Security Scan: Sign in

Summary

This website contacted 3 IPs in 2 countries across 3 domains to perform 20 HTTP transactions. The main domain is signin.spark.co.nz.

Submitted URL: https://www.spark.co.nz/cwa/openam/SSORedirect/metaAlias/Xtramail/idp1?SAMLRequest=hZJbaxsxEIX%2FyqL3Xfm6G4Rt2HodMCRtsNNS%2BhJUeUJEdYtmNpv211dap8V9SdGDYGYOc74jrVBaE0Tb05M7wHMPSMWrNQ7F2FizPjrhJWoUTlpAQUoc29sbMasmIkRPXnnDLiTvKyQiRNLesWLfrdnDrl7W891iN22uFul0Td02zYdtdzW7bpvJYs6KLxAxza9ZkicRYg97hyQdpdJkVpeTZTld3k9rsViKefONFV1i0E7SqHoiCig4H4ahwiDjj0r5yv3iapDcB0gO%2BfH46QAnHUERt0CyNVoi%2F0pRWqkN16cwZcXWO4S88z06dR4Sqo8x3aW2wWiliRXXPioYQ16zR2kQMspdSkO%2FwN9K%2ByecvKy3EI8QX7SCz4ebCxD4nm1Vr8nfG4sFY7zjwSMdAEM2wTar%2FBhizCtuZAjYa4IyF0sa4opftlfnT%2FAxAe27O588%2F8yOrfwPb67oU%2Fk4jopkyKFO3IkkGRq2ESQlOoo9ML45r%2Fz3q21%2BAw%3D%3D&RelayState=https%3A%2F%2Fwebmail.xtra.co.nz%2Findex.cgi&SigAlg=http%3A%2F%2Fwww.w3.org%2F2001%2F04%2Fxmldsig-more%23rsa-sha256&Signature=fn4ssn8pvuBsklQt1nDL7gIE1c5RmYTlhypOmuEA%2F2iPKC4C9T9Qz8ELkjEbLhkRvwR1nMqZOgv4EmJ6vltNQotVz63edmZCWi%2B8cyS0ZwRzTHILRQ%2BsNzO7MtFPQ%2FFIFxKSFdxSjFjMBd5J3cXzn6s1UiksdvrMmWcbQn4shR4aFF31qnXlUoLTnzeUdSmHm0xbewq1Xk8bhVFHYqjNe2bNZdYaiF59%2BSgS2ztJXm9kzUtkq4eLHnXco%2Fxp4doZC2%2BtQC%2F3VJA5oPvHXVBX4YxNTJZav19urH2i98HcSaYNP7SkBYkSyG%2FUnLVRrkuwif6uHZfs9cgj5W3wJxSnOg%3D%3D

Effective URL: https://signin.spark.co.nz/?goto=https://www.spark.co.nz/xtramail/checkcookies?spEntityID%3Dappsuite-saml-twr%26goto%3Dhttp://openam.internal.spark.co.nz:8080/openam/saml2/continue/metaAlias/Xtramail/idp1?secondVisitUrl%253D/SSORedirect/metaAlias/Xtramail/idp1?ReqID%25253D_E6563E4E1784848D76A77BCD82FA7043%26AMAuthCookie%3D&brand=xtramailRedirected

The Cisco Umbrella rank of the primary domain is #416,869 of the top 1 million websites

AI Security Verdict

Confirmed Scam

Confidence: 92%

Risk Score

The site mimics an Xtra Mail login on a low‑rank, newly‑registered domain and triggers critical malware alerts; treat as confirmed credential phishing.

Risk Factors

Low domain ranking for claimed brand

Unknown domain age combined with credential form

Critical IDS alerts indicating malware and C2 activity

Brand impersonation of Xtra Mail on a non‑official domain

Single login form collecting user credentials

Domain age information unavailable

Details

Page Title

Scan Type

public

Language

🇺🇸

English

(54% confidence)

Screenshot

Page Load Overview

5.50s

Total Load Time

HTTP Requests

Domains

164 KB

Total Size

Language Analysis

Primary Language

🇺🇸English

Code: en

Confidence:54%

Script:Latin

Direction:ltr

Detection Details

Language Code:en

Detection Confidence:54%

Script Type:Latin

Text Length:187 chars

Detector Agreement:100%

Website Classification

Primary Category

healthcare medical29% confidence

Type: spa

Method: ml+structural

All Detected Categories

healthcare medical

29%

technology software

27%

Detected Features

Domain & IP Information

Requests	IP Address	Location	AS Autonomous System
8	34.160.81.0	Kansas City, Missouri, United States	AS396982Google LLC
6	66.22.91.1	Auckland, Auckland, New Zealand	AS48851Radware Ltd
6	66.22.91.48	Auckland, Auckland, New Zealand	AS48851Radware Ltd
20	3	-	-