Security Scan: Bitwarden Web vault

Summary

API

This view is built from:

Scan result: counts, verdicts, details, IPs, technologies, hashes/api/v1/result/16f0f54d-96d6-48cf-8d4a-51c9bd317f85 Domain and IP registration (RDAP)/api/v1/rdap/16f0f54d-96d6-48cf-8d4a-51c9bd317f85How often this domain was scanned/api/v1/domain/stats/vault.dev.bitwarden-gov.com Scan history for this domain/api/v1/domain/history/vault.dev.bitwarden-gov.com?limit=15

This website contacted 1 IP in 1 country across 1 domain to perform 16 HTTP transactions. The main domain is bitwarden-gov.com and was registered 6 months ago.

Submitted URL: https://vault.dev.bitwarden-gov.com

Effective URL:

https://vault.dev.bitwarden-gov.com/#/login

Redirected

AI Security Verdict

Confirmed Scam

Confidence: 95%

Risk Score

Look-alike bitwarden-gov.com host clones the Bitwarden vault login and asks for email plus master password. Brand impersonation plus credential harvesting — do not enter any credentials.

Risk Factors (4)

Brand impersonation of Bitwarden on a look-alike domain

Credential form capturing a master password (highest-value secret in a password manager)

Deceptive hostname combining the brand with '-gov'

No legitimate relationship to the impersonated vendor; unranked, recently registered domain

Domain age information unavailable

Details

Page Title

Bitwarden Web vault

Scan Type

public

Favicon Hash

MMH3: 464737924

MD5: b071172979419bb7d7b0591409b952dd

Domain Name Analysis

The domain name 'vault.dev.bitwarden-gov.com' uses the commercial generic top-level domain (.com) with subdomain 'vault.dev'. Its registrable label 'bitwarden-gov' stretches across 13 characters split between four vowels and 8 consonants, plus one hyphen. Word splitting yields three words: bit, warden, gov. Median word length is three characters. No strong language cues emerged from the frequency lists.

Screenshot

U bitwarden Log in to Bitwarden Email address* O Remember email or ( & Log in with passkey ) ( ® Use single sign-on | VL New to Bitwarden? Create account Accessing: vault.dev.bitwarden-gov.co...

Page Load Overview

4.67s

Total Load Time

6.0 MB

Total Size

Language Analysis

Primary Language

🇺🇸English

Code: en

Confidence:80%

Script:Latin

Direction:ltr

Detection Details

HTML Lang Attribute:en

Text Length:307 chars

Detector Agreement:50%

Website Classification

Primary Category

government public service53% confidence

Type: dynamic

Method: ml+structural

All Detected Categories

government public service

53%

technology software

39%

documentation technical

34%

cryptocurrency blockchain

32%

corporate business

27%

Detected Features

No structural features detected

Domain & IP Information

Requests	IP Address	Location	AS Autonomous System
16	150.171.109.107Azure · CLOUD	United States	AS8075Microsoft Corporation
16	1	-	-

Detected Technologies5

100%

50%

40%

40%

40%

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T16743FAF01B2421FD0DD387AEBF387593A31EA1E9FA6E8CC0B25E465436D3952CA57940

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

768:NjnCZyiBYVj17viiBPopi5xoJbGad8nf1ivGeIdDU4f/J1k2:NjCZyYMKYMJb9886U4fB1X

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:57743:AYrAnFcHj9YAAXKKMBgAyIqECABSCHRgOmBLSGAySScASYBEGDEBIyCASBECLlMIy5AGM3KoEQIQgDmhDh6sCQLkZNE0AJAd

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:7fe7ffe7e7ff7e24

Perceptual Hash:b3e38dcd2215998d

Difference Hash:880c184d4c28cccc

Wavelet Hash:43c3e3e3c7c63c24

Color Hash:N/A

Other Hashes

Crop Resistant:880c184d4c28cccc

Scan History

Scan history not available

Unable to load historical scan data

Security Scan Report: vault.dev.bitwarden-gov.com