Security Scan: Sign in

Summary

This website contacted 3 IPs in 2 countries across 3 domains to perform 20 HTTP transactions. The main domain is signin.spark.co.nz.

Submitted URL: https://www.spark.co.nz/cwa/openam/SSORedirect/metaAlias/Xtramail/idp1?SAMLRequest=hZLdbtswDIVfxdC9LTupO1dIAhhJCwTotiLphqE3haqwqDD9TaTrbk8%2FyWmH7Ka9EkDygOc74gKlNUH0Az25HfwaAKl4scahmBpLNkQnvESNwkkLKEiJff%2F5WsyqWoToyStv2InkfYVEhEjaO1ZsN0t2P7%2Bcn3d1f%2FGpaZtmftF1bbtZXzX9vD%2FrLtdtz4rvEDHNL1mSJxHiAFuHJB2lUj07L%2Bu2bM5uZ7VoO9E2d6zYJAbtJE2qJ6KAgvNxHCsMMv6slK%2FcH65GyX2A5JDv9193cNARFHELJHujJfIfFKWV2nB9CA0r1t4h5J3v0anjkFBDjOkttQ1GK02suPJRwRTykj1Kg5BRblIa%2Bhn%2BVfq3cPKywULcQ3zWCr7trk9A4CHbql6Sv1cWC8Z4x4NH2gGGbIKtFvkzxJRXXMkQcNAEZS6WNMYFP20vjkfwJQFtNzc%2Bef6dHVv5AW%2Bu6EP5OI2KZMihTtyJJBka1xEkJTqKAzC%2BOq78%2F9RWfwE%3D&RelayState=https%3A%2F%2Fwebmail.xtra.co.nz%2Findex.cgi&SigAlg=http%3A%2F%2Fwww.w3.org%2F2001%2F04%2Fxmldsig-more%23rsa-sha256&Signature=kjq3ixsAyQiuHuNTp7eoTo3YSAcb44HMrqvMOKFDAyZIlVMt5r0mxZNLaghhvJMLdgNdMd7XVGAGQjT8jfNmykIBnq2n%2BWK9y%2BSDjV%2Fnn6U%2F7qRVXue0djZHpetXD3PnvbmGMxzy9s7imoqV7woaspS95l2N77pe9UMYkEbHW6If517jqZM5osGVqaxeUBp9Qkwkt8d53N90CP7z4X5DmIHIT2TbQqkC6JEWEUKd4w6%2F9RemVi8cPMKqwEx7nrIJnNopQGqVipN%2F835rKpExbPtQ5%2BYxkDOl6F6ovGBqrrYuaVrNPbFMn5T0uUhjDFiclTkwuM6xhO9Y96SUsMDdLQ%3D%3D

Effective URL: https://signin.spark.co.nz/?goto=https://www.spark.co.nz/xtramail/checkcookies?spEntityID%3Dappsuite-saml-twr%26goto%3Dhttp://openam.internal.spark.co.nz:8080/openam/saml2/continue/metaAlias/Xtramail/idp1?secondVisitUrl%253D/SSORedirect/metaAlias/Xtramail/idp1?ReqID%25253D_3E3680A971511398855DCF1A3A48EC5A%26AMAuthCookie%3D&brand=xtramailRedirected

The Cisco Umbrella rank of the primary domain is #416,869 of the top 1 million websites

AI Security Verdict

High Risk

Confidence: 88%

Risk Score

The site presents a credential‑phishing login for Xtra Mail on a low‑ranked, newly‑registered Spark domain, reinforced by critical IDS alerts and heavily obfuscated JavaScript.

Risk Factors

Low domain ranking for a well‑known brand

Unknown domain age combined with credential form

Critical IDS alerts indicating possible data exfiltration and C2 activity

Highly obfuscated JavaScript code

Credential collection on a subdomain that does not match official Xtra Mail branding

Domain age information unavailable

Details

Page Title

Scan Type

public

Language

🇺🇸

English

(54% confidence)

Screenshot

Page Load Overview

5.79s

Total Load Time

HTTP Requests

Domains

164 KB

Total Size

Language Analysis

Primary Language

🇺🇸English

Code: en

Confidence:54%

Script:Latin

Direction:ltr

Detection Details

Language Code:en

Detection Confidence:54%

Script Type:Latin

Text Length:187 chars

Detector Agreement:100%

Website Classification

Primary Category

healthcare medical29% confidence

Type: spa

Method: ml+structural

All Detected Categories

healthcare medical

29%

technology software

27%

Detected Features

Domain & IP Information

Requests	IP Address	Location	AS Autonomous System
8	66.22.91.48	Auckland, Auckland, New Zealand	AS48851Radware Ltd
6	34.160.81.0	Kansas City, Missouri, United States	AS396982Google LLC
6	66.22.91.1	Auckland, Auckland, New Zealand	AS48851Radware Ltd
20	3	-	-