urlscan.io logo urlscan.io
SecurityTrails logo

british-gas.zoa.io Open in urlscan Pro
172.67.10.8  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: http://british-gas.zoa.io/
Effective URL: https://british-gas.zoa.io/sign-in?redirect=%2F
Submission: On May 28 via api from GB — Scanned from UK
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 8 IPs in 1 countries across 6 domains to perform 28 HTTP transactions. The main IP is 172.67.10.8, located in United States and belongs to CLOUDFLARENET, US. The main domain is british-gas.zoa.io.
TLS certificate: Issued by WE1 on May 19th 2025. Valid for: 3 months.
This is the only time british-gas.zoa.io was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 18 172.67.10.8 13335 (CLOUDFLAR...)
1 13.32.121.106 16509 (AMAZON-02)
2 216.58.206.46 15169 (GOOGLE)
1 34.149.135.19 396982 (GOOGLE-CL...)
2 199.36.158.100 54113 (FASTLY)
2 216.58.206.74 15169 (GOOGLE)
2 52.32.98.99 16509 (AMAZON-02)
28 8
18    172.67.10.8 (United States)

ASN13335 (CLOUDFLARENET, US)
british-gas.zoa.io
1    13.32.121.106 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-32-121-106.fra60.r.cloudfront.net
sr-client-cfg.amplitude.com
2    216.58.206.46 (United States)

ASN15169 (GOOGLE, US)
PTR: mil07s07-in-f14.1e100.net
apis.google.com
1    34.149.135.19 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 19.135.149.34.bc.googleusercontent.com
browser-intake-datadoghq.eu
2    199.36.158.100 (United States)

ASN54113 (FASTLY, US)
zoa-prod-idp-employee-01.firebaseapp.com
2    216.58.206.74 (United States)

ASN15169 (GOOGLE, US)
PTR: tzfraa-aa-in-f10.1e100.net
www.googleapis.com
2    52.32.98.99 (Boardman, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-32-98-99.us-west-2.compute.amazonaws.com
api2.amplitude.com
Apex Domain
Subdomains		 Transfer
18 zoa.io
british-gas.zoa.io
939 KB
3 amplitude.com
sr-client-cfg.amplitude.com — Cisco Umbrella Rank: 8319
api2.amplitude.com — Cisco Umbrella Rank: 1235
658 B
2 googleapis.com
www.googleapis.com — Cisco Umbrella Rank: 62
396 B
2 firebaseapp.com
zoa-prod-idp-employee-01.firebaseapp.com
91 KB
2 google.com
apis.google.com — Cisco Umbrella Rank: 236
40 KB
1 browser-intake-datadoghq.eu
browser-intake-datadoghq.eu — Cisco Umbrella Rank: 10313
340 B
28 6
Domain Requested by
18 british-gas.zoa.io 1 redirects british-gas.zoa.io
2 api2.amplitude.com british-gas.zoa.io
2 www.googleapis.com zoa-prod-idp-employee-01.firebaseapp.com
2 zoa-prod-idp-employee-01.firebaseapp.com apis.google.com
zoa-prod-idp-employee-01.firebaseapp.com
2 apis.google.com british-gas.zoa.io
apis.google.com
1 browser-intake-datadoghq.eu british-gas.zoa.io
1 sr-client-cfg.amplitude.com british-gas.zoa.io
28 7

This site contains no links.

Subject Issuer Validity Valid
british-gas.zoa.io
WE1		 2025-05-19 -
2025-08-17		 3 months crt.sh
sr-client-cfg.amplitude.com
Amazon RSA 2048 M03		 2025-03-27 -
2026-04-25		 a year crt.sh
*.apis.google.com
WE2		 2025-05-12 -
2025-08-04		 3 months crt.sh
*.browser-intake-datadoghq.eu
DigiCert Global G2 TLS RSA SHA256 2020 CA1		 2025-05-25 -
2026-05-30		 a year crt.sh
firebaseapp.com
WR4		 2025-05-23 -
2025-08-21		 3 months crt.sh
upload.video.google.com
WE2		 2025-05-12 -
2025-08-04		 3 months crt.sh
*.amplitude.com
COMODO RSA Domain Validation Secure Server CA		 2025-02-07 -
2026-02-14		 a year crt.sh

This page contains 2 frames:

Primary Page: https://british-gas.zoa.io/sign-in?redirect=%2F
Frame ID: 22278BFC2A229EF52A388EA72A408AAD
Requests: 23 HTTP requests in this frame

Frame: https://zoa-prod-idp-employee-01.firebaseapp.com/__/auth/iframe?apiKey=AIzaSyBb7r4gLhHUw97qrrn3O9mGtmvEyTWMK_Y&appName=%5BDEFAULT%5D&v=11.7.1&eid=p&usegapi=1&jsh=m%3B%2F_%2Fscs%2Fabc-static%2F_%2Fjs%2Fk%3Dgapi.lb.en.nJpyt-fjzo8.O%2Fd%3D1%2Frs%3DAHpOoo9fTqXSCmwMDsu9FH68l5KSqr6MBg%2Fm%3D__features__
Frame ID: 1237D3FB356AF0B247A3F86B7E1D401F
Requests: 3 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page URL History Show full URLs

  1. http://british-gas.zoa.io/ HTTP 307
    https://british-gas.zoa.io/ HTTP 307
    https://british-gas.zoa.io/sign-in?redirect=%2F Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • apis\.google\.com/js/[a-z]*\.js

Page Statistics

28
Requests

96 %
HTTPS

0 %
IPv6

6
Domains

7
Subdomains

8
IPs

1
Countries

1070 kB
Transfer

4153 kB
Size

3
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://british-gas.zoa.io/ HTTP 307
    https://british-gas.zoa.io/ HTTP 307
    https://british-gas.zoa.io/sign-in?redirect=%2F Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

28 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request sign-in
british-gas.zoa.io/
Redirect Chain
  • http://british-gas.zoa.io/
  • https://british-gas.zoa.io/
  • https://british-gas.zoa.io/sign-in?redirect=%2F
27 KB
6 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://british-gas.zoa.io/sign-in?redirect=%2F
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.67.10.8 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
4de77a376ab6e6e16d06d9d4c0013423738e0d4b620d675462411c9a6fbf83c5
Security Headers
Name Value
Content-Security-Policy default-src 'self'; script-src 'self' https://apis.google.com; style-src 'self' 'unsafe-inline'; img-src 'self' blob: data:; font-src 'self'; object-src 'none'; base-uri 'self'; form-action 'self'; frame-ancestors 'none'; worker-src 'self' blob:; frame-src 'self' https://zoa.helpjuice.com https://looker.zoa.io https://*.firebaseapp.com; connect-src 'self' https://*.amplitude.com https://identitytoolkit.googleapis.com https://securetoken.googleapis.com https://*.sentry.io https://browser-intake-datadoghq.eu; upgrade-insecure-requests; report-uri https://o4505583766536192.ingest.us.sentry.io/api/4507861428535296/security/?sentry_key=55630378aef2f330f413e3c8decc2343; report-to csp_endpoint
Strict-Transport-Security max-age=7776000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Linux; Android 10; SM-A205U) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.114 Mobile Safari/537.36.

Response headers

cache-control
private, no-cache, no-store, max-age=0, must-revalidate
cf-cache-status
DYNAMIC
cf-ray
946bb14a3f0bd117-CDG
content-encoding
br
content-security-policy
default-src 'self'; script-src 'self' https://apis.google.com; style-src 'self' 'unsafe-inline'; img-src 'self' blob: data:; font-src 'self'; object-src 'none'; base-uri 'self'; form-action 'self'; frame-ancestors 'none'; worker-src 'self' blob:; frame-src 'self' https://zoa.helpjuice.com https://looker.zoa.io https://*.firebaseapp.com; connect-src 'self' https://*.amplitude.com https://identitytoolkit.googleapis.com https://securetoken.googleapis.com https://*.sentry.io https://browser-intake-datadoghq.eu; upgrade-insecure-requests; report-uri https://o4505583766536192.ingest.us.sentry.io/api/4507861428535296/security/?sentry_key=55630378aef2f330f413e3c8decc2343; report-to csp_endpoint
content-type
text/html; charset=utf-8
date
Wed, 28 May 2025 06:28:33 GMT
permissions-policy
camera=(), microphone=(), geolocation=()
referrer-policy
strict-origin-when-cross-origin
reporting-endpoints
csp_endpoint=https://o4505583766536192.ingest.us.sentry.io/api/4507861428535296/security/?sentry_key=55630378aef2f330f413e3c8decc2343
server
cloudflare
strict-transport-security
max-age=7776000; includeSubDomains; preload
vary
Accept-Encoding
via
1.1 google, 1.1 google
x-content-type-options
nosniff

Redirect headers

cf-cache-status
DYNAMIC
cf-ray
946bb1493cddd117-CDG
date
Wed, 28 May 2025 06:28:32 GMT
location
/sign-in?redirect=%2F
server
cloudflare
strict-transport-security
max-age=7776000; includeSubDomains; preload
via
1.1 google, 1.1 google
a34f9d1faa5f3315-s.p.woff2
british-gas.zoa.io/_next/static/media/ 		47 KB
48 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://british-gas.zoa.io/_next/static/media/a34f9d1faa5f3315-s.p.woff2
Requested by
Host: british-gas.zoa.io
URL: https://british-gas.zoa.io/sign-in?redirect=%2F
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.67.10.8 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
c88db2401bef7e1203e0933cc5525a0f81863bfd076756db12acea5596f089ec
Security Headers
Name Value
Strict-Transport-Security max-age=7776000; includeSubDomains; preload

Request headers

User-Agent
Mozilla/5.0 (Linux; Android 10; SM-A205U) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.114 Mobile Safari/537.36.
Origin
https://british-gas.zoa.io
Referer
https://british-gas.zoa.io/sign-in?redirect=%2F

Response headers

strict-transport-security
max-age=7776000; includeSubDomains; preload
cache-control
public, max-age=31536000, immutable
cf-cache-status
MISS
etag
W/"bdac-1971274b580"
via
1.1 google, 1.1 google
cf-ray
946bb14b79b8d117-CDG
accept-ranges
bytes
content-length
48556
date
Wed, 28 May 2025 06:28:33 GMT
content-type
font/woff2
last-modified
Tue, 27 May 2025 15:55:28 GMT
vary
Accept-Encoding
server
cloudflare
48340cfe5c3cfec7.css
british-gas.zoa.io/_next/static/css/ 		2 KB
754 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://british-gas.zoa.io/_next/static/css/48340cfe5c3cfec7.css
Requested by
Host: british-gas.zoa.io
URL: https://british-gas.zoa.io/sign-in?redirect=%2F
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.67.10.8 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
96a63313fefa9f8ae46cb3c64b2f49b140e0098cac396ab0333588342c1c0f63
Security Headers
Name Value
Strict-Transport-Security max-age=7776000; includeSubDomains; preload

Request headers

User-Agent
Mozilla/5.0 (Linux; Android 10; SM-A205U) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.114 Mobile Safari/537.36.
Referer
https://british-gas.zoa.io/sign-in?redirect=%2F

Response headers

strict-transport-security
max-age=7776000; includeSubDomains; preload
cache-control
public, max-age=31536000, immutable
content-encoding
gzip
cf-cache-status
MISS
etag
W/"869-1971274b580"
via
1.1 google, 1.1 google
cf-ray
946bb14b6974d117-CDG
date
Wed, 28 May 2025 06:28:33 GMT
content-type
text/css; charset=UTF-8
last-modified
Tue, 27 May 2025 15:55:28 GMT
vary
Accept-Encoding
server
cloudflare
webpack-f4136470e41d3da5.js
british-gas.zoa.io/_next/static/chunks/ 		2 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://british-gas.zoa.io/_next/static/chunks/webpack-f4136470e41d3da5.js
Requested by
Host: british-gas.zoa.io
URL: https://british-gas.zoa.io/sign-in?redirect=%2F
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.67.10.8 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
6dbfe0afa9bd6979d981e1804fb80c5c53d9d62493be6f2eb4e061c59c9e3d62
Security Headers
Name Value
Strict-Transport-Security max-age=7776000; includeSubDomains; preload

Request headers

User-Agent
Mozilla/5.0 (Linux; Android 10; SM-A205U) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.114 Mobile Safari/537.36.
Referer
https://british-gas.zoa.io/sign-in?redirect=%2F

Response headers

strict-transport-security
max-age=7776000; includeSubDomains; preload
cache-control
public, max-age=31536000, immutable
content-encoding
gzip
cf-cache-status
HIT
etag
W/"9fd-1971274b580"
age
20351
via
1.1 google, 1.1 google
cf-ray
946bb14b79bbd117-CDG
date
Wed, 28 May 2025 06:28:33 GMT
content-type
application/javascript; charset=UTF-8
last-modified
Tue, 27 May 2025 15:55:28 GMT
vary
Accept-Encoding
server
cloudflare
framework-f16529bf20979877.js
british-gas.zoa.io/_next/static/chunks/ 		137 KB
44 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://british-gas.zoa.io/_next/static/chunks/framework-f16529bf20979877.js
Requested by
Host: british-gas.zoa.io
URL: https://british-gas.zoa.io/sign-in?redirect=%2F
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.67.10.8 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
c18488e853055ee53b1d9eb9703deffc99b378626d5f107551910742b672f89f
Security Headers
Name Value
Strict-Transport-Security max-age=7776000; includeSubDomains; preload

Request headers

User-Agent
Mozilla/5.0 (Linux; Android 10; SM-A205U) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.114 Mobile Safari/537.36.
Referer
https://british-gas.zoa.io/sign-in?redirect=%2F

Response headers

strict-transport-security
max-age=7776000; includeSubDomains; preload
cache-control
public, max-age=31536000, immutable
content-encoding
gzip
cf-cache-status
HIT
etag
W/"22433-1971274b580"
age
20351
via
1.1 google, 1.1 google
cf-ray
946bb14b79bcd117-CDG
date
Wed, 28 May 2025 06:28:33 GMT
content-type
application/javascript; charset=UTF-8
last-modified
Tue, 27 May 2025 15:55:28 GMT
vary
Accept-Encoding
server
cloudflare
main-de1f30cecdca4435.js
british-gas.zoa.io/_next/static/chunks/ 		131 KB
39 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://british-gas.zoa.io/_next/static/chunks/main-de1f30cecdca4435.js
Requested by
Host: british-gas.zoa.io
URL: https://british-gas.zoa.io/sign-in?redirect=%2F
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.67.10.8 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
634e80c49c56385d23955a0040ef52e8e7d9c8bbf8a28c5cb4c30459b18dea84
Security Headers
Name Value
Strict-Transport-Security max-age=7776000; includeSubDomains; preload

Request headers

User-Agent
Mozilla/5.0 (Linux; Android 10; SM-A205U) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.114 Mobile Safari/537.36.
Referer
https://british-gas.zoa.io/sign-in?redirect=%2F

Response headers

strict-transport-security
max-age=7776000; includeSubDomains; preload
cache-control
public, max-age=31536000, immutable
content-encoding
gzip
cf-cache-status
HIT
etag
W/"20c87-1971274b580"
age
20350
via
1.1 google, 1.1 google
cf-ray
946bb14b79bfd117-CDG
date
Wed, 28 May 2025 06:28:33 GMT
content-type
application/javascript; charset=UTF-8
last-modified
Tue, 27 May 2025 15:55:28 GMT
vary
Accept-Encoding
server
cloudflare
_app-f088ab104989091d.js
british-gas.zoa.io/_next/static/chunks/pages/ 		3 MB
751 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://british-gas.zoa.io/_next/static/chunks/pages/_app-f088ab104989091d.js
Requested by
Host: british-gas.zoa.io
URL: https://british-gas.zoa.io/sign-in?redirect=%2F
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.67.10.8 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
9d63d1fc285834cca52ebad83d156f8baa697892899428220e9b1a4849ac2309
Security Headers
Name Value
Strict-Transport-Security max-age=7776000; includeSubDomains; preload

Request headers

User-Agent
Mozilla/5.0 (Linux; Android 10; SM-A205U) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.114 Mobile Safari/537.36.
Referer
https://british-gas.zoa.io/sign-in?redirect=%2F

Response headers

strict-transport-security
max-age=7776000; includeSubDomains; preload
cache-control
public, max-age=31536000, immutable
content-encoding
gzip
cf-cache-status
HIT
etag
W/"29c0cf-1971274b580"
age
20350
via
1.1 google, 1.1 google
cf-ray
946bb14b79c0d117-CDG
date
Wed, 28 May 2025 06:28:33 GMT
content-type
application/javascript; charset=UTF-8
last-modified
Tue, 27 May 2025 15:55:28 GMT
vary
Accept-Encoding
server
cloudflare
f0eb20bc-49db8e9b84dc6037.js
british-gas.zoa.io/_next/static/chunks/ 		713 KB
38 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://british-gas.zoa.io/_next/static/chunks/f0eb20bc-49db8e9b84dc6037.js
Requested by
Host: british-gas.zoa.io
URL: https://british-gas.zoa.io/sign-in?redirect=%2F
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.67.10.8 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
60de40ee79e9238ae8513077755a045812d7cfb4cd4c3230ad8ab1405493e4c6
Security Headers
Name Value
Strict-Transport-Security max-age=7776000; includeSubDomains; preload

Request headers

User-Agent
Mozilla/5.0 (Linux; Android 10; SM-A205U) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.114 Mobile Safari/537.36.
Referer
https://british-gas.zoa.io/sign-in?redirect=%2F

Response headers

strict-transport-security
max-age=7776000; includeSubDomains; preload
cache-control
public, max-age=31536000, immutable
content-encoding
gzip
cf-cache-status
HIT
etag
W/"b25d6-1971274b580"
age
20349
via
1.1 google, 1.1 google
cf-ray
946bb14b79c1d117-CDG
date
Wed, 28 May 2025 06:28:33 GMT
content-type
application/javascript; charset=UTF-8
last-modified
Tue, 27 May 2025 15:55:28 GMT
vary
Accept-Encoding
server
cloudflare
808-e03e9b9701260b05.js
british-gas.zoa.io/_next/static/chunks/ 		6 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://british-gas.zoa.io/_next/static/chunks/808-e03e9b9701260b05.js
Requested by
Host: british-gas.zoa.io
URL: https://british-gas.zoa.io/sign-in?redirect=%2F
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.67.10.8 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
6f428b6913ab44103c912214a5dbd9da2423a84d16994891e86fabfbb5ce1424
Security Headers
Name Value
Strict-Transport-Security max-age=7776000; includeSubDomains; preload

Request headers

User-Agent
Mozilla/5.0 (Linux; Android 10; SM-A205U) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.114 Mobile Safari/537.36.
Referer
https://british-gas.zoa.io/sign-in?redirect=%2F

Response headers

strict-transport-security
max-age=7776000; includeSubDomains; preload
cache-control
public, max-age=31536000, immutable
content-encoding
gzip
cf-cache-status
HIT
etag
W/"1964-1971274b580"
age
20348
via
1.1 google, 1.1 google
cf-ray
946bb14b79c2d117-CDG
date
Wed, 28 May 2025 06:28:33 GMT
content-type
application/javascript; charset=UTF-8
last-modified
Tue, 27 May 2025 15:55:28 GMT
vary
Accept-Encoding
server
cloudflare
sign-in-56885fc99a1789e7.js
british-gas.zoa.io/_next/static/chunks/pages/ 		5 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://british-gas.zoa.io/_next/static/chunks/pages/sign-in-56885fc99a1789e7.js
Requested by
Host: british-gas.zoa.io
URL: https://british-gas.zoa.io/sign-in?redirect=%2F
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.67.10.8 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
08a796bdb40cecdb3387c9b5917bd40daa2a914a8472dcf7e083a5283d93a28b
Security Headers
Name Value
Strict-Transport-Security max-age=7776000; includeSubDomains; preload

Request headers

User-Agent
Mozilla/5.0 (Linux; Android 10; SM-A205U) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.114 Mobile Safari/537.36.
Referer
https://british-gas.zoa.io/sign-in?redirect=%2F

Response headers

strict-transport-security
max-age=7776000; includeSubDomains; preload
cache-control
public, max-age=31536000, immutable
content-encoding
gzip
cf-cache-status
HIT
etag
W/"15a6-1971274b580"
age
20348
via
1.1 google, 1.1 google
cf-ray
946bb14b79c3d117-CDG
date
Wed, 28 May 2025 06:28:33 GMT
content-type
application/javascript; charset=UTF-8
last-modified
Tue, 27 May 2025 15:55:28 GMT
vary
Accept-Encoding
server
cloudflare
_buildManifest.js
british-gas.zoa.io/_next/static/LjV0JiJyq3bnLyYNr__mk/ 		3 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://british-gas.zoa.io/_next/static/LjV0JiJyq3bnLyYNr__mk/_buildManifest.js
Requested by
Host: british-gas.zoa.io
URL: https://british-gas.zoa.io/sign-in?redirect=%2F
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.67.10.8 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
de67125b06d994279d39ce1ef17770fe8801caa30681152eacd437eb9312437e
Security Headers
Name Value
Strict-Transport-Security max-age=7776000; includeSubDomains; preload

Request headers

User-Agent
Mozilla/5.0 (Linux; Android 10; SM-A205U) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.114 Mobile Safari/537.36.
Referer
https://british-gas.zoa.io/sign-in?redirect=%2F

Response headers

strict-transport-security
max-age=7776000; includeSubDomains; preload
cache-control
public, max-age=31536000, immutable
content-encoding
gzip
cf-cache-status
HIT
etag
W/"b92-1971274b580"
age
20348
via
1.1 google, 1.1 google
cf-ray
946bb14b79c4d117-CDG
date
Wed, 28 May 2025 06:28:33 GMT
content-type
application/javascript; charset=UTF-8
last-modified
Tue, 27 May 2025 15:55:28 GMT
vary
Accept-Encoding
server
cloudflare
_ssgManifest.js
british-gas.zoa.io/_next/static/LjV0JiJyq3bnLyYNr__mk/ 		77 B
126 B 		Script
General
Check archive.org
Download Go to
Full URL
https://british-gas.zoa.io/_next/static/LjV0JiJyq3bnLyYNr__mk/_ssgManifest.js
Requested by
Host: british-gas.zoa.io
URL: https://british-gas.zoa.io/sign-in?redirect=%2F
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.67.10.8 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
6f5b4aa00d2f8d6aed9935b471806bf7acef464d0c1d390260e5fe27f800c67e
Security Headers
Name Value
Strict-Transport-Security max-age=7776000; includeSubDomains; preload

Request headers

User-Agent
Mozilla/5.0 (Linux; Android 10; SM-A205U) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.114 Mobile Safari/537.36.
Referer
https://british-gas.zoa.io/sign-in?redirect=%2F

Response headers

strict-transport-security
max-age=7776000; includeSubDomains; preload
cache-control
public, max-age=31536000, immutable
content-encoding
br
cf-cache-status
HIT
etag
W/"4d-1971274b580"
age
20348
via
1.1 google, 1.1 google
cf-ray
946bb14baa0fd117-CDG
date
Wed, 28 May 2025 06:28:33 GMT
content-type
application/javascript; charset=UTF-8
last-modified
Tue, 27 May 2025 15:55:28 GMT
vary
Accept-Encoding
server
cloudflare
b904a87d-720d-4fdb-b88f-bb01bcfe9640
https://british-gas.zoa.io/ 		0
0
config
sr-client-cfg.amplitude.com/ 		31 B
441 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://sr-client-cfg.amplitude.com/config?api_key=adcf5e1c2a8c55a91540f59fdf77e0a5&config_keys=analyticsSDK
Requested by
Host: british-gas.zoa.io
URL: https://british-gas.zoa.io/_next/static/chunks/pages/_app-f088ab104989091d.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.32.121.106 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-32-121-106.fra60.r.cloudfront.net
Software
/
Resource Hash
5e82265d046058ee7b5a936a202ead0cbf99b0c9aa96dd93c262f8434f2850ef

Request headers

User-Agent
Mozilla/5.0 (Linux; Android 10; SM-A205U) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.114 Mobile Safari/537.36.
Accept
*/*
Referer
https://british-gas.zoa.io/

Response headers

cache-control
public, max-age=60, s-maxage=60, stale-if-error=86400, stale-while-revalidate=600
access-control-expose-headers
X-Cache,Age
access-control-allow-credentials
true
via
1.1 8c08c39035033b8c904aa0e3f734d6c6.cloudfront.net (CloudFront)
access-control-allow-origin
https://british-gas.zoa.io
x-cache
Miss from cloudfront
content-length
31
x-amz-cf-id
T5Rl_vO8BXMYI4-W-UV9GfZ_MPXeANZwVuHijjsQrGV6M08uWlNCkg==
date
Wed, 28 May 2025 06:28:34 GMT
content-type
application/json
x-amz-cf-pop
FRA60-P1
vary
Origin
frontend
british-gas.zoa.io/api/ 		14 B
275 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://british-gas.zoa.io/api/frontend?sessionId=162690843&appName=default&environment=default
Requested by
Host: british-gas.zoa.io
URL: https://british-gas.zoa.io/_next/static/chunks/pages/_app-f088ab104989091d.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.67.10.8 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2d92a0692609c57e1b3657bc1845d9944b6c64794720d49b0c515f87c5310f42
Security Headers
Name Value
Strict-Transport-Security max-age=7776000; includeSubDomains; preload

Request headers

x-datadog-origin
rum
x-datadog-parent-id
1534863223683150334
authorization
default:production.b367c1088eeb0f3502c8886edbbd62b0869417d6a28977c0e2dae8ad
Referer
https://british-gas.zoa.io/sign-in?redirect=%2F
unleash-appname
default
unleash-connection-id
2cdb50c0-40fe-441b-b032-8f65bad8075c
x-datadog-trace-id
10322122202116056054
traceparent
00-00000000000000008f3f8b74314ce3f6-154cedf84a71f1fe-01
User-Agent
Mozilla/5.0 (Linux; Android 10; SM-A205U) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.114 Mobile Safari/537.36.
accept
application/json
unleash-sdk
unleash-client-js:3.7.6
x-datadog-sampling-priority
1

Response headers

strict-transport-security
max-age=7776000; includeSubDomains; preload
access-control-expose-headers
ETag
cache-control
no-cache
cf-cache-status
DYNAMIC
etag
W/"e-s5xwV9+7QhSQAlOjSJ/Y5v+WCp4"
access-control-allow-credentials
true
via
1.1 google, 1.1 google
cf-ray
946bb14f697fd117-CDG
access-control-allow-origin
*
content-length
14
date
Wed, 28 May 2025 06:28:33 GMT
content-type
application/json; charset=utf-8
vary
Origin, Accept-Encoding
server
cloudflare
favicon.ico
british-gas.zoa.io/ 		600 B
2 KB 		Other
General
Check archive.org
Download Go to
Full URL
https://british-gas.zoa.io/favicon.ico
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.67.10.8 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
8c24dfb20b34fb03c34a857a455d20b8c836ad5817b965ff2e53a584dc86cf3c
Security Headers
Name Value
Content-Security-Policy default-src 'self'; script-src 'self' https://apis.google.com; style-src 'self' 'unsafe-inline'; img-src 'self' blob: data:; font-src 'self'; object-src 'none'; base-uri 'self'; form-action 'self'; frame-ancestors 'none'; worker-src 'self' blob:; frame-src 'self' https://zoa.helpjuice.com https://looker.zoa.io https://*.firebaseapp.com; connect-src 'self' https://*.amplitude.com https://identitytoolkit.googleapis.com https://securetoken.googleapis.com https://*.sentry.io https://browser-intake-datadoghq.eu; upgrade-insecure-requests; report-uri https://o4505583766536192.ingest.us.sentry.io/api/4507861428535296/security/?sentry_key=55630378aef2f330f413e3c8decc2343; report-to csp_endpoint
Strict-Transport-Security max-age=7776000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (Linux; Android 10; SM-A205U) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.114 Mobile Safari/537.36.
Referer
https://british-gas.zoa.io/sign-in?redirect=%2F

Response headers

content-encoding
br
cf-cache-status
MISS
etag
W/"258-197126c87c0"
x-content-type-options
nosniff
date
Wed, 28 May 2025 06:28:33 GMT
content-type
image/x-icon
last-modified
Tue, 27 May 2025 15:46:32 GMT
vary
Accept-Encoding
strict-transport-security
max-age=7776000; includeSubDomains; preload
reporting-endpoints
csp_endpoint=https://o4505583766536192.ingest.us.sentry.io/api/4507861428535296/security/?sentry_key=55630378aef2f330f413e3c8decc2343
content-security-policy
default-src 'self'; script-src 'self' https://apis.google.com; style-src 'self' 'unsafe-inline'; img-src 'self' blob: data:; font-src 'self'; object-src 'none'; base-uri 'self'; form-action 'self'; frame-ancestors 'none'; worker-src 'self' blob:; frame-src 'self' https://zoa.helpjuice.com https://looker.zoa.io https://*.firebaseapp.com; connect-src 'self' https://*.amplitude.com https://identitytoolkit.googleapis.com https://securetoken.googleapis.com https://*.sentry.io https://browser-intake-datadoghq.eu; upgrade-insecure-requests; report-uri https://o4505583766536192.ingest.us.sentry.io/api/4507861428535296/security/?sentry_key=55630378aef2f330f413e3c8decc2343; report-to csp_endpoint
cache-control
public, max-age=14400
referrer-policy
strict-origin-when-cross-origin
via
1.1 google, 1.1 google
cf-ray
946bb14fca4ed117-CDG
permissions-policy
camera=(), microphone=(), geolocation=()
server
cloudflare
api.js
apis.google.com/js/ 		14 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://apis.google.com/js/api.js?onload=__iframefcb859753
Requested by
Host: british-gas.zoa.io
URL: https://british-gas.zoa.io/_next/static/chunks/pages/_app-f088ab104989091d.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
216.58.206.46 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
mil07s07-in-f14.1e100.net
Software
sffe /
Resource Hash
86d99001caa216269b8b2ebe290678aa4a50035fe99943e620b969c3593b93f7
Security Headers
Name Value
Content-Security-Policy require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/gapi-team
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (Linux; Android 10; SM-A205U) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.114 Mobile Safari/537.36.
Referer
https://british-gas.zoa.io/

Response headers

content-encoding
gzip
etag
"96c4834949897e5f"
report-to
{"group":"gapi-team","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gapi-team"}]}
x-content-type-options
nosniff
expires
Wed, 28 May 2025 06:28:34 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Wed, 28 May 2025 06:28:34 GMT
content-type
text/javascript
vary
Accept-Encoding
content-security-policy
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/gapi-team
cache-control
private, max-age=1800, stale-while-revalidate=1800
timing-allow-origin
*
cross-origin-opener-policy
same-origin; report-to="gapi-team"
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
access-control-allow-origin
*
content-length
5772
x-xss-protection
0
server
sffe
rum
browser-intake-datadoghq.eu/api/v2/ 		53 B
340 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://browser-intake-datadoghq.eu/api/v2/rum?ddsource=browser&ddtags=sdk_version%3A5.35.1%2Capi%3Afetch%2Cenv%3Aprod%2Cservice%3Asupplier-web%2Cversion%3A38376&dd-api-key=pub60ab114171636040f024bc222fb36874&dd-evp-origin-version=5.35.1&dd-evp-origin=browser&dd-request-id=53e9550c-cd68-414d-8f6f-e1997021fc6e&batch_time=1748413714016
Requested by
Host: british-gas.zoa.io
URL: https://british-gas.zoa.io/_next/static/chunks/pages/_app-f088ab104989091d.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.149.135.19 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
19.135.149.34.bc.googleusercontent.com
Software
/
Resource Hash
3a3f0d44d54b7275747273b03f2bd509b041e20422761878517251fb461d7be8
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (Linux; Android 10; SM-A205U) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.114 Mobile Safari/537.36.
Content-Type
text/plain;charset=UTF-8
Referer
https://british-gas.zoa.io/

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
cross-origin-resource-policy
cross-origin
x-content-type-options
nosniff
via
1.1 google
access-control-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
53
accept-encoding
identity,gzip,x-gzip,deflate,x-deflate,zstd
date
Wed, 28 May 2025 06:28:34 GMT
content-type
application/json
dd-request-id
53e9550c-cd68-414d-8f6f-e1997021fc6e
cb=gapi.loaded_0
apis.google.com/_/scs/abc-static/_/js/k=gapi.lb.en.nJpyt-fjzo8.O/m=gapi_iframes/rt=j/sv=1/d=1/ed=1/rs=AHpOoo9fTqXSCmwMDsu9FH68l5KSqr6MBg/ 		100 KB
33 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://apis.google.com/_/scs/abc-static/_/js/k=gapi.lb.en.nJpyt-fjzo8.O/m=gapi_iframes/rt=j/sv=1/d=1/ed=1/rs=AHpOoo9fTqXSCmwMDsu9FH68l5KSqr6MBg/cb=gapi.loaded_0?le=scs
Requested by
Host: apis.google.com
URL: https://apis.google.com/js/api.js?onload=__iframefcb859753
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
216.58.206.46 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
mil07s07-in-f14.1e100.net
Software
sffe /
Resource Hash
33105d219543d651b49650355b2133bf3cdf137aaf0e63398084957fa2462cfd
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (Linux; Android 10; SM-A205U) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.114 Mobile Safari/537.36.
Referer
https://british-gas.zoa.io/

Response headers

content-encoding
gzip
age
75740
report-to
{"group":"social-frontend-mpm-access","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/social-frontend-mpm-access"}]}
x-content-type-options
nosniff
expires
Wed, 27 May 2026 09:26:14 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Tue, 27 May 2025 09:26:14 GMT
last-modified
Tue, 06 May 2025 22:02:56 GMT
content-type
text/javascript; charset=UTF-8
vary
Accept-Encoding
cache-control
public, max-age=31536000
cross-origin-opener-policy
same-origin; report-to="social-frontend-mpm-access"
cross-origin-resource-policy
cross-origin
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/social-frontend-mpm-access
accept-ranges
bytes
access-control-allow-origin
*
content-length
33787
x-xss-protection
0
server
sffe
iframe
zoa-prod-idp-employee-01.firebaseapp.com/__/auth/ Frame 1237 		364 B
535 B 		Document
General
Check archive.org
Download Go to
Full URL
https://zoa-prod-idp-employee-01.firebaseapp.com/__/auth/iframe?apiKey=AIzaSyBb7r4gLhHUw97qrrn3O9mGtmvEyTWMK_Y&appName=%5BDEFAULT%5D&v=11.7.1&eid=p&usegapi=1&jsh=m%3B%2F_%2Fscs%2Fabc-static%2F_%2Fjs%2Fk%3Dgapi.lb.en.nJpyt-fjzo8.O%2Fd%3D1%2Frs%3DAHpOoo9fTqXSCmwMDsu9FH68l5KSqr6MBg%2Fm%3D__features__
Requested by
Host: apis.google.com
URL: https://apis.google.com/_/scs/abc-static/_/js/k=gapi.lb.en.nJpyt-fjzo8.O/m=gapi_iframes/rt=j/sv=1/d=1/ed=1/rs=AHpOoo9fTqXSCmwMDsu9FH68l5KSqr6MBg/cb=gapi.loaded_0?le=scs
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
199.36.158.100 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
d1eea8206093f3c645b999e44787c4798a867a5a26bc482313cf9007b778a47d
Security Headers
Name Value
Strict-Transport-Security max-age=31556926; includeSubDomains; preload

Request headers

Referer
https://british-gas.zoa.io/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Linux; Android 10; SM-A205U) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.114 Mobile Safari/537.36.

Response headers

accept-ranges
bytes
alt-svc
h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
cache-control
max-age=1800
content-encoding
gzip
content-length
244
content-type
text/html; charset=utf-8
date
Wed, 28 May 2025 06:28:34 GMT
strict-transport-security
max-age=31556926; includeSubDomains; preload
vary
x-fh-requested-host, accept-encoding
x-cache
MISS
x-cache-hits
0
x-served-by
cache-dub4361-DUB
x-timer
S1748413714.394644,VS0,VE204
forgotten-password.json
british-gas.zoa.io/_next/data/LjV0JiJyq3bnLyYNr__mk/en/ 		2 B
167 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://british-gas.zoa.io/_next/data/LjV0JiJyq3bnLyYNr__mk/en/forgotten-password.json
Requested by
Host: british-gas.zoa.io
URL: https://british-gas.zoa.io/_next/static/chunks/pages/_app-f088ab104989091d.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.67.10.8 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
Security Headers
Name Value
Content-Security-Policy default-src 'self'; script-src 'self' https://apis.google.com; style-src 'self' 'unsafe-inline'; img-src 'self' blob: data:; font-src 'self'; object-src 'none'; base-uri 'self'; form-action 'self'; frame-ancestors 'none'; worker-src 'self' blob:; frame-src 'self' https://zoa.helpjuice.com https://looker.zoa.io https://*.firebaseapp.com; connect-src 'self' https://*.amplitude.com https://identitytoolkit.googleapis.com https://securetoken.googleapis.com https://*.sentry.io https://browser-intake-datadoghq.eu; upgrade-insecure-requests; report-uri https://o4505583766536192.ingest.us.sentry.io/api/4507861428535296/security/?sentry_key=55630378aef2f330f413e3c8decc2343; report-to csp_endpoint
Strict-Transport-Security max-age=7776000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

x-datadog-origin
rum
x-datadog-parent-id
7783375351736148746
Referer
https://british-gas.zoa.io/sign-in?redirect=%2F
purpose
prefetch
x-middleware-prefetch
1
x-datadog-trace-id
2932000396487471811
x-nextjs-data
1
traceparent
00-000000000000000028b08ed381f0b2c3-6c041aa4f1c3a30a-01
User-Agent
Mozilla/5.0 (Linux; Android 10; SM-A205U) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.114 Mobile Safari/537.36.
x-datadog-sampling-priority
1

Response headers

strict-transport-security
max-age=7776000; includeSubDomains; preload
reporting-endpoints
csp_endpoint=https://o4505583766536192.ingest.us.sentry.io/api/4507861428535296/security/?sentry_key=55630378aef2f330f413e3c8decc2343
content-security-policy
default-src 'self'; script-src 'self' https://apis.google.com; style-src 'self' 'unsafe-inline'; img-src 'self' blob: data:; font-src 'self'; object-src 'none'; base-uri 'self'; form-action 'self'; frame-ancestors 'none'; worker-src 'self' blob:; frame-src 'self' https://zoa.helpjuice.com https://looker.zoa.io https://*.firebaseapp.com; connect-src 'self' https://*.amplitude.com https://identitytoolkit.googleapis.com https://securetoken.googleapis.com https://*.sentry.io https://browser-intake-datadoghq.eu; upgrade-insecure-requests; report-uri https://o4505583766536192.ingest.us.sentry.io/api/4507861428535296/security/?sentry_key=55630378aef2f330f413e3c8decc2343; report-to csp_endpoint
cache-control
private, no-cache, no-store, max-age=0, must-revalidate
cf-cache-status
DYNAMIC
referrer-policy
strict-origin-when-cross-origin
x-content-type-options
nosniff
via
1.1 google, 1.1 google
permissions-policy
camera=(), microphone=(), geolocation=()
x-matched-path
/forgotten-password
cf-ray
946bb1525fbad117-CDG
date
Wed, 28 May 2025 06:28:34 GMT
x-middleware-skip
1
server
cloudflare
forgotten-password-0eb7b359fab1ab47.js
british-gas.zoa.io/_next/static/chunks/pages/ 		0
3 KB 		Other
General
Check archive.org
Download Go to
Full URL
https://british-gas.zoa.io/_next/static/chunks/pages/forgotten-password-0eb7b359fab1ab47.js
Requested by
Host: british-gas.zoa.io
URL: https://british-gas.zoa.io/_next/static/chunks/main-de1f30cecdca4435.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.67.10.8 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=7776000; includeSubDomains; preload

Request headers

User-Agent
Mozilla/5.0 (Linux; Android 10; SM-A205U) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.114 Mobile Safari/537.36.
Referer
https://british-gas.zoa.io/sign-in?redirect=%2F

Response headers

strict-transport-security
max-age=7776000; includeSubDomains; preload
cache-control
public, max-age=31536000, immutable
content-encoding
gzip
cf-cache-status
MISS
etag
W/"1c9c-1971274b580"
via
1.1 google, 1.1 google
cf-ray
946bb1530935d117-CDG
date
Wed, 28 May 2025 06:28:34 GMT
content-type
application/javascript; charset=UTF-8
last-modified
Tue, 27 May 2025 15:55:28 GMT
vary
Accept-Encoding
server
cloudflare
forgotten-password-0eb7b359fab1ab47.js
british-gas.zoa.io/_next/static/chunks/pages/ 		7 KB
0 		Script
General
Check archive.org
Download Go to
Full URL
https://british-gas.zoa.io/_next/static/chunks/pages/forgotten-password-0eb7b359fab1ab47.js
Requested by
Host: british-gas.zoa.io
URL: https://british-gas.zoa.io/_next/static/chunks/main-de1f30cecdca4435.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.67.10.8 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
8d7c1df3dffa6d0ca433db1d8f69fb005a22c5d5ad8e455eee1ce9fbb3e0c925

Request headers

User-Agent
Mozilla/5.0 (Linux; Android 10; SM-A205U) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.114 Mobile Safari/537.36.
Referer
https://british-gas.zoa.io/sign-in?redirect=%2F

Response headers

cache-control
public, max-age=31536000, immutable
content-encoding
gzip
cf-cache-status
MISS
etag
W/"1c9c-1971274b580"
via
1.1 google, 1.1 google
cf-ray
946bb1530935d117-CDG
date
Wed, 28 May 2025 06:28:34 GMT
content-type
application/javascript; charset=UTF-8
last-modified
Tue, 27 May 2025 15:55:28 GMT
vary
Accept-Encoding
server
cloudflare
iframe.js
zoa-prod-idp-employee-01.firebaseapp.com/__/auth/ Frame 1237 		282 KB
90 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://zoa-prod-idp-employee-01.firebaseapp.com/__/auth/iframe.js
Requested by
Host: zoa-prod-idp-employee-01.firebaseapp.com
URL: https://zoa-prod-idp-employee-01.firebaseapp.com/__/auth/iframe?apiKey=AIzaSyBb7r4gLhHUw97qrrn3O9mGtmvEyTWMK_Y&appName=%5BDEFAULT%5D&v=11.7.1&eid=p&usegapi=1&jsh=m%3B%2F_%2Fscs%2Fabc-static%2F_%2Fjs%2Fk%3Dgapi.lb.en.nJpyt-fjzo8.O%2Fd%3D1%2Frs%3DAHpOoo9fTqXSCmwMDsu9FH68l5KSqr6MBg%2Fm%3D__features__
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
199.36.158.100 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
d6d71f7ca9d1d2fb552ac23f6327149ff16edd5d6ecfde3a69a0f2bdb723b827
Security Headers
Name Value
Strict-Transport-Security max-age=31556926; includeSubDomains; preload

Request headers

User-Agent
Mozilla/5.0 (Linux; Android 10; SM-A205U) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.114 Mobile Safari/537.36.
Referer
https://zoa-prod-idp-employee-01.firebaseapp.com/__/auth/iframe?apiKey=AIzaSyBb7r4gLhHUw97qrrn3O9mGtmvEyTWMK_Y&appName=%5BDEFAULT%5D&v=11.7.1&eid=p&usegapi=1&jsh=m%3B%2F_%2Fscs%2Fabc-static%2F_%2Fjs%2Fk%3Dgapi.lb.en.nJpyt-fjzo8.O%2Fd%3D1%2Frs%3DAHpOoo9fTqXSCmwMDsu9FH68l5KSqr6MBg%2Fm%3D__features__

Response headers

strict-transport-security
max-age=31556926; includeSubDomains; preload
cache-control
max-age=1800
content-encoding
gzip
x-timer
S1748413715.647482,VS0,VE456
accept-ranges
bytes
alt-svc
h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
x-cache
MISS
content-length
91992
date
Wed, 28 May 2025 06:28:35 GMT
content-type
text/javascript; charset=utf-8
x-served-by
cache-dub4361-DUB
x-cache-hits
0
vary
x-fh-requested-host, accept-encoding
getProjectConfig
www.googleapis.com/identitytoolkit/v3/relyingparty/ Frame 1237 		150 B
396 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://www.googleapis.com/identitytoolkit/v3/relyingparty/getProjectConfig?key=AIzaSyBb7r4gLhHUw97qrrn3O9mGtmvEyTWMK_Y&cb=1748413715252
Requested by
Host: zoa-prod-idp-employee-01.firebaseapp.com
URL: https://zoa-prod-idp-employee-01.firebaseapp.com/__/auth/iframe.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
216.58.206.74 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
tzfraa-aa-in-f10.1e100.net
Software
ESF /
Resource Hash
f1a4540d95f883904a1868bf9f165b656439f2a76106a0defea7cb82676e4b09
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Referer
https://zoa-prod-idp-employee-01.firebaseapp.com/
User-Agent
Mozilla/5.0 (Linux; Android 10; SM-A205U) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.114 Mobile Safari/537.36.
X-Client-Version
Chrome/Iframe/2.20.6/FirebaseCore-web
Content-Type
application/json

Response headers

cache-control
no-cache, no-store, max-age=0, must-revalidate
access-control-expose-headers
date,vary,vary,vary,content-encoding,server,content-length
content-encoding
gzip
pragma
no-cache
x-content-type-options
nosniff
expires
Mon, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin
https://zoa-prod-idp-employee-01.firebaseapp.com
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
141
date
Wed, 28 May 2025 06:28:35 GMT
x-xss-protection
0
content-type
application/json; charset=UTF-8
vary
Origin, X-Origin, Referer
server
ESF
x-frame-options
SAMEORIGIN
getProjectConfig
www.googleapis.com/identitytoolkit/v3/relyingparty/ Frame 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://www.googleapis.com/identitytoolkit/v3/relyingparty/getProjectConfig?key=AIzaSyBb7r4gLhHUw97qrrn3O9mGtmvEyTWMK_Y&cb=1748413715252
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
216.58.206.74 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
tzfraa-aa-in-f10.1e100.net
Software
ESF /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Accept
*/*
Access-Control-Request-Headers
content-type,x-client-version
Access-Control-Request-Method
GET
Origin
https://zoa-prod-idp-employee-01.firebaseapp.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Linux; Android 10; SM-A205U) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.114 Mobile Safari/537.36.

Response headers

access-control-allow-headers
content-type,x-client-version
access-control-allow-methods
DELETE,GET,HEAD,OPTIONS,PATCH,POST,PUT
access-control-allow-origin
https://zoa-prod-idp-employee-01.firebaseapp.com
access-control-max-age
3600
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
content-type
text/html
date
Wed, 28 May 2025 06:28:35 GMT
server
ESF
vary
origin referer x-origin
x-content-type-options
nosniff
x-frame-options
SAMEORIGIN
x-xss-protection
0
httpapi
api2.amplitude.com/2/ Frame 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://api2.amplitude.com/2/httpapi
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
52.32.98.99 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-32-98-99.us-west-2.compute.amazonaws.com
Software
/
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=15768000

Request headers

Accept
*/*
Access-Control-Request-Headers
content-type
Access-Control-Request-Method
POST
Origin
https://british-gas.zoa.io
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Linux; Android 10; SM-A205U) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.114 Mobile Safari/537.36.

Response headers

access-control-allow-headers
content-type
access-control-allow-methods
GET, POST
access-control-allow-origin
*
access-control-max-age
86400
content-length
0
date
Wed, 28 May 2025 06:28:36 GMT
strict-transport-security
max-age=15768000
httpapi
api2.amplitude.com/2/ 		93 B
217 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://api2.amplitude.com/2/httpapi
Requested by
Host: british-gas.zoa.io
URL: https://british-gas.zoa.io/_next/static/chunks/pages/_app-f088ab104989091d.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
52.32.98.99 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-32-98-99.us-west-2.compute.amazonaws.com
Software
/
Resource Hash
941b7c4e0d3661e94ff47a7f188d10b2a1a452791fe3dc9f609a7d1f92d68cea
Security Headers
Name Value
Strict-Transport-Security max-age=15768000

Request headers

Referer
https://british-gas.zoa.io/
User-Agent
Mozilla/5.0 (Linux; Android 10; SM-A205U) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.114 Mobile Safari/537.36.
Accept
*/*
Content-Type
application/json

Response headers

strict-transport-security
max-age=15768000
access-control-allow-origin
*
content-length
93
date
Wed, 28 May 2025 06:28:36 GMT
content-type
application/json

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
british-gas.zoa.io
URL
blob:https://british-gas.zoa.io/b904a87d-720d-4fdb-b88f-bb01bcfe9640

Verdicts & Comments Add Verdict or Comment

30 JavaScript Window variables

These are the non-standard variables defined on the window object. These include var declarations and global functions and can be helpful in identifying possible client-side frameworks and code.

object| 0 object| _sentryDebugIds string| _sentryDebugIdIdentifier object| webpackChunk_N_E function| __next_set_public_path__ object| next object| __NEXT_DATA__ function| __SSG_MANIFEST_CB object| __NEXT_P object| _N_E object| __SENTRY__ object| SENTRY_RELEASE object| DD_RUM object| _reactFireDatabaseCachedQueries object| _reactFirePreloadedObservables object| _reactFireFirestoreQueryCache object| __REACT_INTL_CONTEXT__ object| __MIDDLEWARE_MATCHERS object| __BUILD_MANIFEST object| __SSG_MANIFEST object| __clientConfig object| __remoteConfig object| zoaDevTools function| __iframefcb859753 object| gapi object| ___jsl object| _F_toggles object| osapi boolean| __reactResponderSystemActive object| analyticsConnectorInstances

3 Cookies

Domain/Path Name / Value
.british-gas.zoa.io/ Name: AMP_MKTG_adcf5e1c2a
Value: JTdCJTdE
.british-gas.zoa.io/ Name: AMP_adcf5e1c2a
Value: JTdCJTIyZGV2aWNlSWQlMjIlM0ElMjI2YTNhNjFjZS0xMjYxLTQwZmUtYWU4NS0yYTlmYzhlZTY2OGIlMjIlMkMlMjJzZXNzaW9uSWQlMjIlM0ExNzQ4NDEzNzE0Mjk2JTJDJTIyb3B0T3V0JTIyJTNBZmFsc2UlMkMlMjJsYXN0RXZlbnRUaW1lJTIyJTNBMTc0ODQxMzcxNTI2OSUyQyUyMmxhc3RFdmVudElkJTIyJTNBNCUyQyUyMnBhZ2VDb3VudGVyJTIyJTNBMSU3RA==
british-gas.zoa.io/ Name: _dd_s
Value: rum=1&id=58b3d5fc-d274-43ca-8c5a-3b0cf4a9cc95&created=1748413713768&expire=1748414613768

1 Console Messages

Source Level URL
Text
recommendation verbose URL: https://british-gas.zoa.io/sign-in?redirect=%2F
Message:
[DOM] Password field is not contained in a form: (More info: https://goo.gl/9p2vKq) %o

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Content-Security-Policy default-src 'self'; script-src 'self' https://apis.google.com; style-src 'self' 'unsafe-inline'; img-src 'self' blob: data:; font-src 'self'; object-src 'none'; base-uri 'self'; form-action 'self'; frame-ancestors 'none'; worker-src 'self' blob:; frame-src 'self' https://zoa.helpjuice.com https://looker.zoa.io https://*.firebaseapp.com; connect-src 'self' https://*.amplitude.com https://identitytoolkit.googleapis.com https://securetoken.googleapis.com https://*.sentry.io https://browser-intake-datadoghq.eu; upgrade-insecure-requests; report-uri https://o4505583766536192.ingest.us.sentry.io/api/4507861428535296/security/?sentry_key=55630378aef2f330f413e3c8decc2343; report-to csp_endpoint
Strict-Transport-Security max-age=7776000; includeSubDomains; preload
X-Content-Type-Options nosniff

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

api2.amplitude.com
apis.google.com
british-gas.zoa.io
browser-intake-datadoghq.eu
sr-client-cfg.amplitude.com
www.googleapis.com
zoa-prod-idp-employee-01.firebaseapp.com
british-gas.zoa.io
13.32.121.106
172.67.10.8
199.36.158.100
216.58.206.46
216.58.206.74
34.149.135.19
52.32.98.99
08a796bdb40cecdb3387c9b5917bd40daa2a914a8472dcf7e083a5283d93a28b
2d92a0692609c57e1b3657bc1845d9944b6c64794720d49b0c515f87c5310f42
33105d219543d651b49650355b2133bf3cdf137aaf0e63398084957fa2462cfd
3a3f0d44d54b7275747273b03f2bd509b041e20422761878517251fb461d7be8
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
4de77a376ab6e6e16d06d9d4c0013423738e0d4b620d675462411c9a6fbf83c5
5e82265d046058ee7b5a936a202ead0cbf99b0c9aa96dd93c262f8434f2850ef
60de40ee79e9238ae8513077755a045812d7cfb4cd4c3230ad8ab1405493e4c6
634e80c49c56385d23955a0040ef52e8e7d9c8bbf8a28c5cb4c30459b18dea84
6dbfe0afa9bd6979d981e1804fb80c5c53d9d62493be6f2eb4e061c59c9e3d62
6f428b6913ab44103c912214a5dbd9da2423a84d16994891e86fabfbb5ce1424
6f5b4aa00d2f8d6aed9935b471806bf7acef464d0c1d390260e5fe27f800c67e
86d99001caa216269b8b2ebe290678aa4a50035fe99943e620b969c3593b93f7
8c24dfb20b34fb03c34a857a455d20b8c836ad5817b965ff2e53a584dc86cf3c
8d7c1df3dffa6d0ca433db1d8f69fb005a22c5d5ad8e455eee1ce9fbb3e0c925
941b7c4e0d3661e94ff47a7f188d10b2a1a452791fe3dc9f609a7d1f92d68cea
96a63313fefa9f8ae46cb3c64b2f49b140e0098cac396ab0333588342c1c0f63
9d63d1fc285834cca52ebad83d156f8baa697892899428220e9b1a4849ac2309
c18488e853055ee53b1d9eb9703deffc99b378626d5f107551910742b672f89f
c88db2401bef7e1203e0933cc5525a0f81863bfd076756db12acea5596f089ec
d1eea8206093f3c645b999e44787c4798a867a5a26bc482313cf9007b778a47d
d6d71f7ca9d1d2fb552ac23f6327149ff16edd5d6ecfde3a69a0f2bdb723b827
de67125b06d994279d39ce1ef17770fe8801caa30681152eacd437eb9312437e
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
f1a4540d95f883904a1868bf9f165b656439f2a76106a0defea7cb82676e4b09