Security Scan Report: balances.web.vanguard.com

Redirected to:
https://login.vanguard.com/login?state=hKFo2SBaLS10dkxwcDdYTXhYMmRVUmZ...
Site favicon
Submitted: Sep 24, 2026, 3:34:29 AMCompleted: Sep 24, 2026, 3:35:52 AMpubliccompleted

This website contacted 155 IPs in 4 countries across 83 domains to perform 575 HTTP transactions. The main domain is login.vanguard.com and was registered 18 years ago.

Submitted URL: https://balances.web.vanguard.com

Effective URL:

https://login.vanguard.com/login?state=hKFo2SBaLS10dkxwcDdYTXhYMmRVUmZ...
Redirected

The Cisco Umbrella rank of the primary domain is #30,818 of the top 1 million websites

AI Security Verdict

Safe Website

Confidence: 96%

0
Risk Score

Official Vanguard login page on vanguard.com. Established domain, legitimate SSO flow, no threat-intel, malware, or phishing indicators. Safe to use.

Safety Factors
Official Vanguard domain and branding
Well-established domain registered in 1995
Legitimate SSO authentication flow detected
No threat intelligence matches
No credential exfiltration detected
Domain age information unavailable

Details

Page Title

Log on to vanguard.com - personal investors

Scan Type

public

Domain Name Analysis

Within the commercial generic top-level domain (.com), 'balances.web.vanguard.com' is registered with subdomain 'balances.web'. Count 8 characters in 'vanguard' containing 3 vowels alongside 5 consonants. Tokenizing the label suggests 1 word: vanguard. No strong language cues emerged from the frequency lists.

Screenshot

Security scan screenshot of https://balances.web.vanguard.com

Page Load Overview

24.94s
Total Load Time
8.5 MB
Total Size

Language Analysis

Primary Language

🇺🇸English
Code: en
Confidence:80%
Script:Latin
Direction:ltr

Detection Details

HTML Lang Attribute:en
Text Length:3,923 chars
Detector Agreement:100%

Website Classification

Primary Category

technology software30% confidence
Type: spa
Method: ml+structural

All Detected Categories

technology software
30%
social_media
25%

Detected Features

Login Form
Search

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
11323.36.162.213Akamai · CDNFrankfurt am Main, Hesse, Germany
AS20940Akamai International B.V.
323.36.162.202Akamai · CDNFrankfurt am Main, Hesse, Germany
AS20940Akamai International B.V.
33.161.82.25Cloudfront · CDNUnited States
AS16509Amazon.com, Inc.
323.36.162.214Akamai · CDNFrankfurt am Main, Hesse, Germany
AS20940Akamai International B.V.
352.222.136.85Cloudfront · CDNUnited States
AS16509Amazon.com, Inc.
33.174.46.63Cloudfront · CDNUnited States
AS16509Amazon.com, Inc.
33.174.46.104Cloudfront · CDNUnited States
AS16509Amazon.com, Inc.
318.66.147.126Cloudfront · CDNUnited States
AS16509Amazon.com, Inc.
33.161.82.74Cloudfront · CDNUnited States
AS16509Amazon.com, Inc.
323.36.162.219Akamai · CDNFrankfurt am Main, Hesse, Germany
AS20940Akamai International B.V.
575155--

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T1960120A3C8508C0BF7319B52DFA371088456F7D9CD5AA840B9CD421D2E807C7895345C

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

24:hRY+K6uriUwD10o+Fs531Rctd1kRtSX+SX5s9G:TBKLmLD10o++VIdmvDMs8

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:785:AAAAAAAAGAAAAAAAAAAAAAoAAAAAAAAAgAAAAAAAAAAAACAAAAAAAAIAAAABgAIAAAAAAAQBAgAAAAAAADAAAAAAAgAAAAAV

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:ffffffffffff0000
Perceptual Hash:b2b50b8fa7268939
Difference Hash:683c960e081681c9
Wavelet Hash:3fffcfe7e7000000
Color Hash:#c59287

Other Hashes

Scan History

Scan history not available

Unable to load historical scan data