URL: https://swiftinstitutemail.org/47RJ-1DF0I-9G5NB-175VHC-1/c.aspx
Submission: On July 27 via manual from BE — Scanned from DE

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 2 HTTP transactions. The main IP is 104.16.208.86, located in and belongs to CLOUDFLARENET, US. The main domain is swiftinstitutemail.org.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on June 11th 2022. Valid for: a year.
This is the only time swiftinstitutemail.org was scanned on urlscan.io!

urlscan.io Verdict: No classification

Downloads These files were downloaded by the website

MIME: PDF document, version 1.7
Size: 78 KB (80370 bytes, 100% done)
Downloaded from: https://swiftinstitute.org/wp-content/uploads/2022/07/SWIFT-Institute-July-Review-final.pdf?dm_i=47RJ,1DF0I,9G5NB,6CIOZ,1

Domain & IP information

IP Address AS Autonomous System
1 104.16.208.86 13335 (CLOUDFLAR...)
1 80.87.10.47 6859 (KCP-AS)
2 2
Domain Requested by
1 swiftinstitute.org
1 swiftinstitutemail.org
2 2

This site contains links to these domains. Also see Links.

Domain
swiftinstitute.org
Subject Issuer Validity Valid
swiftinstitutemail.org
Cloudflare Inc ECC CA-3
2022-06-11 -
2023-06-11
a year crt.sh
swiftinstitute.org
R3
2022-06-18 -
2022-09-16
3 months crt.sh

This page contains 1 frames:

Frame: https://swiftinstitute.org/wp-content/uploads/2022/07/SWIFT-Institute-July-Review-final.pdf?dm_i=47RJ,1DF0I,9G5NB,6CIOZ,1
Frame ID: E9E8BCE47871639F544F9E547B8F9220
Requests: 2 HTTP requests in this frame

Screenshot


Detected technologies

Overall confidence: 100%
Detected patterns
  • /wp-(?:content|includes)/

Overall confidence: 100%
Detected patterns
  • \.aspx?(?:$|\?)

Page Statistics

2
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

1 kB
Transfer

0 kB
Size

2
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

2 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request c.aspx
swiftinstitutemail.org/47RJ-1DF0I-9G5NB-175VHC-1/
399 B
802 B
Document
General
Full URL
https://swiftinstitutemail.org/47RJ-1DF0I-9G5NB-175VHC-1/c.aspx
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.16.208.86 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
696b32a9483aebbffba52612bc62be27e5ddb70cdcc886e1983a63f48653202f

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control
private, max-age=0
cf-cache-status
DYNAMIC
cf-ray
7316f5d13cf991d8-FRA
content-encoding
gzip
content-type
text/html
date
Wed, 27 Jul 2022 17:05:29 GMT
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server
cloudflare
SWIFT-Institute-July-Review-final.pdf
swiftinstitute.org/wp-content/uploads/2022/07/
0
0
Document
General
Full URL
https://swiftinstitute.org/wp-content/uploads/2022/07/SWIFT-Institute-July-Review-final.pdf?dm_i=47RJ,1DF0I,9G5NB,6CIOZ,1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
80.87.10.47 , United Kingdom, ASN6859 (KCP-AS, GB),
Reverse DNS
s032-web01.vmg.ontinuity.co.uk
Software
/
Resource Hash
Security Headers
Name Value
Content-Security-Policy default-src 'self'; script-src 'report-sample' 'self' 'unsafe-inline' 'unsafe-eval' https://www.google-analytics.com/ https://www.google.com/recaptcha/ https://www.gstatic.com/recaptcha/ cdnjs.cloudflare.com; style-src 'report-sample' 'self' 'unsafe-inline'; object-src 'none'; base-uri 'self'; connect-src 'self' https://metrics.articulate.com https://www.google-analytics.com; font-src 'self' data: ; frame-src 'self' https://www.google.com youtube.com www.youtube.com soundcloud.com w.soundcloud.com; img-src 'self' 'unsafe-inline' data: https://secure.adnxs.com; manifest-src 'self'; media-src 'self'; worker-src 'none';
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://swiftinstitutemail.org/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

accept-ranges
bytes
content-length
80370
content-security-policy
default-src 'self'; script-src 'report-sample' 'self' 'unsafe-inline' 'unsafe-eval' https://www.google-analytics.com/ https://www.google.com/recaptcha/ https://www.gstatic.com/recaptcha/ cdnjs.cloudflare.com; style-src 'report-sample' 'self' 'unsafe-inline'; object-src 'none'; base-uri 'self'; connect-src 'self' https://metrics.articulate.com https://www.google-analytics.com; font-src 'self' data: ; frame-src 'self' https://www.google.com youtube.com www.youtube.com soundcloud.com w.soundcloud.com; img-src 'self' 'unsafe-inline' data: https://secure.adnxs.com; manifest-src 'self'; media-src 'self'; worker-src 'none';
content-type
application/pdf
date
Wed, 27 Jul 2022 17:05:30 GMT
etag
"62dff196-139f2"
last-modified
Tue, 26 Jul 2022 13:52:22 GMT
strict-transport-security
max-age=63072000; includeSubDomains; preload
x-content-type-options
nosniff
x-frame-options
SAMEORIGIN

Verdicts & Comments Add Verdict or Comment

8 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation

2 Cookies

Domain/Path Name / Value
.swiftinstitutemail.org/ Name: __cf_bm
Value: aaUttZZH9dWTH3nvjt6FchuVU9wrkRRXfDf1taQML8U-1658941529-0-AZ0g6eIixSEgWtb2KOH2J8JS5lxk4fWVXXnEYdeMRPmtdIxcAnF1M5RcLVaWYDCMw2ecFtNhpk7NzqfmMhS60ag=
swiftinstitutemail.org/ Name: __cflb
Value: 0H28vbka3Tp63XFuYsqHHrawjcNu2NcXtzjtuvyk72U

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

swiftinstitute.org
swiftinstitutemail.org
104.16.208.86
80.87.10.47
696b32a9483aebbffba52612bc62be27e5ddb70cdcc886e1983a63f48653202f