Security Scan Report: hacomono-1password-scim.com

Redirected to:
https://hacomono-1password-scim.com/app/login
Site favicon
Submitted: Completed: publiccompleted
This website contacted 1 IP in 1 country across 1 domain to perform 7 HTTP transactions. The main domain is hacomono-1password-scim.com and was registered 4 years 8 months ago.

Submitted URL: https://hacomono-1password-scim.com

Effective URL:
https://hacomono-1password-scim.com/app/login
Redirected

AI Security Verdict

Moderate Risk

Confidence: 60%

5
Risk Score

Aged third-party domain serving a bare '1Password SCIM bridge' bearer-token prompt. No threat-intel, hunting rule, IDS or exfiltration evidence, and the pattern matches a self-hosted SCIM bridge, but branding on an unofficial domain and the orphan password field warrant caution.

Risk Factors (4)
Third-party domain contains the 1Password brand name without being an official 1Password domain, and the page reproduces 1Password branding with no ownership disclosure
Password-style field presented without a username field — a pattern consistent with token harvesting, though also consistent with a self-hosted SCIM bridge bearer-token prompt
No identifiable operator, contact, legal or documentation pages on the page to confirm this is a sanctioned self-hosted deployment
Domain absent from Cisco Umbrella top 1M and weak overall legitimacy signals
Safety Factors (4)
Domain age of roughly 4.7 years is inconsistent with throwaway phishing infrastructure
No Indicators of Compromise, no hunting rule malware matches, no IDS alerts, no Safe Browsing hit
No credential exfiltration, no cross-origin form submission, no obfuscated or anti-analysis JavaScript detected
Bearer-token-only authentication is the documented behaviour of a self-hosted 1Password SCIM bridge, which customers run on their own domains
Domain age information unavailable

Details

Page Title

1Password SCIM bridge

Scan Type

public

Domain Name Analysis

Within the commercial generic top-level domain (.com), 'hacomono-1password-scim.com' is registered with no subdomain. The registrable portion 'hacomono-1password-scim' spans 23 characters with seven vowels and 13 consonants, plus one digit and 2 hyphens. Breaking it apart gives six words: haco, mono, 1, password, s, cim. The median word length lands at 3.5 characters. No strong language cues emerged from the frequency lists.

Screenshot

1Password SCIM bridge Bearer Token

Page Load Overview

2.63s
Total Load Time
229 KB
Total Size

Language Analysis

Primary Language

🇺🇸English
Code: en
Confidence:60%
Script:Latin
Direction:ltr

Detection Details

Text Length:125 chars
Detector Agreement:100%

Website Classification

Primary Category

technology software58% confidence
Type: static
Method: ml+structural

All Detected Categories

technology software
58%
cryptocurrency blockchain
28%

Detected Features

No structural features detected

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
734.84.52.123Google · CDNTokyo, Tokyo, Japan
AS396982Google LLC
71--

Detected Technologies1

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T16A3273CE23141EBDB8B787D9EB9172B43129067BDA657328D9320578424D29CAC3BCD2

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

192:61/X3XTXLQdnGmcGeu7TJdEfLQsDq3knmh9xJOjsZ69LrpZ+O:OfzcdnU07FdcFDJmhE7ppZ7

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:11730:BuQiF4igGeNQAdYVgDWHCCURzJBQQAMVEThyMsKQoC4gwlGk3YCEOA1QEGACgBCjEBAYCgTJLCzIRQIQAQLWISI+a4A6DAFK

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:efffcbc7c7ffefff
Perceptual Hash:b331ccce3331cccc
Difference Hash:1028525a4a300800
Wavelet Hash:c0fcc8c0c0f0fcfc
Color Hash:07001000180

Other Hashes

Crop Resistant:1028525a4a300800

Scan History

Scan history not available

Unable to load historical scan data