ScanMalware.com

Security Scan Report: 1password-sign-in-accounts.pages.dev

Site favicon
Submitted: Sep 25, 2026, 1:41:07 PMCompleted: Sep 25, 2026, 1:41:40 PMpubliccompleted

AI Security Verdict

Moderate Risk

Confidence: 65%

5
Risk Score

Fake 1Password sign-in page on an unranked pages.dev subdomain. No form here, but its only 'Sign In' link points to a different throwaway host — treat as a possible multi-step phishing lure and avoid entering any 1Password credentials.

Risk Factors (4)
Brand impersonation: 1Password sign-in branding on a domain that is not 1password.com
Sole CTA funnels visitors to a different disposable hosting namespace (login-now.pages.dev) instead of the official service
Deceptive hostname '1password-sign-in-accounts' engineered to look like an official 1Password account portal
Unranked subdomain on a free instant-publish platform; page age cannot be verified
Safety Factors (5)
No credential, password, or payment form detected on the scanned page (verified DOM form counts all zero)
No Indicators of Compromise matched against the page or its resources
No JavaScript malware (YARA) patterns and no behavioral exfiltration signals
Suricata alerts are informational DNS/TLS observations about the pages.dev platform, not attack traffic
Content is informational/explanatory text about 1Password sign-in rather than a live harvesting interface
Domain age information unavailable

Details

Page Title

1Password Sign In – Easy & Secure Access to Your Vault

Scan Type

public

Domain Name Analysis

Domain '1password-sign-in-accounts.pages.dev' uses the developer-focused generic top-level domain (.dev); it also runs on subdomain '1password-sign-in-accounts'. Count 5 characters in 'pages' with 2 vowels and three consonants. Splitting it apart reveals one word: pages. The median word length lands at five characters. No strong language cues emerged from the frequency lists.

Screenshot

Security scan screenshot of https://1password-sign-in-accounts.pages.dev

Page Load Overview

0.18s
Total Load Time
7 KB
Total Size

Language Analysis

Primary Language

🇺🇸English
Code: en
Confidence:80%
Script:Latin
Direction:ltr

Detection Details

HTML Lang Attribute:en
Text Length:5,701 chars
Detector Agreement:100%

Website Classification

Primary Category

technology software86% confidence
Type: static
Method: ml+structural

All Detected Categories

technology software
86%
government public service
38%
education learning
34%
documentation technical
28%
cryptocurrency blockchain
28%

Detected Features

No structural features detected

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
1172.66.44.75Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
1172.66.47.181Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
22--

Detected Technologies3

HTTP/3
40%
Cloudflare Bot Management
40%
Cloudflare
40%

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T15702940F925518064A534296BB2107BB7325DC0B668707A53EFAD22CBF367235B736CA

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

192:hqIgJFe9vsiVwSHYC6ic1nVP63sr80xXyziF4:hqIgJF+h9c1nwshb4

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:8976:M8iA0SSTSJAUPVIZmS0EE8JBa1RahYIBiYQRIQjkCAKAQCwkwPABMEICVcAI2AAEQqCSA2QAQ3XwQaMJBNFgquIkMxBfCAaE

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:00ffffffffffffff
Perceptual Hash:b84f4b0b2a3a3a3b
Difference Hash:710696969c969c9e
Wavelet Hash:00c6c3c3cfc3cfc3
Color Hash:#783a62

Other Hashes

Crop Resistant:710696969c969c9e,55f55b5b585a524c,02210d3133300500

Scan History

Scan history not available

Unable to load historical scan data