en
Frequently Asked Questions (FAQ)
learn more about unesco's role, vision and results. unesco is the united nations educational, scientific and cultural organization. our aim is to promote peace and security through international cooperation
IndustryOriginGlobal rankRank in United States
Updated at The higher the score, the more externally observable protections the system has recorded. This page does not certify that the website is reputable, legitimate, or completely free of vulnerabilities.
As of August 26, 2026 at 12:04, www.buenosaires.iipe.unesco.org has a security score of 59/100 (grade U – “Unrated”), but this result is provisional because some required evidence is incomplete. CyStack’s automated assessment recorded 4 issues to review after completing 59.5% of applicable checks. The website owner should address “HTTPS/TLS endpoint reachability” first, then review the remaining items in order of impact.
At assessment time, CyStack did not find www.buenosaires.iipe.unesco.org or related infrastructure on any scam, phishing, or malware warning list after checking 5 online reputation sources. This result reflects external observations; it does not guarantee absolute safety or verify the organization’s legal status or reputation.
Compare the security level of each assessed category at a glance.
Frequently asked questions
A valid SSL certificate still does not prove that www.buenosaires.iipe.unesco.org is safe, legitimate, or free of scam signals. For a more complete assessment, this report also checks phishing and malware, exposed email records, IPs and open ports, subdomains, technologies, and CVEs that may apply to observed versions.
HTTPS on www.buenosaires.iipe.unesco.org could not be reached during this assessment, so its SSL certificate and transport encryption could not be evaluated.
Review HTTPS and certificateData sources
CyStack compiles scan results from its internal cybersecurity monitoring systems, including CyStack VulnScan and CyStack Threat Intelligence, together with publicly available Internet data. The assessment only observes and analyzes information already available; it does not attempt unauthorized access, test passwords, send exploit code, or change or disrupt the assessed system.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the enterprise.
These 3 failed checks or warnings have the greatest impact on the result for www.buenosaires.iipe.unesco.org.
Why it matters
This check only confirms whether a TLS handshake can be established with at least one tested resolved endpoint on the HTTPS port. Certificate trust, hostname identity, validity, chain, protocol, and cryptographic strength are evaluated separately.
What to do
Provide the entire website over HTTPS using a certificate trusted by common browsers.
Diagnostic information
The scanner could not complete a TLS handshake with the HTTPS endpoint during this assessment.
Evidence and check scope
This is the port on which the scanner attempted a TLS connection. The port number alone does not prove that the port is open or that HTTPS works.
Why it matters
Names containing admin, development, staging, VPN, database, or monitoring terms may point attackers toward valuable systems. A name alone does not prove exposure, but it identifies a surface that should be reviewed.
What to do
Remove obsolete DNS names and protect non-public systems with strong authentication, MFA, network allowlists, or a VPN.
Why it matters
Infostealer intelligence may contain credentials associated with the domain, but it does not prove that an account is current, valid, or still exposed.
What to do
Review the masked evidence and observation time, validate affected accounts and devices, then reset active credentials and sessions, enforce MFA, and remove malware where confirmed.
This list contains only failed checks and warnings. Checks without enough evidence are grouped separately below.
Check result
A TLS connection could not be established on the tested HTTPS endpoint (port 443).
Why it matters
This check only confirms whether a TLS handshake can be established with at least one tested resolved endpoint on the HTTPS port. Certificate trust, hostname identity, validity, chain, protocol, and cryptographic strength are evaluated separately.
What to do
Provide the entire website over HTTPS using a certificate trusted by common browsers.
Diagnostic information
The scanner could not complete a TLS handshake with the HTTPS endpoint during this assessment.
Evidence and check scope
This is the port on which the scanner attempted a TLS connection. The port number alone does not prove that the port is open or that HTTPS works.
Check result
CyStack confirmed at least 567 active DNS subdomains of unesco.org. 93 names may expose sensitive services; discovery was partial, so more may exist.
Why it matters
Names containing admin, development, staging, VPN, database, or monitoring terms may point attackers toward valuable systems. A name alone does not prove exposure, but it identifies a surface that should be reviewed.
Check result
72 email exposure records ending in @unesco.org are associated with approximately 30 infected devices. These are intelligence observations; they do not prove that the email accounts are still active or that the devices belong to the organization.
Why it matters
Infostealer intelligence may contain credentials associated with the domain, but it does not prove that an account is current, valid, or still exposed.
Check result
No DNSSEC DS delegation was found.
Why it matters
DNSSEC adds digital signatures so resolvers can detect forged DNS answers. This quick check looks for a DS record at the parent domain; a passing result confirms that delegation signal, but it does not validate the complete signature chain.
What to do
Check result
The assessment could not determine whether password forms on the inspected homepage use HTTPS for both the page and submission URL.
Why it matters
If either a password page or the address receiving its form uses HTTP, someone observing the network may read or change the submitted password.
Diagnostic information
The scanner did not obtain a reliable enough website response to conclude this check.
Scope of this check
This check only evaluates the homepage response and content that the scanner could reach. Other pages and sign-in flows may use different settings.
Check result
The assessment could not determine whether every session-like cookie observed on the homepage response uses HttpOnly.
Why it matters
HttpOnly prevents browser scripts from directly reading a cookie. It does not fix script injection, but it makes theft of session and authentication cookies more difficult.
Diagnostic information
The scanner did not obtain a reliable enough website response to conclude this check.
Scope of this check
This check only evaluates the homepage response and content that the scanner could reach. Other pages and sign-in flows may use different settings.
Check result
The assessment could not determine whether every session-like cookie observed on the homepage response uses Secure.
Why it matters
The Secure attribute prevents a browser from sending a cookie over unencrypted HTTP. This bounded check scores cookies whose names look session- or authentication-related; other cookies are reported as context but do not by themselves prove that sensitive data is exposed.
Diagnostic information
The scanner did not obtain a reliable enough website response to conclude this check.
Scope of this check
This check only evaluates the homepage response and content that the scanner could reach. Other pages and sign-in flows may use different settings.
Check result
The assessment could not determine whether the homepage CORS probe does not reflect the arbitrary test origin with credentials or another broadly permissive combination.
Why it matters
Cross-Origin Resource Sharing (CORS) decides which websites may read responses from this service in a visitor's browser. Rules that trust arbitrary origins, especially with login cookies, can expose private data to another website.
Diagnostic information
The scanner did not obtain a reliable enough website response to conclude this check.
Scope of this check
This check only evaluates the homepage response and content that the scanner could reach. Other pages and sign-in flows may use different settings.
Check result
The assessment could not determine whether the inspected homepage HTML response has a CSP without a broad or unsafe directive recognized by this bounded check.
Why it matters
Content Security Policy (CSP) limits where scripts, styles, frames, and other browser content may come from. A strong policy reduces the impact if an attacker manages to inject content into a page.
Diagnostic information
The scanner did not obtain a reliable enough website response to conclude this check.
Scope of this check
This check only evaluates the homepage response and content that the scanner could reach. Other pages and sign-in flows may use different settings.
References
Check result
The assessment could not determine whether observed homepage cookies use an explicit SameSite setting and do not combine SameSite=None with missing Secure.
Why it matters
SameSite limits when a browser includes cookies in requests started by another website. This helps prevent another site from silently making an authenticated request on a user's behalf.
Diagnostic information
The scanner did not obtain a reliable enough website response to conclude this check.
Scope of this check
This check only evaluates the homepage response and content that the scanner could reach. Other pages and sign-in flows may use different settings.
Check result
The assessment could not determine whether the inspected homepage restricts framing with CSP frame-ancestors or X-Frame-Options.
Why it matters
Another website can place this page inside a hidden or misleading frame and trick a user into clicking an unintended action. Frame restrictions tell browsers which sites, if any, may embed the page.
Diagnostic information
The scanner did not obtain a reliable enough website response to conclude this check.
Scope of this check
This check only evaluates the homepage response and content that the scanner could reach. Other pages and sign-in flows may use different settings.
References
Check result
The assessment could not determine whether the inspected HTTPS homepage contains no active resource or form destination over HTTP.
Why it matters
An HTTPS page can still load scripts, frames, styles, or forms over unencrypted HTTP. An attacker on the network may alter that content and compromise the otherwise secure page.
Diagnostic information
The scanner did not obtain a reliable enough website response to conclude this check.
Scope of this check
This check only evaluates the homepage response and content that the scanner could reach. Other pages and sign-in flows may use different settings.
Check result
The assessment could not determine whether the inspected homepage response sets X-Content-Type-Options to nosniff.
Why it matters
Without the nosniff setting, a browser may guess a file's type and treat harmless-looking content as executable code. This can turn an incorrect Content-Type into a security issue.
Diagnostic information
The scanner did not obtain a reliable enough website response to conclude this check.
Scope of this check
This check only evaluates the homepage response and content that the scanner could reach. Other pages and sign-in flows may use different settings.
References
Check result
The assessment could not determine whether the inspected homepage HTTPS response contains an effective HSTS policy.
Why it matters
HTTP Strict Transport Security (HSTS) tells a browser to use HTTPS automatically on future visits. This reduces the chance that a visitor is downgraded to an unencrypted connection.
Diagnostic information
The scanner did not obtain a reliable enough website response to conclude this check.
Scope of this check
This check only evaluates the homepage response and content that the scanner could reach. Other pages and sign-in flows may use different settings.
Check result
The assessment could not determine whether the homepage redirects directly from HTTP to HTTPS on the first hop and no later redirect downgrades to HTTP.
Why it matters
Visitors may enter an address beginning with HTTP or follow an old link. Redirecting them immediately to HTTPS prevents the rest of the visit from continuing over an unencrypted connection.
Diagnostic information
The scanner did not obtain a reliable enough website response to conclude this check.
Scope of this check
This check only evaluates the homepage response and content that the scanner could reach. Other pages and sign-in flows may use different settings.
Check result
The assessment could not determine whether the inspected homepage does not match a common automatic directory-listing pattern.
Why it matters
When a web server automatically lists a directory, visitors may discover files that were never linked publicly, including backups, logs, or deployment artifacts.
Diagnostic information
The scanner did not obtain a reliable enough website response to conclude this check.
Scope of this check
This check only evaluates the homepage response and content that the scanner could reach. Other pages and sign-in flows may use different settings.
Check result
The assessment could not determine whether the inspected homepage sets Permissions-Policy without a broad grant recognized by this bounded check.
Why it matters
Permissions-Policy can further restrict browser features such as the camera, microphone, and location for this page and embedded content. Each feature already has a browser-defined default allowlist, so an absent header does not mean that every feature is unrestricted.
Diagnostic information
The scanner did not obtain a reliable enough website response to conclude this check.
Scope of this check
This check only evaluates the homepage response and content that the scanner could reach. Other pages and sign-in flows may use different settings.
References
Check result
The assessment could not determine whether the inspected homepage explicitly sets a privacy-preserving Referrer-Policy.
Why it matters
When a visitor follows a link, the browser may send information about the previous URL to the destination. Modern browsers default to strict-origin-when-cross-origin when no header is sent, so an absent header is a hardening gap rather than proof that a full sensitive URL was exposed.
Diagnostic information
The scanner did not obtain a reliable enough website response to conclude this check.
Scope of this check
This check only evaluates the homepage response and content that the scanner could reach. Other pages and sign-in flows may use different settings.
References
Check result
The assessment could not determine whether the inspected homepage HSTS policy lasts at least 180 days.
Why it matters
The max-age value controls how long browsers remember to use HTTPS. A very short period provides limited protection, while includeSubDomains also covers every subdomain and can break one that does not support HTTPS.
Diagnostic information
The scanner did not obtain a reliable enough website response to conclude this check.
Scope of this check
This check only evaluates the homepage response and content that the scanner could reach. Other pages and sign-in flows may use different settings.
Check result
The assessment could not determine whether the inspected homepage response exposes no explicit software-version token recognized by this check.
Why it matters
Exact web server or framework versions help attackers quickly look for known weaknesses that may apply. Hiding a version is not a substitute for patching, but unnecessary disclosure gives away useful targeting information.
Diagnostic information
The scanner did not obtain a reliable enough website response to conclude this check.
Scope of this check
This check only evaluates the homepage response and content that the scanner could reach. Other pages and sign-in flows may use different settings.
Check result
Technology fingerprints could not be evaluated from the root response.
Why it matters
Response headers, page content, and other public clues suggest which technologies the service uses. These observations help explain the attack surface, but they can be incomplete or mistaken and do not by themselves confirm a vulnerability.
Diagnostic information
Product identification did not complete for all observed services.
Check result
Passive WAF and edge signals were unavailable because no root response was obtained.
Why it matters
This check looks for bounded passive signals of a Web Application Firewall (WAF), CDN, or other edge service. A match suggests presence but does not test enforcement, and no match does not prove absence.
Diagnostic information
The scanner did not obtain a reliable enough website response to conclude this check.
Check result
5 providers were definitive and 1 were inconclusive.
Why it matters
This shows how many independent blacklist services returned a clear result. A service that was unavailable was not checked successfully and must not be treated as a clean result.
Evidence and check scope
Check result
Observed 0 versioned product(s); 0 had exact CPE mappings and 0 completed lookup(s).
Why it matters
This shows how many detected products had reliable version information and an exact CPE identity, allowing them to be checked against CVE applicability data. A product that could not be checked must not be treated as free of known vulnerabilities.
Evidence and check scope
Check result
The target resolved to 1 public IP address(es).
Why it matters
Public DNS connects the domain to its Internet addresses. Missing or incorrect records can make the service unreachable or send traffic to the wrong system.
Evidence and check scope
Check result
This certificate check was not run because no TLS connection was established.
Why it matters
The certificate must list the exact hostname visitors requested in its Subject Alternative Names (SAN). A mismatch produces browser warnings because the certificate may belong to a different service.
Evidence and check scope
Check result
This certificate check was not run because no TLS connection was established.
Why it matters
Browsers trust a website only when its certificate can be traced to a recognized certificate provider. An untrusted certificate causes warnings and prevents visitors from reliably confirming the website's identity.
Evidence and check scope
Check result
No exact product version was observed, so there was no reliable CVE candidate to compare with the CISA Known Exploited Vulnerabilities catalog. This check is not applicable.
Why it matters
This check asks whether an applicable CVE candidate also appears in the CISA Known Exploited Vulnerabilities (KEV) catalog. A positive match means attackers have used that vulnerability in real incidents and warrants urgent investigation, but the installed software still needs to be confirmed as affected.
Evidence and check scope
Check result
No public management service was found on the scanned TCP port set.
Why it matters
Remote administration services such as RDP, VNC, Docker, Kubernetes, and management consoles are high-value targets. Public exposure allows anyone on the Internet to attempt passwords or exploit an unpatched service.
Evidence and check scope
Check result
No public datastore service was found on the scanned TCP port set.
Why it matters
Databases and caches often contain sensitive information and are normally used only by internal applications. Direct Internet access makes password attacks and configuration mistakes much more likely to become a data breach.
Evidence and check scope
Check result
No public file-sharing service was found on the scanned TCP port set.
Why it matters
Services such as SMB, NFS, and rsync can reveal or modify shared files and have a history of serious vulnerabilities. They rarely need to accept connections directly from the public Internet.
Evidence and check scope
Check result
No public legacy cleartext service was found on the scanned TCP port set.
Why it matters
Older services such as Telnet, FTP, and unencrypted mail or directory protocols can send passwords and data in readable form. Anyone able to observe the network path may capture them.
Evidence and check scope
Check result
No independent abuse-list consensus was found across 5 definitive providers.
Why it matters
Security and email providers maintain DNS-based blacklists of IP addresses associated with spam, malware, or compromised systems. Several current, independent listings are a strong reason to investigate, although a shared IP can sometimes affect unrelated customers.
Evidence and check scope
Check result
The effective DMARC policy is reject and is declared for 100% of messages.
Why it matters
A policy of quarantine or reject tells receiving services to move suspicious mail to spam or refuse it. A monitoring-only policy (p=none) records the problem but does not ask receivers to stop spoofed mail.
Evidence and check scope
References
Check result
A DMARC record was found for the registrable email domain.
Why it matters
DMARC lets the domain owner tell receiving services what to do when the visible From address is not verified by SPF or DKIM. Without DMARC, attackers have more opportunity to impersonate the domain in phishing email.
Evidence and check scope
References
Check result
The bounded core DMARC tags passed structural validation.
Why it matters
This bounded check validates the core structure and required tags of the DMARC record found by the domain-tree lookup. It does not verify delivery or authorization of every external reporting destination.
Evidence and check scope
References
Check result
The registration expires in 3110 day(s).
Why it matters
An expired domain stops directing users to the organization's services and may eventually become available to someone else. A domain close to expiry leaves little time to recover from payment or account problems.
Evidence and check scope
Check result
RDAP returned 1 status value(s); 0 require attention.
Why it matters
Registrar or registry restrictions such as hold, redemption, or pending deletion can disable the domain. If they are not resolved, the organization may lose control of its website and email identity.
Evidence and check scope
Check result
This certificate check was not run because no TLS connection was established.
Why it matters
A certificate works only between its start and expiry dates. An expired, not-yet-valid, or soon-to-expire certificate can trigger browser warnings and interrupt access to the website or API.
Evidence and check scope
Check result
This certificate check was not run because no TLS connection was established.
Why it matters
The certificate's public key and signature algorithm protect it from forgery. Keys that are too short or signatures based on obsolete algorithms provide less protection against modern attacks.
Evidence and check scope
Check result
This certificate check was not run because no TLS connection was established.
Why it matters
TLS 1.0 and TLS 1.1 use outdated security designs and are no longer accepted by modern standards. Leaving them enabled allows older, weaker connection methods.
Evidence and check scope
References
Check result
The scan completed without observing an exact product version that could be matched reliably to CVE records. This check is not applicable; it does not mean the system is free of vulnerabilities.
Why it matters
This check compares an observed product only when a reliable version and exact CPE identity are available, using applicability records from the National Vulnerability Database (NVD). Any returned match is a lead, not confirmation: the installed software may include vendor fixes or differ from the version visible on the Internet.
Evidence and check scope
Check result
The terminal SPF policy is -all.
Why it matters
The final SPF rule tells receiving services how confidently they should reject unlisted senders. A permissive result allows more spoofed mail to appear legitimate than a hard fail (-all).
Evidence and check scope
References
Check result
An SPF record was found for the registrable email domain.
Why it matters
Sender Policy Framework (SPF) lists the systems allowed to send email for the domain. Without it, receiving services have less evidence to distinguish legitimate mail from spoofed mail.
Evidence and check scope
References
Check result
The SPF record passed structural validation.
Why it matters
This bounded check validates the published SPF record's basic structure, duplicate-record rule, and directly declared DNS-lookup terms. It does not recursively expand every include or redirect, so a pass is not a complete SPF evaluation.
Evidence and check scope
References
Check result
All 1 explicit MX target(s) resolved to public addresses.
Why it matters
MX records direct incoming email to the correct mail servers. Broken records can stop delivery, while a Null MX clearly tells senders that the domain does not receive email.
Evidence and check scope
Check result
This certificate check was not run because no TLS connection was established.
Why it matters
The server must provide the intermediate certificates that connect its website certificate to a trusted provider. If any are missing, some browsers, mobile devices, or API clients may reject the connection.
Evidence and check scope
Check result
No public unexpected service was found on the scanned TCP port set.
Why it matters
Every open service can be discovered and attacked and must be configured, monitored, and patched. Services without a clear public purpose add risk without providing business value.
Evidence and check scope
Check result
A syntactically valid aggregate-report mailto URI is published; external authorization and delivery were not verified.
Why it matters
This check looks for at least one syntactically usable mailto destination in rua; a passing result confirms that publication. It does not verify authorization for an external destination or prove that reports can actually be delivered and monitored.
Evidence and check scope
Check result
The domain publishes 1 explicit MX route(s), declaring that it receives email.
Why it matters
This check asks whether the domain clearly declares email-receiving intent through one or more explicit MX routes or a sole Null MX. MX target validity and reachability are evaluated separately by the mail-route health check.
Evidence and check scope
Check result
Found 1 valid CAA issue rule(s) and 1 issuewild rule(s); no malformed or unknown critical rule was observed.
Why it matters
Certificate Authority Authorization (CAA) records state which certificate providers may issue certificates for the domain. This reduces the chance of an unintended provider issuing one.
Evidence and check scope
Check result
Found 4 authoritative name server(s).
Why it matters
This check counts the authoritative name-server hostnames published for the domain. Fewer than two creates an obvious single-server dependency; two or more meets the count baseline but does not prove that the servers use independent networks or remain available during an outage.
Evidence and check scope
There are currently 72 exposed email records matching the unesco.org domain. These records may be old or already resolved. The website owner should verify them before resetting passwords or locking related accounts.
Review exposed email recordsNo technology could be identified with enough confidence on www.buenosaires.iipe.unesco.org to run version-based CVE matching.
Review technologies and CVEsThe assessment observed 1 public IPs and 4 open ports for www.buenosaires.iipe.unesco.org. An open port is not the same as a vulnerability, but the website owner should keep every public service updated and appropriately restrict access.
Review IPs and open portsThe assessment observed 567+ public subdomains of unesco.org. This list can reveal additional entry points such as APIs, administration systems, or test environments, but it does not mean that every subdomain is risky.
Review discovered subdomainsDiagnostic information
Subdomain discovery did not complete, so the current list may be incomplete.
Evidence and check scope
Evidence and check scope
8 additional evidence fields are not shown here.
What to do
Remove obsolete DNS names and protect non-public systems with strong authentication, MFA, network allowlists, or a VPN.
Diagnostic information
Subdomain discovery did not complete, so the current list may be incomplete.
Evidence and check scope
What to do
Review the masked evidence and observation time, validate affected accounts and devices, then reset active credentials and sessions, enforce MFA, and remove malware where confirmed.
Evidence and check scope
8 additional evidence fields are not shown here.
Sign the DNS zone, publish the matching DS record through the registrar, and monitor the signature chain after key changes.
References
14 additional evidence fields are not shown here.
References
14 additional evidence fields are not shown here.
14 additional evidence fields are not shown here.
References
References
References
Recently completed assessments, prioritizing websites with a similar sector, country or security grade for easier comparison.
United States
