update-1-b4cd40.ingress-bonde.ewp.live Open in urlscan Pro
63.250.43.2 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://protect-au.mimecast.com/s/rQBOCnxyqQslLGqVFNDeLN?domain=url7618.sparkmembership.com
Effective URL:
https://update-1-b4cd40.ingress-bonde.ewp.live/update/02/xtra/login/signin/
Submission: On September 21 via manual (September 21st 2022, 10:46:41 pm UTC) from NZ — Scanned from AU

Summary HTTP 18 Redirects Links 11 Behaviour Indicators

Summary

This website contacted 3 IPs in 2 countries across 4 domains to perform 18 HTTP transactions. The main IP is 63.250.43.2, located in United States and belongs to NAMECHEAP-NET, US. The main domain is update-1-b4cd40.ingress-bonde.ewp.live.
TLS certificate: Issued by Sectigo RSA Domain Validation Secure ... on June 28th 2022. Valid for: a year.

This is the only time update-1-b4cd40.ingress-bonde.ewp.live was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Spark (Telecommunication)

Domain & IP information

	IP Address	AS Autonomous System
2 2	103.13.69.19 103.13.69.19	17819 (ASN-EQUIN...) (ASN-EQUINIX-AP Equinix Asia Pacific)
1 1	167.89.115.56 167.89.115.56	11377 (SENDGRID) (SENDGRID)
2 15	63.250.43.2 63.250.43.2	22612 (NAMECHEAP...) (NAMECHEAP-NET)
3	146.171.248.36 146.171.248.36	() ()
18	3

2 103.13.69.19 (Australia) 2 redirects

ASN17819 (ASN-EQUINIX-AP Equinix Asia Pacific, SG)
PTR: au-api.mimecast.com

protect-au.mimecast.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 167.89.115.56 (Herndon, United States) 1 redirects

ASN11377 (SENDGRID, US)
PTR: o16789115x56.outbound-mail.sendgrid.net

url7618.sparkmembership.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

15 63.250.43.2 (United States) 2 redirects

ASN22612 (NAMECHEAP-NET, US)
PTR: ingress-bonde.easywp.com

update-1-b4cd40.ingress-bonde.ewp.live	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 146.171.248.36 (None, )

ASN- ()

www.spark.co.nz	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
15	ewp.live 2 redirects update-1-b4cd40.ingress-bonde.ewp.live	296 KB
3	spark.co.nz www.spark.co.nz	14 KB
2	mimecast.com 2 redirects protect-au.mimecast.com — Cisco Umbrella Rank: 441559	3 KB
1	sparkmembership.com 1 redirects url7618.sparkmembership.com	278 B
18	4

	Domain	Requested by
15	update-1-b4cd40.ingress-bonde.ewp.live	2 redirects update-1-b4cd40.ingress-bonde.ewp.live
3	www.spark.co.nz	update-1-b4cd40.ingress-bonde.ewp.live
2	protect-au.mimecast.com	2 redirects
1	url7618.sparkmembership.com	1 redirects
18	4

This site contains links to these domains. Also see Links.

Domain
www.spark.co.nz

Subject Issuer	Validity	Valid
*.ingress-bonde.ewp.live Sectigo RSA Domain Validation Secure Server CA	`2022-06-28` - `2023-06-28`	a year	crt.sh
www.spark.co.nz Entrust Certification Authority - L1K	`2022-06-14` - `2023-07-12`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://update-1-b4cd40.ingress-bonde.ewp.live/update/02/xtra/login/signin/
Frame ID: 1A43E74AA65DF02D5D48AA14739E3F3F
Requests: 18 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Xtramail sign in | Spark NZ

Page URL History Show full URLs

https://update-1-b4cd40.ingress-bonde.ewp.live/update/02/xtra/login/signin HTTP 301
http://update-1-b4cd40.ingress-bonde.ewp.live/update/02/xtra/login/signin/ HTTP 307
https://update-1-b4cd40.ingress-bonde.ewp.live/update/02/xtra/login/signin/ Page URL

Detected technologies

Adobe Experience Manager (CMS) Expand

Overall confidence: 100%
Detected patterns

<div class="[^"]*aem-Grid
/etc/designs/

Page Statistics

18
Requests

89 %
HTTPS

0 %
IPv6

4
Domains

4
Subdomains

3
IPs

2
Countries

309 kB
Transfer

1251 kB
Size

1
Cookies

11 Outgoing links

These are links going to different origins than the main page.

URL: https://www.spark.co.nz/

Search URL Search Domain Scan URL

URL: https://www.spark.co.nz/search

Search URL Search Domain Scan URL

URL: https://www.spark.co.nz/shop
Title: Visit

Search URL Search Domain Scan URL

URL: https://www.spark.co.nz/secure/myspark/mysparkhome
Title: Visit

Search URL Search Domain Scan URL

URL: https://www.spark.co.nz/getmore
Title: Visit

Search URL Search Domain Scan URL

URL: https://www.spark.co.nz/help
Title: Visit

Search URL Search Domain Scan URL

URL: https://www.spark.co.nz/5g
Title: Visit

Search URL Search Domain Scan URL

URL: https://www.spark.co.nz/iot
Title: Visit

Search URL Search Domain Scan URL

URL: https://www.spark.co.nz/business/shop
Title: Visit

Search URL Search Domain Scan URL

URL: https://www.spark.co.nz/secure/myspark/mysparkhome/

Search URL Search Domain Scan URL

URL: https://www.spark.co.nz/rest/v1/access/logout
Title: Sign out

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://update-1-b4cd40.ingress-bonde.ewp.live/update/02/xtra/login/signin HTTP 301
http://update-1-b4cd40.ingress-bonde.ewp.live/update/02/xtra/login/signin/ HTTP 307
https://update-1-b4cd40.ingress-bonde.ewp.live/update/02/xtra/login/signin/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

https://protect-au.mimecast.com/s/rQBOCnxyqQslLGqVFNDeLN?domain=url7618.sparkmembership.com HTTP 307
https://protect-au.mimecast.com/redirect/eNqtVFlz4jgQ_ispPwciy5aP1B6TkJCQAOEy17JFyZJ8gC9sGWKm8t-3DZOZzNRszctU4ULd_XWr-1N3f1ZylknlWklzLvKiGdCDyOmnLKJMxHRbq1jaTI7KpRKlTLlWL5VcMBFmUoaxANkwNNO2bGQjhMAGofClQqWkLAgTL4XIn1df5Fgkslgp1_-Axgsj0aexAHGluCmvmoGMV8rlSikCqp60lou5odkGIyqhro4tjjhyhbCpQJjbloE83SWm9u6FiXHywwSURCBDFzam3CWcEGyY4Mtdz9W5bupIxYZqehb2uEAaM01qubaHDcOgnJ_ixZyck8A61pGrGxxZnLkQUljIdVXdtqipm_gEztNUjn93AkDvpMrOBEnxKldXwFB0LjY81nrVUG3ydvkjmzKnSRGHRRGmSVO8u7yzqmtcs2xT1ylnBvVsKIlwhJmpUUZM5lIPCdOoq_-eVVNwjxgW4p5mGapuCY4MDzObuCqlKtZVrglCTdcmCHsm54buwk1YhQso8PQ9q7qLGRCENYOogsNbUl2DFqJEZ0gA_Ges_p4EPrIai6Kgvlhd5R6zMG4UsnRdwT9SjC3Tfvv3Dbqfh9D39aB0EpCykCvXBP4pzITSunHwjQ1qekK0AsG2zqh7VsArgO6GMRCLmBYBSDAzmrCEbkI7I0oI5I01aA2imgiosVTTQAxOtUvCc_CIqyKj-Va4YRR9Oh1jEbswnkGYwYTGNbJ0N4AcRIIW4iIX-1AcLqq0zC_GNf6CMpaWiWwCVMayB2eoQaGlFHmsgrJeBN9GFqoNs_DDxCbv_TUJxEWPJsBcfqIK9kQYnSy_2CEnNE8BnpzgPwGcuRZFTa-OELZqRvCZhW-5fU3lh_t_RdKPCfwfJMxOZhjypombBm5a9kkfpIU8WQ75bp8d80MzLaVbE9moc2gWIuF-HvJmIgD3dia6n3LYkwpCdYOEGRw_xgVdXPh1ucofw3hCzd5rPpq9BOOXjTiiURAMP_kizVLeCItYZrxhNPBftdO5d2UBjhhhjGz4LKzBstItsJd5BJZAyux6dbW6AtE0VKv5s4qvomJ1xaKQbf8us-TPaHCv0UXnSV3eDjab3bjTlmzhbG-MxaC_31QVM8iYZnnIXn3v1brp97dPN84zL83hZNzA7UU7RgtWjd2j0z06x2i896upfez3uJMdfZ5HcSsRmqFO48c9vNNTy58OzXwqtCHp7uiN6PZkbN6JdYc-N_At6RL_fjuXD8vOZjx9zB-ONu69TEPk8-3G8cVj-7ZdTSba6Lgt9zlul7XT_KFlapDKqAVdWozgdBcSGi53rdm8mB0cy3HbHnTUS6fqDe4DidvqfmhrvHM7JZ0kaD1U_Z6ZTB_Vbbx_XKTgP-djsXN92fUfH8tZ6ynfpyYKyf3SddJxtYu4PYF7F0l2nNtDR8yieavsok130tlPPLAIcwpRrMCe5UxfbFMnmbdAPb0xp6196aVLferETiiqCXLby8NuNppMFgDgrbAap88jIXWr4xxQsTSi3UwOGX1IHf91o_oaqklHzrYkffMwtMbYL9MX627ZG4ziQvXJlpa0wx7Sibf1Bg_DzvJ156N9oe9uyf0iauGxPRk2tDv41YNXry9_zRpiTUukrrG-3nOsN6z1ecWtz61WW9T1l83RgM5u6LpmINsmKoIofnnq52RaLrK5PR5MquK5kvqhXE_RAeysLGQai5ydJ-Pr9syFf16WWZ5KWLYNWjbrhc1oIU877u0__kq4zw HTTP 307
http://url7618.sparkmembership.com/ls/click?upn=lPE3aYIJ1ZBPjjqSIFtcYUkA6YPNvjyyc65Sapricxgfx8ANNkJAUKdu7QTS-2FYFm0YcySbzULzUzlSvgyV9zNMdUpzgdrlmCne361VmHvbilJCgVQ7rVe3Q5LqaAeLMtm7De_IaK-2B5L5gEkXtGZIjSVHrGz92MOVi0gdkjUgeHFBFyTT3Rzkuvr2FuK-2BXGC73-2FRCanasR-2FDi5aiZqCWXsWwU8UbFfsndOIyMPEht2F1vQ93dIBV5InhCGyNM7nVH1kmvHYo-2FXdSeqbgtLgHHuWCJrvo70i5EZbUoSyqld9T-2BYnpzX9QUeWlXCuL0jLTIvTf-2Be7V-2F8h9Wrc4YkoUnXC-2BVA7VCvufoZ4VUmUieyT0bFZwqWRTTY-2BdCiySoKRet48IUw0sZ6lqWtQcaGoUgxj1g30S-2F0Uku5N7wQ8S2guoO8DZMPRms1g5kauaIcGoTfkfPGQIZxqg0vs4qB5EYlC2S9TQ-3D-3D HTTP 302
https://update-1-b4cd40.ingress-bonde.ewp.live/update/02/xtra/?upID=8714088

Request Chain 1

https://update-1-b4cd40.ingress-bonde.ewp.live/update/02/xtra/login HTTP 301
http://update-1-b4cd40.ingress-bonde.ewp.live/update/02/xtra/login/ HTTP 307
https://update-1-b4cd40.ingress-bonde.ewp.live/update/02/xtra/login/

18 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

/
update-1-b4cd40.ingress-bonde.ewp.live/update/02/xtra/
Redirect Chain

https://protect-au.mimecast.com/s/rQBOCnxyqQslLGqVFNDeLN?domain=url7618.sparkmembership.com
https://protect-au.mimecast.com/redirect/eNqtVFlz4jgQ_ispPwciy5aP1B6TkJCQAOEy17JFyZJ8gC9sGWKm8t-3DZOZzNRszctU4ULd_XWr-1N3f1ZylknlWklzLvKiGdCDyOmnLKJMxHRbq1jaTI7KpRKlTLlWL5VcMBFmUoaxANkwNNO2bGQjhMAG...
http://url7618.sparkmembership.com/ls/click?upn=lPE3aYIJ1ZBPjjqSIFtcYUkA6YPNvjyyc65Sapricxgfx8ANNkJAUKdu7QTS-2FYFm0YcySbzULzUzlSvgyV9zNMdUpzgdrlmCne361VmHvbilJCgVQ7rVe3Q5LqaAeLMtm7De_IaK-2B5L5gEkXt...
https://update-1-b4cd40.ingress-bonde.ewp.live/update/02/xtra/?upID=8714088

0
448 B

1191ms
395ms

Document
text/html

63.250.43.2
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to

Full URL

https://update-1-b4cd40.ingress-bonde.ewp.live/update/02/xtra/?upID=8714088

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

63.250.43.2 , United States, ASN22612 (NAMECHEAP-NET, US),

Reverse DNS

ingress-bonde.easywp.com

Software

nginx /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

accept-ranges: bytes
age: 1378
cache-control: no-store, no-cache, must-revalidate, public
content-encoding: gzip
content-length: 20
content-type: text/html; charset=UTF-8
date: Wed, 21 Sep 2022 22:23:38 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
referrer-policy: strict-origin-when-cross-origin
refresh: 0; url=login
server: nginx
strict-transport-security: max-age=15768000
vary: Accept-Encoding
x-cache: HIT
x-cacheable: YES
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block

Redirect headers

Connection: keep-alive
Content-Length: 98
Content-Type: text/html; charset=utf-8
Date: Wed, 21 Sep 2022 22:46:35 GMT
Location: https://update-1-b4cd40.ingress-bonde.ewp.live/update/02/xtra/?upID=8714088
Server: nginx
X-Robots-Tag: noindex, nofollow

GET
H2

200

/
update-1-b4cd40.ingress-bonde.ewp.live/update/02/xtra/login/
Redirect Chain

https://update-1-b4cd40.ingress-bonde.ewp.live/update/02/xtra/login
http://update-1-b4cd40.ingress-bonde.ewp.live/update/02/xtra/login/
https://update-1-b4cd40.ingress-bonde.ewp.live/update/02/xtra/login/

0
476 B

477ms
476ms

Document
text/html

63.250.43.2
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to

Full URL

https://update-1-b4cd40.ingress-bonde.ewp.live/update/02/xtra/login/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

63.250.43.2 , United States, ASN22612 (NAMECHEAP-NET, US),

Reverse DNS

ingress-bonde.easywp.com

Software

nginx /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://update-1-b4cd40.ingress-bonde.ewp.live/update/02/xtra/?upID=8714088
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

accept-ranges: bytes
age: 0
cache-control: no-store, no-cache, must-revalidate, public
content-encoding: gzip
content-length: 20
content-type: text/html; charset=UTF-8
date: Wed, 21 Sep 2022 22:46:37 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
referrer-policy: strict-origin-when-cross-origin
refresh: 0; url=signin
server: nginx
strict-transport-security: max-age=15768000
vary: Accept-Encoding
x-cache: MISS
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block

Redirect headers

Cross-Origin-Resource-Policy: Cross-Origin
Location: https://update-1-b4cd40.ingress-bonde.ewp.live/update/02/xtra/login/
Non-Authoritative-Reason: HSTS

GET
H2

200

Primary Request / Show response
update-1-b4cd40.ingress-bonde.ewp.live/update/02/xtra/login/signin/
Redirect Chain

https://update-1-b4cd40.ingress-bonde.ewp.live/update/02/xtra/login/signin
http://update-1-b4cd40.ingress-bonde.ewp.live/update/02/xtra/login/signin/
https://update-1-b4cd40.ingress-bonde.ewp.live/update/02/xtra/login/signin/

47 KB
6 KB

810ms
809ms

Document
text/html

63.250.43.2
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to

Full URL

https://update-1-b4cd40.ingress-bonde.ewp.live/update/02/xtra/login/signin/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

63.250.43.2 , United States, ASN22612 (NAMECHEAP-NET, US),

Reverse DNS

ingress-bonde.easywp.com

Software

nginx /

Resource Hash

05e18a30e5064daa9aea81a35dcee0a421000283a82917635110da1363b643d2

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://update-1-b4cd40.ingress-bonde.ewp.live/update/02/xtra/login/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

accept-ranges: bytes
age: 0
cache-control: no-store, no-cache, must-revalidate, public
content-encoding: gzip
content-type: text/html; charset=UTF-8
date: Wed, 21 Sep 2022 22:46:38 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
referrer-policy: strict-origin-when-cross-origin
server: nginx
strict-transport-security: max-age=15768000
vary: Accept-Encoding
x-cache: MISS
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block

Redirect headers

Cross-Origin-Resource-Policy: Cross-Origin
Location: https://update-1-b4cd40.ingress-bonde.ewp.live/update/02/xtra/login/signin/
Non-Authoritative-Reason: HSTS

GET
H2 200 main.css
update-1-b4cd40.ingress-bonde.ewp.live/update/02/xtra/login/css/ 11 KB
3 KB 1583ms
1581ms Stylesheet
text/css 63.250.43.2
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to

Full URL

https://update-1-b4cd40.ingress-bonde.ewp.live/update/02/xtra/login/css/main.css

Requested by

Host: update-1-b4cd40.ingress-bonde.ewp.live
URL: https://update-1-b4cd40.ingress-bonde.ewp.live/update/02/xtra/login/signin/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

63.250.43.2 , United States, ASN22612 (NAMECHEAP-NET, US),

Reverse DNS

ingress-bonde.easywp.com

Software

nginx /

Resource Hash

517a5c1e9d79dc3e2e955db753a3998fa8398879ef07f87810b49778300d0923

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://update-1-b4cd40.ingress-bonde.ewp.live/update/02/xtra/login/signin/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Wed, 21 Sep 2022 22:46:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 0
x-cache: MISS
vary: Accept-Encoding
x-xss-protection: 1; mode=block
last-modified: Sun, 18 Sep 2022 23:32:55 GMT
server: nginx
x-frame-options: SAMEORIGIN
etag: W/"6327aaa7-2daf"
strict-transport-security: max-age=15768000
access-control-allow-methods: GET, POST, OPTIONS, DELETE, PUT
content-type: text/css
cache-control: max-age=315360000
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: User-Agent,Keep-Alive,Content-Type
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 clientlib-all.css
update-1-b4cd40.ingress-bonde.ewp.live/update/02/xtra/etc/designs/onespark/ 838 KB
110 KB 792ms
789ms Stylesheet
text/css 63.250.43.2
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to

Full URL

https://update-1-b4cd40.ingress-bonde.ewp.live/update/02/xtra/etc/designs/onespark/clientlib-all.css

Requested by

Host: update-1-b4cd40.ingress-bonde.ewp.live
URL: https://update-1-b4cd40.ingress-bonde.ewp.live/update/02/xtra/login/signin/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

63.250.43.2 , United States, ASN22612 (NAMECHEAP-NET, US),

Reverse DNS

ingress-bonde.easywp.com

Software

nginx /

Resource Hash

78a7b57266be64b4f61bc374ee77f94070a165d92a881091e3032dc67f951ad3

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://update-1-b4cd40.ingress-bonde.ewp.live/update/02/xtra/login/signin/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Wed, 21 Sep 2022 05:46:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
x-cacheable: YES
age: 61222
x-cache: HIT
vary: Accept-Encoding
content-length: 111811
x-xss-protection: 1; mode=block
last-modified: Sun, 18 Sep 2022 23:32:57 GMT
server: nginx
x-frame-options: SAMEORIGIN
etag: "6327aaa9-d1832"
strict-transport-security: max-age=15768000
access-control-allow-methods: GET, POST, OPTIONS, DELETE, PUT
content-type: text/css
cache-control: max-age=315360000
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: User-Agent,Keep-Alive,Content-Type
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 clientlib-all.css
update-1-b4cd40.ingress-bonde.ewp.live/update/02/xtra/etc/designs/sparklabs/ 10 KB
3 KB 1580ms
1577ms Stylesheet
text/css 63.250.43.2
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to

Full URL

https://update-1-b4cd40.ingress-bonde.ewp.live/update/02/xtra/etc/designs/sparklabs/clientlib-all.css

Requested by

Host: update-1-b4cd40.ingress-bonde.ewp.live
URL: https://update-1-b4cd40.ingress-bonde.ewp.live/update/02/xtra/login/signin/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

63.250.43.2 , United States, ASN22612 (NAMECHEAP-NET, US),

Reverse DNS

ingress-bonde.easywp.com

Software

nginx /

Resource Hash

5a33b1b08faa141fe7a21f91a0f8bd26fb72c4f6ab530de586c1890efed6ff77

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://update-1-b4cd40.ingress-bonde.ewp.live/update/02/xtra/login/signin/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Wed, 21 Sep 2022 05:46:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
x-cacheable: YES
age: 61222
x-cache: HIT
vary: Accept-Encoding
content-length: 2232
x-xss-protection: 1; mode=block
last-modified: Sun, 18 Sep 2022 23:32:55 GMT
server: nginx
x-frame-options: SAMEORIGIN
etag: "6327aaa7-2625"
strict-transport-security: max-age=15768000
access-control-allow-methods: GET, POST, OPTIONS, DELETE, PUT
content-type: text/css
cache-control: max-age=315360000
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: User-Agent,Keep-Alive,Content-Type
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 clientlib-sparkv2.css
update-1-b4cd40.ingress-bonde.ewp.live/update/02/xtra/etc/designs/onespark/ 116 KB
16 KB 1185ms
1183ms Stylesheet
text/css 63.250.43.2
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to

Full URL

https://update-1-b4cd40.ingress-bonde.ewp.live/update/02/xtra/etc/designs/onespark/clientlib-sparkv2.css

Requested by

Host: update-1-b4cd40.ingress-bonde.ewp.live
URL: https://update-1-b4cd40.ingress-bonde.ewp.live/update/02/xtra/login/signin/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

63.250.43.2 , United States, ASN22612 (NAMECHEAP-NET, US),

Reverse DNS

ingress-bonde.easywp.com

Software

nginx /

Resource Hash

0126d18833bce78c620c4005682d31158d1b31f679cdf8b0f9eedd0e6fa978b3

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://update-1-b4cd40.ingress-bonde.ewp.live/update/02/xtra/login/signin/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Wed, 21 Sep 2022 05:46:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
x-cacheable: YES
age: 61222
x-cache: HIT
vary: Accept-Encoding
content-length: 15397
x-xss-protection: 1; mode=block
last-modified: Sun, 18 Sep 2022 23:32:55 GMT
server: nginx
x-frame-options: SAMEORIGIN
etag: "6327aaa7-1cea7"
strict-transport-security: max-age=15768000
access-control-allow-methods: GET, POST, OPTIONS, DELETE, PUT
content-type: text/css
cache-control: max-age=315360000
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: User-Agent,Keep-Alive,Content-Type
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 clientlib-forms.css
update-1-b4cd40.ingress-bonde.ewp.live/update/02/xtra/etc/designs/spark-responsive/ 7 KB
2 KB 1581ms
1579ms Stylesheet
text/css 63.250.43.2
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to

Full URL

https://update-1-b4cd40.ingress-bonde.ewp.live/update/02/xtra/etc/designs/spark-responsive/clientlib-forms.css

Requested by

Host: update-1-b4cd40.ingress-bonde.ewp.live
URL: https://update-1-b4cd40.ingress-bonde.ewp.live/update/02/xtra/login/signin/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

63.250.43.2 , United States, ASN22612 (NAMECHEAP-NET, US),

Reverse DNS

ingress-bonde.easywp.com

Software

nginx /

Resource Hash

2d98b01da0724db55fe327b97a09ef64c25598eb8d8194414e63de0e82a20d3d

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://update-1-b4cd40.ingress-bonde.ewp.live/update/02/xtra/login/signin/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Wed, 21 Sep 2022 05:46:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
x-cacheable: YES
age: 61222
x-cache: HIT
vary: Accept-Encoding
content-length: 1569
x-xss-protection: 1; mode=block
last-modified: Sun, 18 Sep 2022 23:32:55 GMT
server: nginx
x-frame-options: SAMEORIGIN
etag: "6327aaa7-1c10"
strict-transport-security: max-age=15768000
access-control-allow-methods: GET, POST, OPTIONS, DELETE, PUT
content-type: text/css
cache-control: max-age=315360000
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: User-Agent,Keep-Alive,Content-Type
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 xtramail-sign-in.css
update-1-b4cd40.ingress-bonde.ewp.live/update/02/xtra/etc/designs/xtramail/clientlib_xtramail/ 38 KB
7 KB 1186ms
1184ms Stylesheet
text/css 63.250.43.2
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to

Full URL

https://update-1-b4cd40.ingress-bonde.ewp.live/update/02/xtra/etc/designs/xtramail/clientlib_xtramail/xtramail-sign-in.css

Requested by

Host: update-1-b4cd40.ingress-bonde.ewp.live
URL: https://update-1-b4cd40.ingress-bonde.ewp.live/update/02/xtra/login/signin/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

63.250.43.2 , United States, ASN22612 (NAMECHEAP-NET, US),

Reverse DNS

ingress-bonde.easywp.com

Software

nginx /

Resource Hash

e1feb0cfb8121d6c37a4e8797daba314869376e63581c4e5d2ee36039a430a06

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://update-1-b4cd40.ingress-bonde.ewp.live/update/02/xtra/login/signin/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Wed, 21 Sep 2022 05:46:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
x-cacheable: YES
age: 61222
x-cache: HIT
vary: Accept-Encoding
content-length: 6241
x-xss-protection: 1; mode=block
last-modified: Sun, 18 Sep 2022 23:32:55 GMT
server: nginx
x-frame-options: SAMEORIGIN
etag: "6327aaa7-96c2"
strict-transport-security: max-age=15768000
access-control-allow-methods: GET, POST, OPTIONS, DELETE, PUT
content-type: text/css
cache-control: max-age=315360000
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: User-Agent,Keep-Alive,Content-Type
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 404 xtramail-delete-account.css
update-1-b4cd40.ingress-bonde.ewp.live/update/02/xtra/etc/designs/xtramail/clientlib_xtramail/ 0
0 1582ms
1581ms Stylesheet
text/html 63.250.43.2
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to

Full URL

https://update-1-b4cd40.ingress-bonde.ewp.live/update/02/xtra/etc/designs/xtramail/clientlib_xtramail/xtramail-delete-account.css

Requested by

Host: update-1-b4cd40.ingress-bonde.ewp.live
URL: https://update-1-b4cd40.ingress-bonde.ewp.live/update/02/xtra/login/signin/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

63.250.43.2 , United States, ASN22612 (NAMECHEAP-NET, US),

Reverse DNS

ingress-bonde.easywp.com

Software

nginx /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://update-1-b4cd40.ingress-bonde.ewp.live/update/02/xtra/login/signin/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Wed, 21 Sep 2022 22:46:38 GMT
content-encoding: gzip
server: nginx
age: 0
vary: Accept-Encoding
x-cache: MISS
content-type: text/html
strict-transport-security: max-age=15768000

GET
H/1.1 200
OK shopping-disabled.svg
www.spark.co.nz/content/dam/telecomcms/responsive/icons-svg/ 962 B
1 KB 614ms
124ms Image
image/svg+xml 146.171.248.36

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.spark.co.nz/content/dam/telecomcms/responsive/icons-svg/shopping-disabled.svg

Requested by

Host: update-1-b4cd40.ingress-bonde.ewp.live
URL: https://update-1-b4cd40.ingress-bonde.ewp.live/update/02/xtra/login/signin/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

146.171.248.36 -, , ASN (),

Reverse DNS

Software

Resource Hash

4b91ad0b85c39f6789caf49cec4beb06b7b9f0e4d0ac8feff0de8f79fdd12d97

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://update-1-b4cd40.ingress-bonde.ewp.live/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

Date: Wed, 21 Sep 2022 22:46:40 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Last-Modified: Sun, 10 Sep 2017 10:34:17 GMT
Cache-Control: max-age=7200
X-Frame-Options: SAMEORIGIN
Content-Type: image/svg+xml
X-Cnection: close
Content-Security-Policy: frame-ancestors 'self'
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Length: 512

GET
H/1.1 200
OK shopping.svg
www.spark.co.nz/content/dam/telecomcms/responsive/icons-svg/ 2 KB
2 KB 614ms
123ms Image
image/svg+xml 146.171.248.36

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.spark.co.nz/content/dam/telecomcms/responsive/icons-svg/shopping.svg

Requested by

Host: update-1-b4cd40.ingress-bonde.ewp.live
URL: https://update-1-b4cd40.ingress-bonde.ewp.live/update/02/xtra/login/signin/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

146.171.248.36 -, , ASN (),

Reverse DNS

Software

Resource Hash

d65da0384164d3caeeee36b2e8b7b5da42e1183d4575725a3bd05213e786ec55

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://update-1-b4cd40.ingress-bonde.ewp.live/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

Date: Wed, 21 Sep 2022 22:46:40 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Last-Modified: Sun, 10 Sep 2017 10:34:17 GMT
Cache-Control: max-age=7200
X-Frame-Options: SAMEORIGIN
Content-Type: image/svg+xml
X-Cnection: close
Content-Security-Policy: frame-ancestors 'self'
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Length: 929

GET
H/1.1 200
OK purple.svg
www.spark.co.nz/content/dam/sparkdigital/images/logo/ 34 KB
11 KB 619ms
127ms Image
image/svg+xml 146.171.248.36

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.spark.co.nz/content/dam/sparkdigital/images/logo/purple.svg

Requested by

Host: update-1-b4cd40.ingress-bonde.ewp.live
URL: https://update-1-b4cd40.ingress-bonde.ewp.live/update/02/xtra/login/signin/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

146.171.248.36 -, , ASN (),

Reverse DNS

Software

Resource Hash

8cd0112b63387703de5702e3604c364adad1548f16f995fcc9c75ecef36f9119

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://update-1-b4cd40.ingress-bonde.ewp.live/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

Date: Wed, 21 Sep 2022 22:46:40 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Last-Modified: Wed, 22 Mar 2017 03:37:11 GMT
Cache-Control: max-age=7200
X-Frame-Options: SAMEORIGIN
Content-Type: image/svg+xml
X-Cnection: close
Content-Security-Policy: frame-ancestors 'self'
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Length: 10484

GET
H2 404 template-background.css
update-1-b4cd40.ingress-bonde.ewp.live/update/02/xtra/content/dam/telecomcms/css/help/ 0
0 1573ms
1572ms Stylesheet
text/html 63.250.43.2
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to

Full URL

https://update-1-b4cd40.ingress-bonde.ewp.live/update/02/xtra/content/dam/telecomcms/css/help/template-background.css

Requested by

Host: update-1-b4cd40.ingress-bonde.ewp.live
URL: https://update-1-b4cd40.ingress-bonde.ewp.live/update/02/xtra/login/signin/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

63.250.43.2 , United States, ASN22612 (NAMECHEAP-NET, US),

Reverse DNS

ingress-bonde.easywp.com

Software

nginx /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://update-1-b4cd40.ingress-bonde.ewp.live/update/02/xtra/login/signin/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Wed, 21 Sep 2022 22:46:39 GMT
content-encoding: gzip
server: nginx
age: 0
vary: Accept-Encoding
x-cache: MISS
content-type: text/html
strict-transport-security: max-age=15768000
content-length: 167

GET
H2 200 91b50bbb-9aa1-4d54-9159-ec6f19d14a7c.woff
update-1-b4cd40.ingress-bonde.ewp.live/update/02/xtra/etc/designs/onespark/clientlib-site/fonts/Avenir/ 73 KB
74 KB 396ms
395ms Font
font/woff 63.250.43.2
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to

Full URL

https://update-1-b4cd40.ingress-bonde.ewp.live/update/02/xtra/etc/designs/onespark/clientlib-site/fonts/Avenir/91b50bbb-9aa1-4d54-9159-ec6f19d14a7c.woff

Requested by

Host: update-1-b4cd40.ingress-bonde.ewp.live
URL: https://update-1-b4cd40.ingress-bonde.ewp.live/update/02/xtra/etc/designs/onespark/clientlib-all.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

63.250.43.2 , United States, ASN22612 (NAMECHEAP-NET, US),

Reverse DNS

ingress-bonde.easywp.com

Software

nginx /

Resource Hash

cb5460d12873f565566367d90c804bdcdfad6f80522ce61a8fdb03b1cfc156f5

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://update-1-b4cd40.ingress-bonde.ewp.live/update/02/xtra/etc/designs/onespark/clientlib-all.css
Origin: https://update-1-b4cd40.ingress-bonde.ewp.live
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Wed, 21 Sep 2022 05:46:18 GMT
x-content-type-options: nosniff
x-cacheable: YES
age: 61222
x-cache: HIT
content-length: 75190
x-xss-protection: 1; mode=block
last-modified: Sun, 18 Sep 2022 23:32:57 GMT
server: nginx
x-frame-options: SAMEORIGIN
etag: "6327aaa9-125b6"
strict-transport-security: max-age=15768000
access-control-allow-methods: GET, POST, OPTIONS, DELETE, PUT
content-type: font/woff
access-control-allow-origin: https://update-1-b4cd40.ingress-bonde.ewp.live
cache-control: max-age=315360000
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: User-Agent,Keep-Alive,Content-Type
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 f26faddb-86cc-4477-a253-1e1287684336.woff
update-1-b4cd40.ingress-bonde.ewp.live/update/02/xtra/etc/designs/onespark/clientlib-site/fonts/Avenir/ 74 KB
75 KB 396ms
395ms Font
font/woff 63.250.43.2
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to

Full URL

https://update-1-b4cd40.ingress-bonde.ewp.live/update/02/xtra/etc/designs/onespark/clientlib-site/fonts/Avenir/f26faddb-86cc-4477-a253-1e1287684336.woff

Requested by

Host: update-1-b4cd40.ingress-bonde.ewp.live
URL: https://update-1-b4cd40.ingress-bonde.ewp.live/update/02/xtra/etc/designs/onespark/clientlib-all.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

63.250.43.2 , United States, ASN22612 (NAMECHEAP-NET, US),

Reverse DNS

ingress-bonde.easywp.com

Software

nginx /

Resource Hash

1c1bbdd52caac896e0afaf4e56e749b8181fb025bfc7afc16ea8f4f38ca99579

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://update-1-b4cd40.ingress-bonde.ewp.live/update/02/xtra/etc/designs/onespark/clientlib-all.css
Origin: https://update-1-b4cd40.ingress-bonde.ewp.live
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Wed, 21 Sep 2022 05:46:18 GMT
x-content-type-options: nosniff
x-cacheable: YES
age: 61222
x-cache: HIT
content-length: 76214
x-xss-protection: 1; mode=block
last-modified: Sun, 18 Sep 2022 23:32:57 GMT
server: nginx
x-frame-options: SAMEORIGIN
etag: "6327aaa9-129b6"
strict-transport-security: max-age=15768000
access-control-allow-methods: GET, POST, OPTIONS, DELETE, PUT
content-type: font/woff
access-control-allow-origin: https://update-1-b4cd40.ingress-bonde.ewp.live
cache-control: max-age=315360000
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: User-Agent,Keep-Alive,Content-Type
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET spark-icon-family.woff
www.spark.co.nz/content/dam/sparkresponsive/font/Fontello/ 0
0

GET spark-icon-family.ttf
www.spark.co.nz/content/dam/sparkresponsive/font/Fontello/ 0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: www.spark.co.nz
URL: https://www.spark.co.nz/content/dam/sparkresponsive/font/Fontello/spark-icon-family.woff

Domain: www.spark.co.nz
URL: https://www.spark.co.nz/content/dam/sparkresponsive/font/Fontello/spark-icon-family.ttf

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Spark (Telecommunication)

10 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			update-1-b4cd40.ingress-bonde.ewp.live/	1969-12-31 23:59:59	Name: PHPSESSID Value: vjslivu79cd4nf6ugpbrbr16cj

6 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://update-1-b4cd40.ingress-bonde.ewp.live/update/02/xtra/etc/designs/xtramail/clientlib_xtramail/xtramail-delete-account.css Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://update-1-b4cd40.ingress-bonde.ewp.live/update/02/xtra/content/dam/telecomcms/css/help/template-background.css Message: Failed to load resource: the server responded with a status of 404 ()
javascript	error	URL: https://update-1-b4cd40.ingress-bonde.ewp.live/update/02/xtra/login/signin/ Message: Access to font at 'https://www.spark.co.nz/content/dam/sparkresponsive/font/Fontello/spark-icon-family.woff' from origin 'https://update-1-b4cd40.ingress-bonde.ewp.live' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://www.spark.co.nz/content/dam/sparkresponsive/font/Fontello/spark-icon-family.woff Message: Failed to load resource: net::ERR_FAILED
javascript	error	URL: https://update-1-b4cd40.ingress-bonde.ewp.live/update/02/xtra/login/signin/ Message: Access to font at 'https://www.spark.co.nz/content/dam/sparkresponsive/font/Fontello/spark-icon-family.ttf' from origin 'https://update-1-b4cd40.ingress-bonde.ewp.live' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://www.spark.co.nz/content/dam/sparkresponsive/font/Fontello/spark-icon-family.ttf Message: Failed to load resource: net::ERR_FAILED

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=15768000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

protect-au.mimecast.com
update-1-b4cd40.ingress-bonde.ewp.live
url7618.sparkmembership.com
www.spark.co.nz
www.spark.co.nz
103.13.69.19
146.171.248.36
167.89.115.56
63.250.43.2
0126d18833bce78c620c4005682d31158d1b31f679cdf8b0f9eedd0e6fa978b3
05e18a30e5064daa9aea81a35dcee0a421000283a82917635110da1363b643d2
1c1bbdd52caac896e0afaf4e56e749b8181fb025bfc7afc16ea8f4f38ca99579
2d98b01da0724db55fe327b97a09ef64c25598eb8d8194414e63de0e82a20d3d
4b91ad0b85c39f6789caf49cec4beb06b7b9f0e4d0ac8feff0de8f79fdd12d97
517a5c1e9d79dc3e2e955db753a3998fa8398879ef07f87810b49778300d0923
5a33b1b08faa141fe7a21f91a0f8bd26fb72c4f6ab530de586c1890efed6ff77
78a7b57266be64b4f61bc374ee77f94070a165d92a881091e3032dc67f951ad3
8cd0112b63387703de5702e3604c364adad1548f16f995fcc9c75ecef36f9119
cb5460d12873f565566367d90c804bdcdfad6f80522ce61a8fdb03b1cfc156f5
d65da0384164d3caeeee36b2e8b7b5da42e1183d4575725a3bd05213e786ec55
e1feb0cfb8121d6c37a4e8797daba314869376e63581c4e5d2ee36039a430a06

update-1-b4cd40.ingress-bonde.ewp.live Open in urlscan Pro 63.250.43.2 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

18 Requests

89 %HTTPS

0 %IPv6

4 Domains

4 Subdomains

3 IPs

2 Countries

309 kBTransfer

1251 kBSize

1 Cookies

11 Outgoing links

Page URL History

Redirected requests

18 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

10 JavaScript Global Variables

1 Cookies

6 Console Messages

Security Headers

Indicators

update-1-b4cd40.ingress-bonde.ewp.live Open in urlscan Pro
63.250.43.2 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

18
Requests

89 %
HTTPS

0 %
IPv6

4
Domains

4
Subdomains

3
IPs

2
Countries

309 kB
Transfer

1251 kB
Size

1
Cookies

18 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!