urlscan.io logo urlscan.io
SecurityTrails logo

download.eftps.com Open in urlscan Pro
204.194.122.122  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://reply.transactionservices.citigroup.com/ccr/CCREmailTracking/ccr/CN-CCR-00000000010659-55709/CLICK/Clicked%20On%20Url?urlClicked=https%3...
Effective URL: https://download.eftps.com/Financial_Institution_Handbook.pdf
Submission: On December 11 via manual from IL — Scanned from IL
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 1 IPs in 1 countries across 2 domains to perform 2 HTTP transactions. The main IP is 204.194.122.122, located in United States and belongs to TELECHECK, US. The main domain is download.eftps.com.
TLS certificate: Issued by Entrust Certification Authority - L1K on August 6th 2024. Valid for: a year.
This is the only time download.eftps.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 1 192.193.56.103 3081 (CITI15)
2 204.194.122.122 10390 (TELECHECK)
2 1
Apex Domain
Subdomains		 Transfer
2 eftps.com
download.eftps.com
4 KB
1 citigroup.com
reply.transactionservices.citigroup.com
795 B
2 2
Domain Requested by
2 download.eftps.com
1 reply.transactionservices.citigroup.com 1 redirects
2 2

This site contains no links.

Subject Issuer Validity Valid
download.eftps.com
Entrust Certification Authority - L1K		 2024-08-06 -
2025-09-06		 a year crt.sh

This page contains 1 frames:

Primary Page: https://download.eftps.com/Financial_Institution_Handbook.pdf
Frame ID: CC27EDCE4F14372FB9DD640AFF38D0E1
Requests: 2 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page URL History Show full URLs

  1. https://reply.transactionservices.citigroup.com/ccr/CCREmailTracking/ccr/CN-CCR-00000000010659-55709/CLICK/Clicked%20On%20Ur... HTTP 302
    https://download.eftps.com/Financial_Institution_Handbook.pdf Page URL

Page Statistics

2
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

1
IPs

1
Countries

4 kB
Transfer

4 kB
Size

3
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://reply.transactionservices.citigroup.com/ccr/CCREmailTracking/ccr/CN-CCR-00000000010659-55709/CLICK/Clicked%20On%20Url?urlClicked=https%3A%2F%2Fdownload.eftps.com%2FFinancial_Institution_Handbook.pdf HTTP 302
    https://download.eftps.com/Financial_Institution_Handbook.pdf Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

2 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request Financial_Institution_Handbook.pdf
download.eftps.com/
Redirect Chain
  • https://reply.transactionservices.citigroup.com/ccr/CCREmailTracking/ccr/CN-CCR-00000000010659-55709/CLICK/Clicked%20On%20Url?urlClicked=https%3A%2F%2Fdownload.eftps.com%2FFinancial_Institution_Han...
  • https://download.eftps.com/Financial_Institution_Handbook.pdf
345 B
0 		Document
General
Check archive.org
Download Go to
Full URL
https://download.eftps.com/Financial_Institution_Handbook.pdf
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
204.194.122.122 , United States, ASN10390 (TELECHECK, US),
Reverse DNS
Software
/
Resource Hash
8e037e15c547aa9b468a1e7e5a0f047bcba50c5c36e94a0c64b2a1229ba39c5d
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'
Strict-Transport-Security max-age=31536000; includeSubdomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

Accept-Ranges
bytes
Cache-Control
no-cache, private
Connection
Keep-Alive
Content-Length
894717
Content-Security-Policy
frame-ancestors 'self'
Content-Type
application/pdf
Date
Wed, 11 Dec 2024 22:39:41 GMT
ETag
"da6fd-61bf822537c80"
Keep-Alive
timeout=5, max=100
Last-Modified
Fri, 28 Jun 2024 19:20:02 GMT
P3P
CP="CAO DSP CURa ADMa DEVa TAIa PSAa PSDa HISa OUR NOR LEG PHY ONL UNI FIN COM NAV INT CNT STA PRE"
Strict-Transport-Security
max-age=31536000; includeSubdomains; preload
X-Content-Type-Options
nosniff
X-Frame-Options
SAMEORIGIN

Redirect headers

Connection
close
Content-Length
0
Content-Security-Policy
default-src 'self' data: 'unsafe-inline' 'unsafe-eval' img-src: https://* default-src 'self';
Date
Wed, 11 Dec 2024 22:39:39 GMT
Location
https://download.eftps.com/Financial_Institution_Handbook.pdf
Permissions-Policy
geolocation=(),midi=(),sync-xhr=(),microphone=(),camera=(),magnetometer=(),gyroscope=(),fullscreen=(self),payment=()
Referrer-Header
same-origin
Server
Apache
Strict-Transport-Security
max-age=63072000; includeSubdomains; preload max-age=31536000; includeSubdomains
X-Content-Type-Options
nosniff
X-Frame-Options
DENY
X-Permitted-Cross-Domain-Policies
master-only
X-Xss-Protection
1; mode=block
favicon.ico
download.eftps.com/ 		4 KB
4 KB 		Other
General
Check archive.org
Download Go to
Full URL
https://download.eftps.com/favicon.ico
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
204.194.122.122 , United States, ASN10390 (TELECHECK, US),
Reverse DNS
Software
/
Resource Hash
a2276c429ae1904c38bb24c8b52ecd06d55b4d775900f39ca217a629c5f500f3
Security Headers
Name Value
Content-Security-Policy default-src 'self'; img-src 'self'; frame-ancestors 'self'; style-src 'self' 'unsafe-inline';
Strict-Transport-Security max-age=31536000; includeSubdomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://download.eftps.com/Financial_Institution_Handbook.pdf

Response headers

Strict-Transport-Security
max-age=31536000; includeSubdomains; preload
Content-Security-Policy
default-src 'self'; img-src 'self'; frame-ancestors 'self'; style-src 'self' 'unsafe-inline';
Cache-Control
no-cache, private
ETag
"e4d-6081b0071c1af"
Connection
Keep-Alive
X-Content-Type-Options
nosniff
Accept-Ranges
bytes
Content-Length
3661
P3P
CP="CAO DSP CURa ADMa DEVa TAIa PSAa PSDa HISa OUR NOR LEG PHY ONL UNI FIN COM NAV INT CNT STA PRE"
Date
Wed, 11 Dec 2024 22:39:42 GMT
Keep-Alive
timeout=5, max=100
Last-Modified
Fri, 20 Oct 2023 00:32:04 GMT
Content-Type
image/x-icon
X-Frame-Options
SAMEORIGIN

Verdicts & Comments Add Verdict or Comment

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0

3 Cookies

Domain/Path Name / Value
download.eftps.com/ Name: BIGipServerC0GD3e5cLLyVS+YAQeIq5w
Value: !jSh2Ji4ez3JdgiSI5JdqMKa3ht22HCq4C7+JmrbW0hqlTTtmPSf9SYpNrZ2PTIfU2GM2h9E4eGlCwjUKluntiMItz+F0T9Vz6awYfbq2oOE=
download.eftps.com/ Name: TS01e7d7fc
Value: 01c9d79c7430d55f5ea250f02da1cb5bb8ee52edbbb892ef7517c9f65e2d27b8cee853bedaaa82a4e188220ee6e465fdb16686df0ceae269396fec082f6cb9a25b79ae9cd8
download.eftps.com/ Name: TSc430b8af027
Value: 08e1237ff2ab2000e439353d727c6dafd67923eaff5fbb3f5409962d98d8801d154ccd853721e2d3082b38c1891130004d7db0a094364715df38c5a71a09d1ee62554d0c8027dc2f8d3406e199b65878a015c41c6f6421efdc1f780ca87d98fb

2 Console Messages

Source Level URL
Text
other error URL: chrome://newtab/
Message:
Clear-Site-Data header on 'https://reply.transactionservices.citigroup.com/ccr/CCREmailTracking/ccr/CN-CCR-00000000010659-55709/CLICK/Clicked%20On%20Url?urlClicked=https%3A%2F%2Fdownload.eftps.com%2FFinancial_Institution_Handbook.pdf': Unrecognized type: *.
other error URL: chrome://newtab/
Message:
Clear-Site-Data header on 'https://reply.transactionservices.citigroup.com/ccr/CCREmailTracking/ccr/CN-CCR-00000000010659-55709/CLICK/Clicked%20On%20Url?urlClicked=https%3A%2F%2Fdownload.eftps.com%2FFinancial_Institution_Handbook.pdf': No recognized types specified.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Content-Security-Policy frame-ancestors 'self'
Strict-Transport-Security max-age=31536000; includeSubdomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

download.eftps.com
reply.transactionservices.citigroup.com
192.193.56.103
204.194.122.122
8e037e15c547aa9b468a1e7e5a0f047bcba50c5c36e94a0c64b2a1229ba39c5d
a2276c429ae1904c38bb24c8b52ecd06d55b4d775900f39ca217a629c5f500f3