_a1xBEN4Mp3hCHV2gL5wIlp7AQSx5xbztKZEP3IVdh-WxRkrPa5hY8OvOxWaQQS9P0iYfnngZXtFEp1ljuqs475VAp1Q%26clink%3Dhttp%253A%252F%252Fsmartad.ee&dynamic_url=https%3A%2F%2Fserving.bepolite.eu%2Fevent%3Fkey%3DFYFWuDany3hwv6rfuoAYF_I3Dac2g1H_tKyDb59iwG_kA2qWNDkOGsG9L7yF2N4rkocKqgGqp0m8aMS6hLpP_RG2RF8EHx_6d7Q6uK27xIXrGA8s6k23oeeYhhqoLly5hucnpoycddr9nEaa9hkF6xsjMRpq_w30KspY7s62Wq_zp3ZdgWtH0MKue5p5AGKHXJxXiVJEh1Vfgxn38rgFo-tSrOiriedI-Oi3R5i8w-2KEKyCRIfPP1ktkR_a1xBEN4Mp3hCHV2gL5wIlp7AQSx5xbztKZEP3IVdh-WxRkrPa5hY8OvOxWaQQS9P0iYfnngZXtFEp1ljuqs475VAp1Q%26clink%3D&f=https%3A%2F%2Fbanner.hookusbookus.com%2Findex_300x600.html%3Flanguage%3Det_ee%26utmSource%3Dallmedia&clink=https%3A%2F%2Fsmartad.ee&banner_id=3b881495c84042deb0d0288185da231350dd7b0f4105441f8f6018cc3fcb090c&bg=black&w=300&h=600&locale=Display%20Estonia-EST&info=https%3A%2F%2Fdigital.tv3.ee%2Fbepolite-id%2F%3Futm_src%3Dbanner
Certificate IssuerAmazon
Subject*.hookusbookus.com
FingerprintCD:CD:3C:03:66:21:F8:A9:21:BC:F8:C8:3C:DC:88:0A:C5:19:F1:7A
ValiditySun, 07 May 2023 00:00:00 GMT - Tue, 04 Jun 2024 23:59:59 GMT
File type ASCII text, with very long lines (7402), with no line terminators
Hash ef4576b025213d57cd958c234d61a8a1
5dd8d741efe63291e503bb6bf23e603c810b9030
69478abb1501f6c8fb03f774621b5f0275d59f55b3fc4f24d95bade9e277efdb
GET /assets/css/index_300x600.css HTTP/1.1
Host: banner.hookusbookus.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://banner.hookusbookus.com/index_300x600.html?language=et_ee&utmSource=allmedia&click_url=https%3A%2F%2Fserving.bepolite.eu%2Fevent%3Fkey%3DFYFWuDany3hwv6rfuoAYF_I3Dac2g1H_tKyDb59iwG_kA2qWNDkOGsG9L7yF2N4rkocKqgGqp0m8aMS6hLpP_RG2RF8EHx_6d7Q6uK27xIXrGA8s6k23oeeYhhqoLly5hucnpoycddr9nEaa9hkF6xsjMRpq_w30KspY7s62Wq_zp3ZdgWtH0MKue5p5AGKHXJxXiVJEh1Vfgxn38rgFo-tSrOiriedI-Oi3R5i8w-2KEKyCRIfPP1ktkR_a1xBEN4Mp3hCHV2gL5wIlp7AQSx5xbztKZEP3IVdh-WxRkrPa5hY8OvOxWaQQS9P0iYfnngZXtFEp1ljuqs475VAp1Q%26clink%3Dhttp%253A%252F%252Fsmartad.ee&dynamic_url=https%3A%2F%2Fserving.bepolite.eu%2Fevent%3Fkey%3DFYFWuDany3hwv6rfuoAYF_I3Dac2g1H_tKyDb59iwG_kA2qWNDkOGsG9L7yF2N4rkocKqgGqp0m8aMS6hLpP_RG2RF8EHx_6d7Q6uK27xIXrGA8s6k23oeeYhhqoLly5hucnpoycddr9nEaa9hkF6xsjMRpq_w30KspY7s62Wq_zp3ZdgWtH0MKue5p5AGKHXJxXiVJEh1Vfgxn38rgFo-tSrOiriedI-Oi3R5i8w-2KEKyCRIfPP1ktkR_a1xBEN4Mp3hCHV2gL5wIlp7AQSx5xbztKZEP3IVdh-WxRkrPa5hY8OvOxWaQQS9P0iYfnngZXtFEp1ljuqs475VAp1Q%26clink%3D&f=https%3A%2F%2Fbanner.hookusbookus.com%2Findex_300x600.html%3Flanguage%3Det_ee%26utmSource%3Dallmedia&clink=https%3A%2F%2Fsmartad.ee&banner_id=3b881495c84042deb0d0288185da231350dd7b0f4105441f8f6018cc3fcb090c&bg=black&w=300&h=600&locale=Display%20Estonia-EST&info=https%3A%2F%2Fdigital.tv3.ee%2Fbepolite-id%2F%3Futm_src%3Dbanner
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Sun, 10 Sep 2023 19:13:46 GMT
content-type: text/css
server: nginx/1.15.12
last-modified: Mon, 05 Jul 2021 19:56:59 GMT
vary: Accept-Encoding
etag: W/"60e3640b-1c4f"
content-encoding: gzip
X-Firefox-Spdy: h2
banner.hookusbookus.com/assets/fonts/greycliff-cf-regular.woff
200 OK 53 kB URL GET HTTP/2 banner.hookusbookus.com/assets/fonts/greycliff-cf-regular.woff
IP
Requested by https://banner.hookusbookus.com/index_300x600.html?language=et_ee&utmSource=allmedia&click_url=https%3A%2F%2Fserving.bepolite.eu%2Fevent%3Fkey%3DFYFWuDany3hwv6rfuoAYF_I3Dac2g1H_tKyDb59iwG_kA2qWNDkOGsG9L7yF2N4rkocKqgGqp0m8aMS6hLpP_RG2RF8EHx_6d7Q6uK27xIXrGA8s6k23oeeYhhqoLly5hucnpoycddr9nEaa9hkF6xsjMRpq_w30KspY7s62Wq_zp3ZdgWtH0MKue5p5AGKHXJxXiVJEh1Vfgxn38rgFo-tSrOiriedI-Oi3R5i8w-2KEKyCRIfPP1ktkR_a1xBEN4Mp3hCHV2gL5wIlp7AQSx5xbztKZEP3IVdh-WxRkrPa5hY8OvOxWaQQS9P0iYfnngZXtFEp1ljuqs475VAp1Q%26clink%3Dhttp%253A%252F%252Fsmartad.ee&dynamic_url=https%3A%2F%2Fserving.bepolite.eu%2Fevent%3Fkey%3DFYFWuDany3hwv6rfuoAYF_I3Dac2g1H_tKyDb59iwG_kA2qWNDkOGsG9L7yF2N4rkocKqgGqp0m8aMS6hLpP_RG2RF8EHx_6d7Q6uK27xIXrGA8s6k23oeeYhhqoLly5hucnpoycddr9nEaa9hkF6xsjMRpq_w30KspY7s62Wq_zp3ZdgWtH0MKue5p5AGKHXJxXiVJEh1Vfgxn38rgFo-tSrOiriedI-Oi3R5i8w-2KEKyCRIfPP1ktkR_a1xBEN4Mp3hCHV2gL5wIlp7AQSx5xbztKZEP3IVdh-WxRkrPa5hY8OvOxWaQQS9P0iYfnngZXtFEp1ljuqs475VAp1Q%26clink%3D&f=https%3A%2F%2Fbanner.hookusbookus.com%2Findex_300x600.html%3Flanguage%3Det_ee%26utmSource%3Dallmedia&clink=https%3A%2F%2Fsmartad.ee&banner_id=3b881495c84042deb0d0288185da231350dd7b0f4105441f8f6018cc3fcb090c&bg=black&w=300&h=600&locale=Display%20Estonia-EST&info=https%3A%2F%2Fdigital.tv3.ee%2Fbepolite-id%2F%3Futm_src%3Dbanner
Certificate IssuerAmazon
Subject*.hookusbookus.com
FingerprintCD:CD:3C:03:66:21:F8:A9:21:BC:F8:C8:3C:DC:88:0A:C5:19:F1:7A
ValiditySun, 07 May 2023 00:00:00 GMT - Tue, 04 Jun 2024 23:59:59 GMT
File type Web Open Font Format, TrueType, length 53104, version 1.500\012- data
Hash 4f5975fe17a8ca74963be0165ff6a443
4bca2ab6c3da2b6ae09602601adeac22e7a90381
5b8f98e0c93afef19bd64c3dea2a16d60dc1574e5a4a79b788ef03b9eb3c22df
GET /assets/fonts/greycliff-cf-regular.woff HTTP/1.1
Host: banner.hookusbookus.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
DNT: 1
Connection: keep-alive
Referer: https://banner.hookusbookus.com/assets/css/index_300x600.css
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Sun, 10 Sep 2023 19:13:46 GMT
content-type: font/woff
content-length: 53104
server: nginx/1.15.12
last-modified: Thu, 22 Apr 2021 07:20:15 GMT
etag: "608123af-cf70"
accept-ranges: bytes
X-Firefox-Spdy: h2
banner.hookusbookus.com/assets/js/jquery.min.js
200 OK 90 kB URL GET HTTP/2 banner.hookusbookus.com/assets/js/jquery.min.js
IP
Requested by https://banner.hookusbookus.com/index_300x600.html?language=et_ee&utmSource=allmedia&click_url=https%3A%2F%2Fserving.bepolite.eu%2Fevent%3Fkey%3DFYFWuDany3hwv6rfuoAYF_I3Dac2g1H_tKyDb59iwG_kA2qWNDkOGsG9L7yF2N4rkocKqgGqp0m8aMS6hLpP_RG2RF8EHx_6d7Q6uK27xIXrGA8s6k23oeeYhhqoLly5hucnpoycddr9nEaa9hkF6xsjMRpq_w30KspY7s62Wq_zp3ZdgWtH0MKue5p5AGKHXJxXiVJEh1Vfgxn38rgFo-tSrOiriedI-Oi3R5i8w-2KEKyCRIfPP1ktkR_a1xBEN4Mp3hCHV2gL5wIlp7AQSx5xbztKZEP3IVdh-WxRkrPa5hY8OvOxWaQQS9P0iYfnngZXtFEp1ljuqs475VAp1Q%26clink%3Dhttp%253A%252F%252Fsmartad.ee&dynamic_url=https%3A%2F%2Fserving.bepolite.eu%2Fevent%3Fkey%3DFYFWuDany3hwv6rfuoAYF_I3Dac2g1H_tKyDb59iwG_kA2qWNDkOGsG9L7yF2N4rkocKqgGqp0m8aMS6hLpP_RG2RF8EHx_6d7Q6uK27xIXrGA8s6k23oeeYhhqoLly5hucnpoycddr9nEaa9hkF6xsjMRpq_w30KspY7s62Wq_zp3ZdgWtH0MKue5p5AGKHXJxXiVJEh1Vfgxn38rgFo-tSrOiriedI-Oi3R5i8w-2KEKyCRIfPP1ktkR_a1xBEN4Mp3hCHV2gL5wIlp7AQSx5xbztKZEP3IVdh-WxRkrPa5hY8OvOxWaQQS9P0iYfnngZXtFEp1ljuqs475VAp1Q%26clink%3D&f=https%3A%2F%2Fbanner.hookusbookus.com%2Findex_300x600.html%3Flanguage%3Det_ee%26utmSource%3Dallmedia&clink=https%3A%2F%2Fsmartad.ee&banner_id=3b881495c84042deb0d0288185da231350dd7b0f4105441f8f6018cc3fcb090c&bg=black&w=300&h=600&locale=Display%20Estonia-EST&info=https%3A%2F%2Fdigital.tv3.ee%2Fbepolite-id%2F%3Futm_src%3Dbanner
Certificate IssuerAmazon
Subject*.hookusbookus.com
FingerprintCD:CD:3C:03:66:21:F8:A9:21:BC:F8:C8:3C:DC:88:0A:C5:19:F1:7A
ValiditySun, 07 May 2023 00:00:00 GMT - Tue, 04 Jun 2024 23:59:59 GMT
File type ASCII text, with very long lines (65451)
Hash dc5e7f18c8d36ac1d3d4753a87c98d0a
c8e1c8b386dc5b7a9184c763c88d19a346eb3342
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d
GET /assets/js/jquery.min.js HTTP/1.1
Host: banner.hookusbookus.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://banner.hookusbookus.com/index_300x600.html?language=et_ee&utmSource=allmedia&click_url=https%3A%2F%2Fserving.bepolite.eu%2Fevent%3Fkey%3DFYFWuDany3hwv6rfuoAYF_I3Dac2g1H_tKyDb59iwG_kA2qWNDkOGsG9L7yF2N4rkocKqgGqp0m8aMS6hLpP_RG2RF8EHx_6d7Q6uK27xIXrGA8s6k23oeeYhhqoLly5hucnpoycddr9nEaa9hkF6xsjMRpq_w30KspY7s62Wq_zp3ZdgWtH0MKue5p5AGKHXJxXiVJEh1Vfgxn38rgFo-tSrOiriedI-Oi3R5i8w-2KEKyCRIfPP1ktkR_a1xBEN4Mp3hCHV2gL5wIlp7AQSx5xbztKZEP3IVdh-WxRkrPa5hY8OvOxWaQQS9P0iYfnngZXtFEp1ljuqs475VAp1Q%26clink%3Dhttp%253A%252F%252Fsmartad.ee&dynamic_url=https%3A%2F%2Fserving.bepolite.eu%2Fevent%3Fkey%3DFYFWuDany3hwv6rfuoAYF_I3Dac2g1H_tKyDb59iwG_kA2qWNDkOGsG9L7yF2N4rkocKqgGqp0m8aMS6hLpP_RG2RF8EHx_6d7Q6uK27xIXrGA8s6k23oeeYhhqoLly5hucnpoycddr9nEaa9hkF6xsjMRpq_w30KspY7s62Wq_zp3ZdgWtH0MKue5p5AGKHXJxXiVJEh1Vfgxn38rgFo-tSrOiriedI-Oi3R5i8w-2KEKyCRIfPP1ktkR_a1xBEN4Mp3hCHV2gL5wIlp7AQSx5xbztKZEP3IVdh-WxRkrPa5hY8OvOxWaQQS9P0iYfnngZXtFEp1ljuqs475VAp1Q%26clink%3D&f=https%3A%2F%2Fbanner.hookusbookus.com%2Findex_300x600.html%3Flanguage%3Det_ee%26utmSource%3Dallmedia&clink=https%3A%2F%2Fsmartad.ee&banner_id=3b881495c84042deb0d0288185da231350dd7b0f4105441f8f6018cc3fcb090c&bg=black&w=300&h=600&locale=Display%20Estonia-EST&info=https%3A%2F%2Fdigital.tv3.ee%2Fbepolite-id%2F%3Futm_src%3Dbanner
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Sun, 10 Sep 2023 19:13:46 GMT
content-type: application/javascript
server: nginx/1.15.12
last-modified: Thu, 22 Apr 2021 07:20:15 GMT
vary: Accept-Encoding
etag: W/"608123af-15d84"
content-encoding: gzip
X-Firefox-Spdy: h2
dskwugy0u6y9l.cloudfront.net/hotelliveeb/images/general/1/vvIcadrN02xzIXgAwzoP.jpg
421 Misdirected Request 58 kB URL GET HTTP/2 dskwugy0u6y9l.cloudfront.net/hotelliveeb/images/general/1/vvIcadrN02xzIXgAwzoP.jpg
IP
Requested by https://banner.hookusbookus.com/index_300x600.html?language=et_ee&utmSource=allmedia&click_url=https%3A%2F%2Fserving.bepolite.eu%2Fevent%3Fkey%3DFYFWuDany3hwv6rfuoAYF_I3Dac2g1H_tKyDb59iwG_kA2qWNDkOGsG9L7yF2N4rkocKqgGqp0m8aMS6hLpP_RG2RF8EHx_6d7Q6uK27xIXrGA8s6k23oeeYhhqoLly5hucnpoycddr9nEaa9hkF6xsjMRpq_w30KspY7s62Wq_zp3ZdgWtH0MKue5p5AGKHXJxXiVJEh1Vfgxn38rgFo-tSrOiriedI-Oi3R5i8w-2KEKyCRIfPP1ktkR_a1xBEN4Mp3hCHV2gL5wIlp7AQSx5xbztKZEP3IVdh-WxRkrPa5hY8OvOxWaQQS9P0iYfnngZXtFEp1ljuqs475VAp1Q%26clink%3Dhttp%253A%252F%252Fsmartad.ee&dynamic_url=https%3A%2F%2Fserving.bepolite.eu%2Fevent%3Fkey%3DFYFWuDany3hwv6rfuoAYF_I3Dac2g1H_tKyDb59iwG_kA2qWNDkOGsG9L7yF2N4rkocKqgGqp0m8aMS6hLpP_RG2RF8EHx_6d7Q6uK27xIXrGA8s6k23oeeYhhqoLly5hucnpoycddr9nEaa9hkF6xsjMRpq_w30KspY7s62Wq_zp3ZdgWtH0MKue5p5AGKHXJxXiVJEh1Vfgxn38rgFo-tSrOiriedI-Oi3R5i8w-2KEKyCRIfPP1ktkR_a1xBEN4Mp3hCHV2gL5wIlp7AQSx5xbztKZEP3IVdh-WxRkrPa5hY8OvOxWaQQS9P0iYfnngZXtFEp1ljuqs475VAp1Q%26clink%3D&f=https%3A%2F%2Fbanner.hookusbookus.com%2Findex_300x600.html%3Flanguage%3Det_ee%26utmSource%3Dallmedia&clink=https%3A%2F%2Fsmartad.ee&banner_id=3b881495c84042deb0d0288185da231350dd7b0f4105441f8f6018cc3fcb090c&bg=black&w=300&h=600&locale=Display%20Estonia-EST&info=https%3A%2F%2Fdigital.tv3.ee%2Fbepolite-id%2F%3Futm_src%3Dbanner
Certificate IssuerAmazon
Subject*.cloudfront.net
FingerprintBA:0F:CD:B3:EA:19:B2:9D:99:9B:51:2D:16:33:6B:D0:3F:31:A2:AB
ValidityThu, 08 Dec 2022 00:00:00 GMT - Thu, 07 Dec 2023 23:59:59 GMT
File type JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 300x230, components 3\012- data
Hash 62c78f9e7993862db8a485e7a5bf3c6a
311a57db504119fdb621d3127f548589bbe15b5b
e601c6113927a94f7f57b9f2cb5c8195e9193d6a4afaa6b5c9581e1d83695224
GET /hotelliveeb/images/general/1/vvIcadrN02xzIXgAwzoP.jpg HTTP/1.1
Host: dskwugy0u6y9l.cloudfront.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://banner.hookusbookus.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 421 Misdirected Request
server: CloudFront
date: Sun, 10 Sep 2023 19:13:46 GMT
content-type: text/html
content-length: 1003
x-cache: Error from cloudfront
via: 1.1 aac54e3fe9825ce24d51e0204433c2c0.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-C1
x-amz-cf-id: kAJtnuAYjk6XjPN_mlb3nlQWvzLY4b-I2gRYGOJtD6J45vtxKlUhqQ==
X-Firefox-Spdy: h2
serving.bepolite.eu/script?space=50dd7b0f-4105-441f-8f60-18cc3fcb090c&type=direct&page_id=2931941&screen_width=1280&screen_height=1024&os=Linux%20x86_64&refurl=https%3A%2F%2Fwww.upload.ee%2Fdownload%2F15560170%2Fa97cd721e2d81d84aedb%2FFab.Generic.Hook.10082023-TheRadziu.rar&pageurl=https%3A%2F%2Fwww.upload.ee%2Ffiles%2F15560170%2FFab.Generic.Hook.10082023-TheRadziu.rar.html%3Fmsg%3Dsess_error&rnd=1694373224168
0 B URL GET serving.bepolite.eu/script?space=50dd7b0f-4105-441f-8f60-18cc3fcb090c&type=direct&page_id=2931941&screen_width=1280&screen_height=1024&os=Linux%20x86_64&refurl=https%3A%2F%2Fwww.upload.ee%2Fdownload%2F15560170%2Fa97cd721e2d81d84aedb%2FFab.Generic.Hook.10082023-TheRadziu.rar&pageurl=https%3A%2F%2Fwww.upload.ee%2Ffiles%2F15560170%2FFab.Generic.Hook.10082023-TheRadziu.rar.html%3Fmsg%3Dsess_error&rnd=1694373224168
IP
Requested by https://www.upload.ee/files/15560170/Fab.Generic.Hook.10082023-TheRadziu.rar.html?msg=sess_error
Certificate IssuerLet's Encrypt
Subjectstatic.bepolite.eu
FingerprintB7:1B:BB:35:5B:E5:6E:92:4D:DE:79:2E:0E:C8:1F:0D:CE:28:88:FD
ValidityMon, 04 Sep 2023 21:06:47 GMT - Sun, 03 Dec 2023 21:06:46 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /script?space=50dd7b0f-4105-441f-8f60-18cc3fcb090c&type=direct&page_id=2931941&screen_width=1280&screen_height=1024&os=Linux%20x86_64&refurl=https%3A%2F%2Fwww.upload.ee%2Fdownload%2F15560170%2Fa97cd721e2d81d84aedb%2FFab.Generic.Hook.10082023-TheRadziu.rar&pageurl=https%3A%2F%2Fwww.upload.ee%2Ffiles%2F15560170%2FFab.Generic.Hook.10082023-TheRadziu.rar.html%3Fmsg%3Dsess_error&rnd=1694373224168 HTTP/1.1
Host: serving.bepolite.eu
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.upload.ee/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
cache-control: private, must-revalidate, max-age=0
vary: accept-encoding
content-encoding: gzip
content-type: text/plain;charset=ISO-8859-1
date: Sun, 10 Sep 2023 19:13:31 GMT
set-cookie: bepolite_id=fa8834dc0a241d1c7b84ec42da0c0659; Max-Age=7776000; Expires=Sat, 09-Dec-2023 19:13:31 GMT; SameSite=None; Secure
p3p: CP='BePolite does not have a P3P policy'
x-varnish: 308732384
age: 0
accept-ranges: bytes
content-length: 1343
X-Firefox-Spdy: h2
51.91.30.159
188.114.96.1
108.157.214.5
212.47.222.20
3.123.83.244
0.0.0.0
0.0.0.0