urlscan.io logo urlscan.io
SecurityTrails logo

rpsim-2.gcpass.prod.2keys.io Open in urlscan Pro
146.190.188.33  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: https://rpsim-2.gcpass.prod.2keys.io/rpsim/gcpass/saml/
Submission: On March 12 via api from US — Scanned from US
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 9 HTTP transactions. The main IP is 146.190.188.33, located in Toronto, Canada and belongs to DIGITALOCEAN-ASN, US. The main domain is rpsim-2.gcpass.prod.2keys.io.
TLS certificate: Issued by R3 on March 8th 2024. Valid for: 3 months.
This is the only time rpsim-2.gcpass.prod.2keys.io was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Canadian Government (Government)

Domain & IP information

IP Address AS Autonomous System
9 146.190.188.33 14061 (DIGITALOC...)
9 1
Apex Domain
Subdomains		 Transfer
9 2keys.io
rpsim-2.gcpass.prod.2keys.io
558 KB
9 1
Domain Requested by
9 rpsim-2.gcpass.prod.2keys.io rpsim-2.gcpass.prod.2keys.io
9 1

This site contains no links.

Subject Issuer Validity Valid
rpsim-2.gcpass.prod.2keys.io
R3		 2024-03-08 -
2024-06-06		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://rpsim-2.gcpass.prod.2keys.io/rpsim/gcpass/saml/
Frame ID: 028395B1FEBF9A8C7B7461207F3FBC45
Requests: 9 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

RP Simulator

Detected technologies

Overall confidence: 100%
Detected patterns
  • bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
Overall confidence: 100%
Detected patterns
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

9
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

558 kB
Transfer

557 kB
Size

1
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

9 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
rpsim-2.gcpass.prod.2keys.io/rpsim/gcpass/saml/ 		11 KB
11 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://rpsim-2.gcpass.prod.2keys.io/rpsim/gcpass/saml/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
146.190.188.33 Toronto, Canada, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
vm-002.paz.prd
Software
/
Resource Hash
f39336fd5247b4bdd03117bee84a3be3ec91e1998c675110d6d3bb9771b8de4a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36
accept-language
en-US,en;q=0.9

Response headers

cache-control
no-cache, no-store, max-age=0, must-revalidate
content-language
en-US
content-type
text/html;charset=UTF-8
date
Tue, 12 Mar 2024 15:54:41 GMT
expires
0
pragma
no-cache
x-content-type-options
nosniff
x-xss-protection
1; mode=block
rpsim.css
rpsim-2.gcpass.prod.2keys.io/rpsim/resources/ 		559 B
680 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://rpsim-2.gcpass.prod.2keys.io/rpsim/resources/rpsim.css
Requested by
Host: rpsim-2.gcpass.prod.2keys.io
URL: https://rpsim-2.gcpass.prod.2keys.io/rpsim/gcpass/saml/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
146.190.188.33 Toronto, Canada, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
vm-002.paz.prd
Software
/
Resource Hash
7bc907df61aa6007df60fc7d2d6a4f0b7a0259ad6a7b9eaa58c1e8c2104383a4
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

accept-language
en-US,en;q=0.9
Referer
https://rpsim-2.gcpass.prod.2keys.io/rpsim/gcpass/saml/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 12 Mar 2024 15:54:41 GMT
x-content-type-options
nosniff
last-modified
Tue, 01 Jan 1980 00:00:01 GMT
vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
content-type
text/css
cache-control
no-cache, no-store, max-age=0, must-revalidate
accept-ranges
bytes
content-length
559
x-xss-protection
1; mode=block
expires
0
wet-boew.min.css
rpsim-2.gcpass.prod.2keys.io/rpsim/resources/gc/css/ 		223 KB
223 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://rpsim-2.gcpass.prod.2keys.io/rpsim/resources/gc/css/wet-boew.min.css
Requested by
Host: rpsim-2.gcpass.prod.2keys.io
URL: https://rpsim-2.gcpass.prod.2keys.io/rpsim/gcpass/saml/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
146.190.188.33 Toronto, Canada, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
vm-002.paz.prd
Software
/
Resource Hash
8f43e674a618fad137e970588bfa97710363bd0bc2e083aacabe1ba1c0f845af
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

accept-language
en-US,en;q=0.9
Referer
https://rpsim-2.gcpass.prod.2keys.io/rpsim/gcpass/saml/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 12 Mar 2024 15:54:41 GMT
x-content-type-options
nosniff
last-modified
Tue, 01 Jan 1980 00:00:01 GMT
vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
content-type
text/css
cache-control
no-cache, no-store, max-age=0, must-revalidate
accept-ranges
bytes
content-length
228152
x-xss-protection
1; mode=block
expires
0
theme.min.css
rpsim-2.gcpass.prod.2keys.io/rpsim/resources/gc/css/ 		119 KB
119 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://rpsim-2.gcpass.prod.2keys.io/rpsim/resources/gc/css/theme.min.css
Requested by
Host: rpsim-2.gcpass.prod.2keys.io
URL: https://rpsim-2.gcpass.prod.2keys.io/rpsim/gcpass/saml/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
146.190.188.33 Toronto, Canada, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
vm-002.paz.prd
Software
/
Resource Hash
f97f77e864d1147be13cbe06e9a2d70693dd2f8d2e56387b080913f588c68900
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

accept-language
en-US,en;q=0.9
Referer
https://rpsim-2.gcpass.prod.2keys.io/rpsim/gcpass/saml/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 12 Mar 2024 15:54:41 GMT
x-content-type-options
nosniff
last-modified
Tue, 01 Jan 1980 00:00:01 GMT
vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
content-type
text/css
cache-control
no-cache, no-store, max-age=0, must-revalidate
accept-ranges
bytes
content-length
121859
x-xss-protection
1; mode=block
expires
0
gckey.css
rpsim-2.gcpass.prod.2keys.io/rpsim/resources/gc/css/ 		4 KB
4 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://rpsim-2.gcpass.prod.2keys.io/rpsim/resources/gc/css/gckey.css
Requested by
Host: rpsim-2.gcpass.prod.2keys.io
URL: https://rpsim-2.gcpass.prod.2keys.io/rpsim/gcpass/saml/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
146.190.188.33 Toronto, Canada, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
vm-002.paz.prd
Software
/
Resource Hash
463e8824b1552f8a0433d5c36ce996831d75924a7681749615feeaf88c2f8b6b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

accept-language
en-US,en;q=0.9
Referer
https://rpsim-2.gcpass.prod.2keys.io/rpsim/gcpass/saml/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 12 Mar 2024 15:54:41 GMT
x-content-type-options
nosniff
last-modified
Tue, 01 Jan 1980 00:00:01 GMT
vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
content-type
text/css
cache-control
no-cache, no-store, max-age=0, must-revalidate
accept-ranges
bytes
content-length
4148
x-xss-protection
1; mode=block
expires
0
sig-blk-en.svg
rpsim-2.gcpass.prod.2keys.io/rpsim/resources/gc/img/ 		10 KB
11 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://rpsim-2.gcpass.prod.2keys.io/rpsim/resources/gc/img/sig-blk-en.svg
Requested by
Host: rpsim-2.gcpass.prod.2keys.io
URL: https://rpsim-2.gcpass.prod.2keys.io/rpsim/gcpass/saml/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
146.190.188.33 Toronto, Canada, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
vm-002.paz.prd
Software
/
Resource Hash
b493143147246fc0d7a9f377c2526560329e923b8be0bb4c9ac3e408adcfb06f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

accept-language
en-US,en;q=0.9
Referer
https://rpsim-2.gcpass.prod.2keys.io/rpsim/gcpass/saml/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 12 Mar 2024 15:54:41 GMT
x-content-type-options
nosniff
last-modified
Tue, 01 Jan 1980 00:00:01 GMT
vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
content-type
image/svg+xml
cache-control
no-cache, no-store, max-age=0, must-revalidate
accept-ranges
bytes
content-length
10710
x-xss-protection
1; mode=block
expires
0
jquery.min.js
rpsim-2.gcpass.prod.2keys.io/rpsim/resources/gc/js/ 		151 KB
151 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://rpsim-2.gcpass.prod.2keys.io/rpsim/resources/gc/js/jquery.min.js
Requested by
Host: rpsim-2.gcpass.prod.2keys.io
URL: https://rpsim-2.gcpass.prod.2keys.io/rpsim/gcpass/saml/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
146.190.188.33 Toronto, Canada, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
vm-002.paz.prd
Software
/
Resource Hash
44f9f49517b584439ea553b17c1f16cfa33b7ce290883d20f9b6cdaa1bcb5fb8
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

accept-language
en-US,en;q=0.9
Referer
https://rpsim-2.gcpass.prod.2keys.io/rpsim/gcpass/saml/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 12 Mar 2024 15:54:41 GMT
x-content-type-options
nosniff
last-modified
Tue, 01 Jan 1980 00:00:01 GMT
vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
content-type
application/javascript
cache-control
no-cache, no-store, max-age=0, must-revalidate
accept-ranges
bytes
content-length
154564
x-xss-protection
1; mode=block
expires
0
bootstrap.min.js
rpsim-2.gcpass.prod.2keys.io/rpsim/resources/gc/js/ 		35 KB
35 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://rpsim-2.gcpass.prod.2keys.io/rpsim/resources/gc/js/bootstrap.min.js
Requested by
Host: rpsim-2.gcpass.prod.2keys.io
URL: https://rpsim-2.gcpass.prod.2keys.io/rpsim/gcpass/saml/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
146.190.188.33 Toronto, Canada, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
vm-002.paz.prd
Software
/
Resource Hash
d5fd173d00d9733900834e0e1083de86b532e048b15c0420ba5c2db0623644b8
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

accept-language
en-US,en;q=0.9
Referer
https://rpsim-2.gcpass.prod.2keys.io/rpsim/gcpass/saml/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 12 Mar 2024 15:54:41 GMT
x-content-type-options
nosniff
last-modified
Tue, 01 Jan 1980 00:00:01 GMT
vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
content-type
application/javascript
cache-control
no-cache, no-store, max-age=0, must-revalidate
accept-ranges
bytes
content-length
35951
x-xss-protection
1; mode=block
expires
0
saml-form-intercept.js
rpsim-2.gcpass.prod.2keys.io/rpsim/resources/js/ 		3 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://rpsim-2.gcpass.prod.2keys.io/rpsim/resources/js/saml-form-intercept.js
Requested by
Host: rpsim-2.gcpass.prod.2keys.io
URL: https://rpsim-2.gcpass.prod.2keys.io/rpsim/gcpass/saml/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
146.190.188.33 Toronto, Canada, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
vm-002.paz.prd
Software
/
Resource Hash
e816ca7fc25cc8aab65b5e29af9efb0b241b3f497a4e40e8452b5768db549ee3
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

accept-language
en-US,en;q=0.9
Referer
https://rpsim-2.gcpass.prod.2keys.io/rpsim/gcpass/saml/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 12 Mar 2024 15:54:41 GMT
x-content-type-options
nosniff
last-modified
Tue, 01 Jan 1980 00:00:01 GMT
vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
content-type
application/javascript
cache-control
no-cache, no-store, max-age=0, must-revalidate
accept-ranges
bytes
content-length
3255
x-xss-protection
1; mode=block
expires
0

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Canadian Government (Government)

3 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| $ function| jQuery string| contextPath

1 Cookies

Domain/Path Name / Value
rpsim-2.gcpass.prod.2keys.io/rpsim Name: JSESSIONID
Value: 9E9A433E8708FD66BCC32D95A2F3E664

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block