s3-ap-southeast-1.amazonaws.com

Summary

This website contacted 2 IPs in 3 countries across 4 domains to perform 2 HTTP transactions. The main IP is 52.219.36.117, located in Singapore, Singapore and belongs to AMAZON-02 - Amazon.com, Inc., US. The main domain is s3-ap-southeast-1.amazonaws.com.
TLS certificate: Issued by DigiCert Baltimore CA-2 G2 on November 8th 2018. Valid for: a year.

This is the only time s3-ap-southeast-1.amazonaws.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Downloads These files were downloaded by the website

N2019Br9876546546.msi 1 MB application/x-msi

SHA256: 98d6839387d86774f0757071637ee1b29fdd2b592c97b73c07983032273510fd

MIME: Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Code page: 1252, Title: Google Chrome 71.0.3578.98, Subject: Google Chrome, Author: Google Inc., Keywords: Installer, Template: Intel;1033, Revision Number: {D416682F-63E6-4F88-946F-715962592023}, Create Time/Date: Mon Aug 13 18:00:06 2018, Last Saved Time/Date: Mon Aug 13 18:00:06 2018, Number of Pages: 200, Number of Words: 12, Name of Creating Application: MSI Wrapper (8.0.26.0), Security: 2

Domain & IP information

	IP Address	AS Autonomous System
1	52.219.36.117 52.219.36.117	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
1 1	185.224.248.57 185.224.248.57	56630 (MELBICOM-...) (MELBICOM-EU-AS Melbikomas UAB)
2 2	2620:100:6021... 2620:100:6021:1::a27d:4101	19679 (DROPBOX) (DROPBOX - Dropbox)
1	2620:100:6022... 2620:100:6022:6::a27d:4206	19679 (DROPBOX) (DROPBOX - Dropbox)
2	2

1 52.219.36.117 (Singapore, Singapore)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)

s3-ap-southeast-1.amazonaws.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 185.224.248.57 (None, ) 1 redirects

ASN56630 (MELBICOM-EU-AS Melbikomas UAB, NL)
PTR: lamekeri.forteacaimbx.com.br

geranotas-nfe.ml	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2620:100:6021:1::a27d:4101 (United States) 2 redirects

ASN19679 (DROPBOX - Dropbox, Inc., US)

www.dropbox.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2620:100:6022:6::a27d:4206 (United States)

ASN19679 (DROPBOX - Dropbox, Inc., US)

uce01d5f5662aca50741f12c7394.dl.dropboxusercontent.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
2	dropbox.com 2 redirects www.dropbox.com	2 KB
1	dropboxusercontent.com uce01d5f5662aca50741f12c7394.dl.dropboxusercontent.com
1	geranotas-nfe.ml 1 redirects geranotas-nfe.ml	307 B
1	amazonaws.com s3-ap-southeast-1.amazonaws.com	493 B
2	4

	Domain	Requested by
2	www.dropbox.com	2 redirects
1	uce01d5f5662aca50741f12c7394.dl.dropboxusercontent.com
1	geranotas-nfe.ml	1 redirects
1	s3-ap-southeast-1.amazonaws.com
2	4

This site contains no links.

Subject Issuer	Validity	Valid
*.s3-ap-southeast-1.amazonaws.com DigiCert Baltimore CA-2 G2	`2018-11-08` - `2019-11-06`	a year	crt.sh
*.dl.dropboxusercontent.com DigiCert SHA2 High Assurance Server CA	`2017-03-06` - `2020-03-10`	3 years	crt.sh

This page contains 1 frames:

Frame: https://uce01d5f5662aca50741f12c7394.dl.dropboxusercontent.com/cd/0/get/Aagqip0VlFkbqk-LOozR0KqRlaPWGrRXnazGXD0r0IXytPNtVCQ63d_QdZX6b1bOBODMvFvsMEqcykllNS-MD8D8Eh78mJ5-983QaPdV5Joo3w/file?dl=1
Frame ID: CFF20CF2231A17B4E5334F216DFD356F
Requests: 2 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

Amazon S3 (Miscellaneous) Expand

Overall confidence: 100%
Detected patterns

headers server /AmazonS3/i

Page Statistics

2
Requests

100 %
HTTPS

50 %
IPv6

4
Domains

4
Subdomains

2
IPs

3
Countries

0 kB
Transfer

0 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

http://geranotas-nfe.ml/ HTTP 302
https://www.dropbox.com/s/sssr7uz79wtmj10/N2019Br9876546546.msi?dl=1 HTTP 301
https://www.dropbox.com/s/dl/sssr7uz79wtmj10/N2019Br9876546546.msi HTTP 302
https://uce01d5f5662aca50741f12c7394.dl.dropboxusercontent.com/cd/0/get/Aagqip0VlFkbqk-LOozR0KqRlaPWGrRXnazGXD0r0IXytPNtVCQ63d_QdZX6b1bOBODMvFvsMEqcykllNS-MD8D8Eh78mJ5-983QaPdV5Joo3w/file?dl=1

2 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request NFe20192901554785412.html Show response
s3-ap-southeast-1.amazonaws.com/notasemitidasportal/ 137 B
493 B 741ms
206ms Document
text/html 52.219.36.117
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://s3-ap-southeast-1.amazonaws.com/notasemitidasportal/NFe20192901554785412.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.219.36.117 Singapore, Singapore, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: a735e6cdb92250fd84682e53213316e023735ef3c6e72bcf2173c939ab053541

Request headers

Host: s3-ap-southeast-1.amazonaws.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Accept-Encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

x-amz-id-2: q/3lZzAK2npj8+8jmyDE3M3/Le9KX73EaRX/invDyV3DedenvqkKsySg2VQrpgqaUctFxM69vAw=
x-amz-request-id: 515048439C57FDB7
Date: Fri, 01 Feb 2019 15:50:07 GMT
Last-Modified: Fri, 01 Feb 2019 08:48:34 GMT
ETag: "4e13feeb574ebc676a6dc0e953120b25"
Accept-Ranges: bytes
Content-Type: text/html
Content-Length: 137
Server: AmazonS3

GET
H2

200

file
uce01d5f5662aca50741f12c7394.dl.dropboxusercontent.com/cd/0/get/Aagqip0VlFkbqk-LOozR0KqRlaPWGrRXnazGXD0r0IXytPNtVCQ63d_QdZX6b1bOBODMvFvsMEqcykllNS-MD8D8Eh78mJ5-983QaPdV5Joo3w/
Redirect Chain

http://geranotas-nfe.ml/
https://www.dropbox.com/s/sssr7uz79wtmj10/N2019Br9876546546.msi?dl=1
https://www.dropbox.com/s/dl/sssr7uz79wtmj10/N2019Br9876546546.msi
https://uce01d5f5662aca50741f12c7394.dl.dropboxusercontent.com/cd/0/get/Aagqip0VlFkbqk-LOozR0KqRlaPWGrRXnazGXD0r0IXytPNtVCQ63d_QdZX6b1bOBODMvFvsMEqcykllNS-MD8D8Eh78mJ5-983QaPdV5Joo3w/file?dl=1

0
0

388ms
344ms

Document
application/binary

2620:100:6022:6::a27d:4206
Dropbox

General

Check archive.org

Show headers Download Go to

Full URL

https://uce01d5f5662aca50741f12c7394.dl.dropboxusercontent.com/cd/0/get/Aagqip0VlFkbqk-LOozR0KqRlaPWGrRXnazGXD0r0IXytPNtVCQ63d_QdZX6b1bOBODMvFvsMEqcykllNS-MD8D8Eh78mJ5-983QaPdV5Joo3w/file?dl=1

Protocol

H2

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2620:100:6022:6::a27d:4206 , United States, ASN19679 (DROPBOX - Dropbox, Inc., US),

Reverse DNS

Software

nginx /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	referrer no-referrer; sandbox;
Strict-Transport-Security	max-age=15552000; includeSubDomains
X-Content-Security-Policy	sandbox
X-Content-Type-Options	nosniff

Request headers

:method: GET
:authority: uce01d5f5662aca50741f12c7394.dl.dropboxusercontent.com
:scheme: https
:path: /cd/0/get/Aagqip0VlFkbqk-LOozR0KqRlaPWGrRXnazGXD0r0IXytPNtVCQ63d_QdZX6b1bOBODMvFvsMEqcykllNS-MD8D8Eh78mJ5-983QaPdV5Joo3w/file?dl=1
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

status: 200
server: nginx
date: Fri, 01 Feb 2019 15:50:13 GMT
content-type: application/binary
content-length: 1159168
x-content-security-policy: sandbox
content-disposition: attachment; filename="N2019Br9876546546.msi"; filename*=UTF-8''N2019Br9876546546.msi
x-robots-tag: noindex, nofollow, noimageindex
content-security-policy: referrer no-referrer; sandbox;
x-content-type-options: nosniff
accept-ranges: bytes
etag: 4d
x-dropbox-request-id: 177ec6cbb70221d70b3942454d599223
pragma: public
cache-control: max-age=60
referrer-policy: no-referrer
x-webkit-csp: sandbox
vary: Origin
x-server-response-time: 210
strict-transport-security: max-age=15552000; includeSubDomains

Redirect headers

status: 302
server: nginx
date: Fri, 01 Feb 2019 15:50:12 GMT
content-type: text/html; charset=utf-8
content-length: 0
location: https://uce01d5f5662aca50741f12c7394.dl.dropboxusercontent.com/cd/0/get/Aagqip0VlFkbqk-LOozR0KqRlaPWGrRXnazGXD0r0IXytPNtVCQ63d_QdZX6b1bOBODMvFvsMEqcykllNS-MD8D8Eh78mJ5-983QaPdV5Joo3w/file?dl=1#
cache-control: no-cache
content-security-policy: sandbox
pragma: no-cache
referrer-policy: origin-when-cross-origin
set-cookie: __Host-js_csrf=Lv85wAFbIKicJekLpGZxDN6w; expires=Mon, 31 Jan 2022 15:50:12 GMT; Path=/; secure t=Lv85wAFbIKicJekLpGZxDN6w; Domain=dropbox.com; expires=Mon, 31 Jan 2022 15:50:12 GMT; httponly; Path=/; secure __Host-ss=T0fdbEDBS4; expires=Mon, 31 Jan 2022 15:50:12 GMT; httponly; Path=/; SameSite=strict; secure puc=; expires=Fri, 01 Feb 2019 15:50:12 GMT; httponly; Path=/; secure
x-content-type-options: nosniff
x-dropbox-request-id: 20d5c366ff2088ac3bc78fd8a802c4f7
x-frame-options: DENY
x-xss-protection: 1; mode=block
strict-transport-security: max-age=15552000; includeSubDomains

Verdicts & Comments Add Verdict or Comment

3 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onselectstart object| onselectionchange function| queueMicrotask

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

geranotas-nfe.ml
s3-ap-southeast-1.amazonaws.com
uce01d5f5662aca50741f12c7394.dl.dropboxusercontent.com
www.dropbox.com
185.224.248.57
2620:100:6021:1::a27d:4101
2620:100:6022:6::a27d:4206
52.219.36.117
a735e6cdb92250fd84682e53213316e023735ef3c6e72bcf2173c939ab053541

s3-ap-southeast-1.amazonaws.com Open in urlscan Pro 52.219.36.117 Public Scan

Summary

urlscan.io Verdict: No classification

Downloads These files were downloaded by the website

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

2 Requests

100 %HTTPS

50 %IPv6

4 Domains

4 Subdomains

2 IPs

3 Countries

0 kBTransfer

0 kBSize

0 Cookies

0 Outgoing links

Redirected requests

2 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Redirect headers

Verdicts & Comments Add Verdict or Comment

3 JavaScript Global Variables

0 Cookies

Indicators

s3-ap-southeast-1.amazonaws.com Open in urlscan Pro
52.219.36.117 Public Scan

Screenshot
Live screenshot

Full Image

2
Requests

100 %
HTTPS

50 %
IPv6

4
Domains

4
Subdomains

2
IPs

3
Countries

0 kB
Transfer

0 kB
Size

0
Cookies

2 HTTP transactions
0 data transactions