Just curious how you are so certain that the servers were CSIS servers?

Pretty sure you would never be able to trace back a CSIS or CSE ip.