mail-cisi.org - urlscan.io

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 5 HTTP transactions. The main IP is 104.16.209.86, located in and belongs to CLOUDFLARENET, US. The main domain is mail-cisi.org.
TLS certificate: Issued by GTS CA 1P5 on January 26th 2023. Valid for: 3 months.

This is the only time mail-cisi.org was scanned on urlscan.io!

urlscan.io Verdict: No classification

Downloads These files were downloaded by the website

capital_markets_survey_l3_l6_2023_tcs.pdf 366 KB application/pdf

SHA256: dbd95d164ab80d256c84eb830084ba726bef1eecf0018fe9346cdbcd7bcdf3f9

MIME: PDF document, version 1.6

Size: 366 KB (374631 bytes, 100% done)

Downloaded from: https://www.cisi.org/cisiweb2/docs/default-source/cisi-website/capital_markets_survey_l3_l6_2023_tcs.pdf?utm_source=CISI&utm_medium=email&utm_campaign=13839514_Capital%20Markets%20Survey%20-%20Level%203%20-%20Reminder%201&utm_content=t%26c

Domain & IP information

	IP Address	AS Autonomous System
4	104.16.209.86 104.16.209.86	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	20.50.102.16 20.50.102.16	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
5	2

4 104.16.209.86 (None, )

ASN13335 (CLOUDFLARENET, US)

mail-cisi.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 20.50.102.16 (London, United Kingdom)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

www.cisi.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
4	mail-cisi.org mail-cisi.org	20 KB
1	cisi.org www.cisi.org — Cisco Umbrella Rank: 338703
5	2

	Domain	Requested by
4	mail-cisi.org	mail-cisi.org
1	www.cisi.org
5	2

This site contains links to these domains. Also see Links.

Domain
www.cisi.org

Subject Issuer	Validity	Valid
mail-cisi.org GTS CA 1P5	`2023-01-26` - `2023-04-26`	3 months	crt.sh
*.cisi.org Go Daddy Secure Certificate Authority - G2	`2022-06-24` - `2023-06-27`	a year	crt.sh

This page contains 2 frames:

Frame: https://www.cisi.org/cisiweb2/docs/default-source/cisi-website/capital_markets_survey_l3_l6_2023_tcs.pdf?utm_source=CISI&utm_medium=email&utm_campaign=13839514_Capital%20Markets%20Survey%20-%20Level%203%20-%20Reminder%201&utm_content=t%26c
Frame ID: CC7794C8D08DF7EC4DBAE05C2E84B655
Requests: 2 HTTP requests in this frame

Frame: https://mail-cisi.org/cdn-cgi/challenge-platform/h/g/scripts/alpha/invisible.js?ts=1679400000
Frame ID: 0DAB92FE51CF2D831CE0D4DBC43AF8B0
Requests: 3 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

Microsoft ASP.NET (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

\.aspx?(?:$|\?)

Page Statistics

5
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

20 kB
Transfer

37 kB
Size

4
Cookies

1 Outgoing links

These are links going to different origins than the main page.

URL: https://www.cisi.org/cisiweb2/docs/default-source/cisi-website/capital_markets_survey_l3_l6_2023_tcs.pdf?utm_source=CISI&utm_medium=email&utm_campaign=13839514_Capital%20Markets%20Survey%20-%20Level%203%20-%20Reminder%201&utm_content=t%26c
Title: Klicken Sie hier, um sich Ihr Dokument anzeigen zu lassen

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

5 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request c.aspx Show response
mail-cisi.org/12P-88MMY-8XXOKN-53I45P-1/ 2 KB
2 KB 128ms
96ms Document
text/html 104.16.209.86
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://mail-cisi.org/12P-88MMY-8XXOKN-53I45P-1/c.aspx
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.209.86 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d210ccb0667190f676503f2581be19358098e21a8e295fd76b89818e5cbe16f3

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control: private, max-age=0
cf-cache-status: DYNAMIC
cf-ray: 7ab7250bff51bbe5-FRA
content-encoding: gzip
content-type: text/html
date: Tue, 21 Mar 2023 15:14:27 GMT
server: cloudflare

GET
H2 200 invisible.js Show response
mail-cisi.org/cdn-cgi/challenge-platform/h/g/scripts/alpha/ Frame 0DAB 29 KB
14 KB 14ms
13ms Script
application/javascript 104.16.209.86
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://mail-cisi.org/cdn-cgi/challenge-platform/h/g/scripts/alpha/invisible.js?ts=1679400000
Requested by: Host: mail-cisi.org
URL: https://mail-cisi.org/12P-88MMY-8XXOKN-53I45P-1/c.aspx
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.209.86 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7c7437e113f7d7832ed4c5aeeb66cf9452eb8e44f5457e70d08e0e8d78bb2042

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date: Tue, 21 Mar 2023 15:14:28 GMT
content-encoding: gzip
server: cloudflare
vary: accept-encoding
content-type: application/javascript; charset=UTF-8
cache-control: max-age=14400, public
x-control-type-options: nosniff
cf-ray: 7ab7250dda28bbe5-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H/1.1 200
OK capital_markets_survey_l3_l6_2023_tcs.pdf
www.cisi.org/cisiweb2/docs/default-source/cisi-website/ 0
0 374ms
165ms Document
application/pdf 20.50.102.16
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.cisi.org/cisiweb2/docs/default-source/cisi-website/capital_markets_survey_l3_l6_2023_tcs.pdf?utm_source=CISI&utm_medium=email&utm_campaign=13839514_Capital%20Markets%20Survey%20-%20Level%203%20-%20Reminder%201&utm_content=t%26c

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

20.50.102.16 London, United Kingdom, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

/

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' .googleapis.com .gstatic.com www.google.com .google-analytics.com apis.google.com connect.facebook.net ajax.aspnetcdn.com https://www.youtube.com/iframe_api platform.twitter.com https://syndication.twitter.com/ https://s.ytimg.com https://publish.twitter.com .twimg.com platform.linkedin.com http://platform.stumbleupon.com/1/widgets.js https://dec.azureedge.net/ munchkin.marketo.net .eloqua.com js.hs-scripts.com js.hs-analytics.net .en25.com cdn.ampproject.org https://.googletagmanager.com https://snap.licdn.com https://code.jquery.com/ui/ .purechat.com .purechatcdn.com .vzaar.com .jobtarget.com cookie-cdn.cookiepro.com .fastly.net .vo.msecnd.net; style-src 'self' 'unsafe-inline' .googleapis.com .gstatic.com netdna.bootstrapcdn.com kendo.cdn.telerik.com www.google.com https://dec.azureedge.net platform.twitter.com/css/ .twimg.com; font-src 'self' fonts.gstatic.com kendo.cdn.telerik.com netdna.bootstrapcdn.com data:; img-src 'self' data: blob: https:; media-src 'self' data: blob: https://.vzaar.com .purechatcdn.com; child-src 'self' https://platform.twitter.com/ https://syndication.twitter.com/ https://www.youtube.com/ https://player.vimeo.com/ https://w.soundcloud.com/ apis.google.com accounts.google.com staticxx.facebook.com www.facebook.com web.facebook.com badge.stumbleupon.com https://.googletagmanager.com https://.google.com https://.vzaar.com https://.doubleclick.net https://.dacast.com https://dacastmmd.mmdlive.lldns.net https://.cbox.ws https://.ustream.tv https://.pxp-solutions.net app.powerbi.com cdn.knightlab.com .fastly.net api.test.kalixa.com appdev.fusiontelecom.co; connect-src 'self' accounts.google.com https://.dec.sitefinity.com .mktoresp.com https://telize-v1.p.rapidapi.com/geoip .purechat.com wss://.purechat.com https://.doubleclick.net https://.google-analytics.com https://.googleapis.com cookie-cdn.cookiepro.com geolocation.onetrust.com *.visualstudio.com api.dictionaryapi.dev; object-src 'none';
Strict-Transport-Security	max-age=31536000; includeSubdomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

Referer: https://mail-cisi.org/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Access-Control-Expose-Headers: Request-Context
Cache-Control: public, max-age=7776000
Connection: keep-alive
Content-Disposition: inline; filename=capital_markets_survey_l3_l6_2023_tcs.pdf
Content-Length: 374631
Content-Type: application/pdf
Date: Tue, 21 Mar 2023 15:14:28 GMT
Expires: Mon, 19 Jun 2023 14:14:28 GMT
Last-Modified: Thu, 09 Mar 2023 14:59:40 GMT
Request-Context: appId=cid-v1:0202b014-27ed-41c9-beb6-15abdc64caf2
SERVER
content-security-policy: default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' *.googleapis.com *.gstatic.com www.google.com *.google-analytics.com apis.google.com connect.facebook.net ajax.aspnetcdn.com https://www.youtube.com/iframe_api platform.twitter.com https://syndication.twitter.com/ https://s.ytimg.com https://publish.twitter.com *.twimg.com platform.linkedin.com http://platform.stumbleupon.com/1/widgets.js https://dec.azureedge.net/ munchkin.marketo.net *.eloqua.com js.hs-scripts.com js.hs-analytics.net *.en25.com cdn.ampproject.org https://*.googletagmanager.com https://snap.licdn.com https://code.jquery.com/ui/ *.purechat.com *.purechatcdn.com *.vzaar.com *.jobtarget.com cookie-cdn.cookiepro.com *.fastly.net *.vo.msecnd.net; style-src 'self' 'unsafe-inline' *.googleapis.com *.gstatic.com netdna.bootstrapcdn.com kendo.cdn.telerik.com www.google.com https://dec.azureedge.net platform.twitter.com/css/ *.twimg.com; font-src 'self' fonts.gstatic.com kendo.cdn.telerik.com netdna.bootstrapcdn.com data:; img-src 'self' data: blob: https:; media-src 'self' data: blob: https://*.vzaar.com *.purechatcdn.com; child-src 'self' https://platform.twitter.com/ https://syndication.twitter.com/ https://www.youtube.com/ https://player.vimeo.com/ https://w.soundcloud.com/ apis.google.com accounts.google.com staticxx.facebook.com www.facebook.com web.facebook.com badge.stumbleupon.com https://*.googletagmanager.com https://*.google.com https://*.vzaar.com https://*.doubleclick.net https://*.dacast.com https://dacastmmd.mmdlive.lldns.net https://*.cbox.ws https://*.ustream.tv https://*.pxp-solutions.net app.powerbi.com cdn.knightlab.com *.fastly.net api.test.kalixa.com appdev.fusiontelecom.co; connect-src 'self' accounts.google.com https://*.dec.sitefinity.com *.mktoresp.com https://telize-v1.p.rapidapi.com/geoip *.purechat.com wss://*.purechat.com https://*.doubleclick.net https://*.google-analytics.com https://*.googleapis.com cookie-cdn.cookiepro.com geolocation.onetrust.com *.visualstudio.com api.dictionaryapi.dev; object-src 'none';
referrer-policy: no-referrer-when-downgrade
strict-transport-security: max-age=31536000; includeSubdomains; preload
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-xss-protection: 1;mode=block

GET
H2 200 pica.js
mail-cisi.org/cdn-cgi/challenge-platform/h/g/scripts/ Frame 0DAB 7 KB
4 KB 13ms
13ms Other
application/javascript 104.16.209.86
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://mail-cisi.org/cdn-cgi/challenge-platform/h/g/scripts/pica.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.209.86 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 21b1d84eab7435290ee76955d1acc6f9a92c0e2221aa6d6b717866e85ae677e4

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date: Tue, 21 Mar 2023 15:14:28 GMT
content-encoding: gzip
server: cloudflare
vary: accept-encoding
content-type: application/javascript; charset=UTF-8
cache-control: max-age=14400, public
x-control-type-options: nosniff
cf-ray: 7ab7250e0a88bbe5-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

POST
H3 200 7ab7250bff51bbe5 Show response
mail-cisi.org/cdn-cgi/challenge-platform/h/g/cv/result/ Frame 0DAB 2 B
460 B 37ms
37ms XHR
text/plain 104.16.209.86
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://mail-cisi.org/cdn-cgi/challenge-platform/h/g/cv/result/7ab7250bff51bbe5
Requested by: Host: mail-cisi.org
URL: https://mail-cisi.org/cdn-cgi/challenge-platform/h/g/scripts/alpha/invisible.js?ts=1679400000
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.16.209.86 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df

Request headers

Referer
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36
Content-Type: application/json

Response headers

date: Tue, 21 Mar 2023 15:14:28 GMT
content-encoding: gzip
server: cloudflare
cf-ray: 7ab7250fafc92c3d-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-type: text/plain; charset=UTF-8

Verdicts & Comments Add Verdict or Comment

2 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 boolean| credentialless

4 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
mail-cisi.org/	1970-01-20 10:31:34	Name: __cflb Value: 0H28vbka3Tp63XFuYsqHHrawjcNu2NcTFGLP37koYGc
.mail-cisi.org/	1970-01-20 10:30:13	Name: __cf_bm Value: Ag0Z6pxARH7ISg_Amne0gmcMcrB9GzFv784_e1zOs0U-1679411668-0-AeHtMNT2kW77BCnmdU3mK7Tfl1F733kjkgmYEieDDPu9aoM39GUm/95A3Cj5lqV21+FXqSzQXkKUA9aN2W7Wma6T/ygQLl3SwFCA4wM9KzzpG5Hw5Xnq7chrUn95h0qSUwtEU3oqbYVUdSRMCOr7WBe1uuJgjsfZnDR8lxOnnLUF
www.cisi.org/	1969-12-31 23:59:59	Name: ApplicationGatewayAffinityCORS Value: e5386addff9819046a42f99b5c9d97d9
www.cisi.org/	1969-12-31 23:59:59	Name: ApplicationGatewayAffinity Value: e5386addff9819046a42f99b5c9d97d9

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

mail-cisi.org
www.cisi.org
104.16.209.86
20.50.102.16
21b1d84eab7435290ee76955d1acc6f9a92c0e2221aa6d6b717866e85ae677e4
2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df
7c7437e113f7d7832ed4c5aeeb66cf9452eb8e44f5457e70d08e0e8d78bb2042
d210ccb0667190f676503f2581be19358098e21a8e295fd76b89818e5cbe16f3

mail-cisi.org Open in urlscan Pro 104.16.209.86 Public Scan

Summary

urlscan.io Verdict: No classification

Downloads These files were downloaded by the website

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

5 Requests

100 %HTTPS

0 %IPv6

2 Domains

2 Subdomains

2 IPs

2 Countries

20 kBTransfer

37 kBSize

4 Cookies

1 Outgoing links

Redirected requests

5 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

2 JavaScript Global Variables

4 Cookies

Indicators

mail-cisi.org Open in urlscan Pro
104.16.209.86 Public Scan

Screenshot
Live screenshot

Full Image

5
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

20 kB
Transfer

37 kB
Size

4
Cookies

5 HTTP transactions
0 data transactions