Is login.salesforce.com safe?

The scan of login.salesforce.com on 20 Aug 2026 reached no verdict either way (score -2). Too little was captured to judge it, which is an unknown rather than a pass.

What malware is associated with login.salesforce.com?

1 analysed samples communicate with this URL, including Sivis.

How was login.salesforce.com checked?

A static pass resolved DNS, captured TLS and headers and followed the redirect chain, and where the fast tier allows, a headless browser rendered the page and recorded every request. Egress is SSRF-locked. Signatures that matched only page text are weighted far below one that matched a served file, because a page documenting malware matches the same rules.

login.salesforce.com - URL scan, 20 Aug 2026

MalwareAnalyzer by Cyble scanned login.salesforce.com and returned a unknown verdict (score -2), categorised as credential-harvest. The page resolved to 104.161.183.2 on SalesForce.com, Inc. in JP. The domain was registered 10123 days ago through MarkMonitor Inc.. 4 domains and 1 IP were contacted, over 4 HTTP requests. 1 malware sample communicates with this URL (Sivis). This is a point-in-time observation from 20 Aug 2026; the page may have changed since.

Scan result

Verdict: unknown (score -2) · Confidence 8%
Scanned URL: https://login.salesforce.com/
Domain: login.salesforce.com · IP: 104.161.183.2 · AS14340 · JP
Page title: Login | Salesforce
HTTP status: 200 · text/html; charset=UTF-8
Registrar: MarkMonitor Inc. · domain age 10123 days · created 1998-12-02
TLS issuer: C=US, O=DigiCert Inc, CN=DigiCert Global G2 TLS RSA SHA256 2020 CA1 · valid to Jan 18 23: · subject C=US, ST=California, L=San Francisco, O=Salesforce, Inc., CN=it4.login.salesforce.com
Evidenced operator: Salesforce, Inc.
HTTP requests captured: 4
Scan tier: fast · observed 2026-08-20 16:52:22 UTC

Malware communicating with this URL (1)

These samples were observed contacting or being served from login.salesforce.com. Each links to its full analysis.

Sivis - referenced · 4001ff2f73ee327ddbab1bd09e4614be · first seen 2026-08-20

Antivirus & YARA (0 of 47 engines)

No engine flagged this page's content.

Why this verdict

Valid TLS, no impersonation or off-origin credential post
Credential-harvesting form

Contacted infrastructure

104.161.183.2 - AS14340 SalesForce.com, Inc. (Japan)

Observed indicators

login.salesforce.com
welcome.salesforce.com
www.salesforce.com
c.salesforce.com
104.161.183.2
https://login.salesforce.com/
https://login.salesforce.com/css/sfdc_210.css?v=7
https://login.salesforce.com/jslibrary/SfdcSessionBase208.js
https://login.salesforce.com/jslibrary/LoginHint208.js
https://login.salesforce.com/?locale=us
https://login.salesforce.com/?locale=nb-no
https://login.salesforce.com/?locale=de
https://login.salesforce.com/?locale=tw
https://login.salesforce.com/?locale=ru
https://login.salesforce.com/?locale=fi
https://login.salesforce.com/?locale=jp
https://login.salesforce.com/?locale=fr
https://login.salesforce.com/?locale=br
https://login.salesforce.com/?locale=se
https://login.salesforce.com/?locale=uk

Questions about login.salesforce.com

Is login.salesforce.com safe?: The scan of login.salesforce.com on 20 Aug 2026 reached no verdict either way (score -2). Too little was captured to judge it, which is an unknown rather than a pass.
What malware is associated with login.salesforce.com?: 1 analysed samples communicate with this URL, including Sivis.
How was login.salesforce.com checked?: A static pass resolved DNS, captured TLS and headers and followed the redirect chain, and where the fast tier allows, a headless browser rendered the page and recorded every request. Egress is SSRF-locked. Signatures that matched only page text are weighted far below one that matched a served file, because a page documenting malware matches the same rules.

Scanned at the fast tier - see how URL scanning works.

Scan another URL · Latest analyzed threats · All scans of login.salesforce.com

Scanned on MalwareAnalyzer by Cyble · Open interactive scan