Security Scan: Sign in

Summary

This website contacted 3 IPs in 2 countries across 3 domains to perform 20 HTTP transactions. The main domain is signin.spark.co.nz.

Submitted URL: https://www.spark.co.nz/cwa/openam/SSORedirect/metaAlias/Xtramail/idp1?SAMLRequest=hZLdahsxEIVfZdH9rnYdO46FbVjbCRjSNthNKbkJijwhIvqLZjab9ukjrdvg3qQgEMzMYc53pDlKa4JoO3pyO3jpAKl4s8ahGBoL1kUnvESNwkkLKEiJffvlWoyqWoToyStv2Inkc4VEhEjaO1ZsNwt23zSjyaZuJ7Pzy3ZdN6vVdDRdjWftVXs5vbgYr1nxAyKm%2BQVL8iRC7GDrkKSjVKpH52U9KZvx93omztJp7lixSQzaSRpUT0QBBed931cYZHyulK%2Fcb656yX2A5JDv9992cNARFHELJFujJfKfFKWV2nB9CA0r1t4h5J2f0anjkFBdjOkutQ1GK02suPJRwRDygj1Kg5BRblIa%2BhU%2BKu3fcPKyzkLcQ3zVCm531ycg8JBtVW%2FJ3x8WC8Z4x4NH2gGGbIIt5%2FkxxJBXXMoQsNMEZS6W1Mc5P23Pj5%2FgawLabm588vwrO7byP7y5og%2Fl4zAqkiGHOnEnkmSoX0eQlOgodsD48rjy36%2B2fAc%3D&RelayState=https%3A%2F%2Fwebmail.xtra.co.nz%2Findex.cgi&SigAlg=http%3A%2F%2Fwww.w3.org%2F2001%2F04%2Fxmldsig-more%23rsa-sha256&Signature=WfPatzYnMyMbRmVcl3nPfJ8qQhA1Hfit62R1mdBgXtxHNNG1%2FW%2Fip5TpJPs4QwhOC5ErEvfpabQdleszNCz8GgkItu10FYaYq4ZpwHU%2FUo9bLEJmunmxKTq8l2UcBQIW46vqmf3XJtdiEFu%2FXRvG9ONwX5HuDHvdcKbBKIEZA2XuJaE6FzzU%2F5bX1hCXub%2BX5WJnwRDM1QzWOrAc%2B5X0lvmXcqsAMdxnJ929PlhXOeXMjmGiDOyejiZcbXmOJaGaFTO9%2B%2Bfi1Ge%2BsMAv%2BMMNPF9BezrcL1t0wvAwVM4BOsYZbWnzEVFBEsj0gnHoZ7oiQkagwykgC7%2Fqyo%2FOsvJ40w%3D%3D

Effective URL: https://signin.spark.co.nz/?goto=https://www.spark.co.nz/xtramail/checkcookies?spEntityID%3Dappsuite-saml-twr%26goto%3Dhttp://openam.internal.spark.co.nz:8080/openam/saml2/continue/metaAlias/Xtramail/idp1?secondVisitUrl%253D/SSORedirect/metaAlias/Xtramail/idp1?ReqID%25253D_1125D0A596EAC01BB727B49AFAE7884C%26AMAuthCookie%3D&brand=xtramailRedirected

The Cisco Umbrella rank of the primary domain is #416,869 of the top 1 million websites

AI Security Verdict

Confirmed Scam

Confidence: 92%

Risk Score

The site presents a credential‑phishing login for Xtra Mail on a low‑rank, unknown‑age domain, reinforced by critical IDS malware alerts and heavily obfuscated JavaScript, indicating a confirmed scam.

Risk Factors

Unknown domain age with credential collection

Low Cisco Umbrella ranking for a brand claim

Critical IDS alerts for malware data exfiltration and C2 activity

Highly obfuscated JavaScript code

Single password field without additional context (phishing indicator)

Domain age information unavailable

Details

Page Title

Scan Type

public

Language

🇺🇸

English

(54% confidence)

Screenshot

Page Load Overview

5.92s

Total Load Time

HTTP Requests

Domains

164 KB

Total Size

Language Analysis

Primary Language

🇺🇸English

Code: en

Confidence:54%

Script:Latin

Direction:ltr

Detection Details

Language Code:en

Detection Confidence:54%

Script Type:Latin

Text Length:187 chars

Detector Agreement:100%

Website Classification

Primary Category

healthcare medical29% confidence

Type: spa

Method: ml+structural

All Detected Categories

healthcare medical

29%

technology software

27%

Detected Features

Domain & IP Information

Requests	IP Address	Location	AS Autonomous System
8	66.22.91.1	Auckland, Auckland, New Zealand	AS48851Radware Ltd
6	66.22.91.48	Auckland, Auckland, New Zealand	AS48851Radware Ltd
6	34.160.81.0	Kansas City, Missouri, United States	AS396982Google LLC
20	3	-	-