![](/screenshots/2d280544-75db-41d2-933d-6996e64d9b37.png)
forms.c-e.io
Open in
urlscan Pro
52.208.171.81
Malicious Activity!
Public Scan
Effective URL: https://forms.c-e.io/bgb_boiler/JcKODh5SDBK1z-vUGMXqNg
Submission: On January 27 via manual from GB
Summary
TLS certificate: Issued by Amazon on July 27th 2020. Valid for: a year.
This is the only time forms.c-e.io was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: British Gas (Utility)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 52.30.226.204 52.30.226.204 | 16509 (AMAZON-02) (AMAZON-02) | |
1 1 | 143.204.94.35 143.204.94.35 | 16509 (AMAZON-02) (AMAZON-02) | |
13 | 52.208.171.81 52.208.171.81 | 16509 (AMAZON-02) (AMAZON-02) | |
2 | 2a00:1450:400... 2a00:1450:4001:827::200e | 15169 (GOOGLE) (GOOGLE) | |
15 | 3 |
ASN16509 (AMAZON-02, US)
PTR: ec2-52-30-226-204.eu-west-1.compute.amazonaws.com
c-e.io |
ASN16509 (AMAZON-02, US)
PTR: server-143-204-94-35.fra50.r.cloudfront.net
r.c-e.io |
ASN16509 (AMAZON-02, US)
PTR: ec2-52-208-171-81.eu-west-1.compute.amazonaws.com
forms.c-e.io |
ASN15169 (GOOGLE, US)
www.google-analytics.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
15 |
c-e.io
2 redirects
c-e.io r.c-e.io forms.c-e.io |
183 KB |
2 |
google-analytics.com
www.google-analytics.com |
19 KB |
15 | 2 |
Domain | Requested by | |
---|---|---|
13 | forms.c-e.io |
forms.c-e.io
|
2 | www.google-analytics.com |
forms.c-e.io
www.google-analytics.com |
1 | r.c-e.io | 1 redirects |
1 | c-e.io | 1 redirects |
15 | 4 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.c-e.io Amazon |
2020-07-27 - 2021-08-27 |
a year | crt.sh |
*.google-analytics.com GTS CA 1O1 |
2021-01-05 - 2021-03-30 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://forms.c-e.io/bgb_boiler/JcKODh5SDBK1z-vUGMXqNg
Frame ID: A66CFEAA018E88A181880A87A9F1E061
Requests: 16 HTTP requests in this frame
Screenshot
![](/screenshots/2d280544-75db-41d2-933d-6996e64d9b37.png)
Page URL History Show full URLs
-
http://c-e.io/9pqw3kg
HTTP 301
https://r.c-e.io/9pqw3kg HTTP 301
https://forms.c-e.io/bgb_boiler/JcKODh5SDBK1z-vUGMXqNg Page URL
Detected technologies
Detected patterns
- script /google-analytics\.com\/(?:ga|urchin|analytics)\.js/i
Detected patterns
- script /jquery[.-]([\d.]*\d)[^/]*\.js/i
- script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://c-e.io/9pqw3kg
HTTP 301
https://r.c-e.io/9pqw3kg HTTP 301
https://forms.c-e.io/bgb_boiler/JcKODh5SDBK1z-vUGMXqNg Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
15 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
JcKODh5SDBK1z-vUGMXqNg
forms.c-e.io/bgb_boiler/ Redirect Chain
|
3 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
normalize.css
forms.c-e.io/css/ |
8 KB 3 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.mobile-1.4.5.min.css
forms.c-e.io/css/ |
203 KB 25 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
skeleton.css
forms.c-e.io/css/ |
11 KB 3 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
forms.css
forms.c-e.io/css/ |
3 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
britishgas.css
forms.c-e.io/css/bespoke/ |
5 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-1.8.3.min.js
forms.c-e.io/Scripts/ |
91 KB 42 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.mobile-1.4.5.min.js
forms.c-e.io/Scripts/ |
195 KB 55 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.validate.min.js
forms.c-e.io/Scripts/ |
22 KB 7 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
main.js
forms.c-e.io/Scripts/ |
931 B 764 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
analytics.js
www.google-analytics.com/ |
46 KB 18 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
BGFlameWeb-Light.woff
forms.c-e.io/fonts/british-gas/ |
30 KB 30 KB |
Font
font/x-woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ajax-loader.gif
forms.c-e.io/css/images/ |
6 KB 6 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
britishgas_logo.svg
forms.c-e.io/images/britishgas/ |
5 KB 5 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
34 B 0 |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H3-Q050 |
collect
www.google-analytics.com/j/ |
2 B 63 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: British Gas (Utility)18 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes boolean| crossOriginIsolated function| $ function| jQuery object| jQuery183012027861014792363 string| GoogleAnalyticsObject function| ga object| google_tag_data object| gaplugins object| gaGlobal object| gaData4 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.c-e.io/ | Name: _gid Value: GA1.2.323037179.1611747949 |
|
.c-e.io/ | Name: _gat Value: 1 |
|
.c-e.io/ | Name: _ga Value: GA1.2.1238195935.1611747949 |
|
forms.c-e.io/ | Name: __RequestVerificationToken Value: YgeH88LaZVRlbJ5r0HCD7ry7jCz-nfQWRcVk55OITnekRHDDA4It1itWYmQZsdS8oihJd6kuUAjXw9jlq1PO2DvoBXIAFX_wKh54JR4Uylw1 |
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
X-Frame-Options | SAMEORIGIN |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
c-e.io
forms.c-e.io
r.c-e.io
www.google-analytics.com
143.204.94.35
2a00:1450:4001:827::200e
52.208.171.81
52.30.226.204
0a5e7e4d3af18eb5f89aabeaf42c7b70007f77ed24c8b70dac05dd72272bb842
0b09bd432167b281c5a25bcc8b257e2f1c1ae28a7930d0cad0cbfbfb10759d21
1e85ec81b9800b4c443d39caca0d0926089a3ac201120db1ceb45b93789480b8
34c907374e938efced62f13f2a6755f9edcd5634ec946a74d936258ef1335c58
3ab9d4466fb5ee0428543ebe77e4d0ff4232ba815da15bf1be2c31f7e4a79db4
4283b7de52bd36949abd99c7f8f7a1301ecf3d67f60658fa8c6854eadcb91950
861fbac4f29c9bc51115c24364e949ab364fa4e9e002746ffa8ed202547790a5
95a8821e987cc19f8f3de5cb6b6120ce5a35dc337d41ebc009a9dce9828b7095
9de941aab5569318b981e6db0d617146032a0943c51518e7395a78e8490d2aa8
a048e640908046be06e00eab37742b5d5ff80964af58cfd22f7cb2de4dfe375f
a79fad2c796872ce2a8838892f7f2b320a3abf6a99a0a66eba0919ff78363fdf
ba6eda7945ab8d7e57b34cc5a3dd292fa2e4c60a5ced79236ecf1a9e0f0c2d32
ce1cc7dd54e9aecfb7232ae045a87fe93a0fa8cac454fe2e94dc1902a2cabdb4
e0efb2698022192156cc78047437988d55dda3b2f39ce4fa3b4cddce3012dcf2
e441c3e2771625ba05630ab464275136a82c99650ee2145ca5aa9853bedeb01b
f30c8cb3ab2e2723a9499ea38d8fac4e111163d2a7efa7e3f7110b7e5ab6c8cd