Mail.qaya.co.uk presents itself as an Outlook webmail login, but the site lacks basic transparency. There is no company name, no contact information, and no privacy policy — all things you'd expect from a legitimate email provider, even a business-hosted one. While the technology behind the site is secure (valid SSL, fast loading), the absence of any identity signals is a major concern. For any site that handles passwords, knowing who you're giving your credentials to is essential. Without that, there is a real risk of phishing or credential theft. If you've received a link to this login page, your safest bet is to contact the company directly using a known phone number or email address — not the one on this page — to verify if this is their legitimate mail server. As always, be wary of unsolicited login pages.
No — mail.qaya.co.uk doesn't look safe
In plain English
Mail.qaya.co.uk is risky to use for logging into email. There's no way to find out who runs it, no contact info, and no privacy policy. While the technical security is okay, the lack of transparency is a major warning sign for a login page.
What you should do now
Don't panic. These steps limit the damage, and the sooner you take them the better.
Don't enter any details
No passwords, card numbers or personal information — even if the site looks professional.
Close the tab
Especially if you got here from an email, text message or social media ad.
Already paid? Call your bank
Contact your bank or card provider right away. They can often stop or reverse a recent payment.
Warn others
Report the site and share this check with anyone who sent you the link.
Where the score comes from
The site has a valid SSL certificate and modern encryption, which is good. But it doesn't set all the browser protections you'd expect from a secure login page, like headers that prevent clickjacking or enforce encrypted connections.
There is no way to tell who runs this site. The domain is a subdomain, and the WHOIS lookup failed to return any owner details. No company name or about page is provided, which is a serious gap for a site that asks for login credentials.
The site isn't on any blacklists, but it has no history in the Wayback Machine and no online reviews. That means there's no track record to judge whether it's trustworthy or not.
The homepage offers no contact information, no social media links, and no about page. For a website that handles logins, that's a significant red flag — legitimate services give you a way to reach them.
Missing privacy policy and terms of service is a problem for any site collecting email and password data. Even if this is a business email portal, users have a right to know how their data will be used.
The site loads quickly and the server is properly configured with some security features like Content Security Policy. However, it lacks DNSSEC and the sitemap is broken, which are minor issues.
What we checked
Think this verdict is wrong?
Site owners can request a fresh scan. Scores update automatically as signals change.