Is vault.outlooktax.com safe?

No. MalwareAnalyzer scanned vault.outlooktax.com on 20 Aug 2026 and returned a malicious verdict with a score of 95 out of 100, categorised as phishing. Treat it as hostile until it is re-checked.

How was vault.outlooktax.com checked?

A static pass resolved DNS, captured TLS and headers and followed the redirect chain, and where the standard tier allows, a headless browser rendered the page and recorded every request. Egress is SSRF-locked. Signatures that matched only page text are weighted far below one that matched a served file, because a page documenting malware matches the same rules.

vault.outlooktax.com - malicious URL scan, 20 Aug 2026

MalwareAnalyzer by Cyble scanned vault.outlooktax.com and returned a malicious verdict (score 95), categorised as phishing. The page resolved to 172.67.222.228 on Cloudflare, Inc. in US. The domain was registered 3321 days ago through Cloudflare, Inc.. 1 domain and 1 IP were contacted, over 19 HTTP requests. This is a point-in-time observation from 20 Aug 2026; the page may have changed since.

Scan result

Verdict: malicious (score 95) · Confidence 100%
Scanned URL: https://vault.outlooktax.com/
Domain: vault.outlooktax.com · IP: 172.67.222.228 · AS13335 · US
Server: cloudflare
Page title: Vaultwarden Web
HTTP status: 200 · text/html; charset=utf-8
Registrar: Cloudflare, Inc. · domain age 3321 days · created 2017-07-17
TLS issuer: C=US, O=Google Trust Services, CN=WE1 · valid to Oct 19 21: · subject CN=outlooktax.com
HTTP requests captured: 19
Scan tier: standard · observed 2026-08-20 16:46:19 UTC

Antivirus & YARA (3 of 47 engines)

YARA: delivr.to detections [yara]: DLV_HTML_Smuggling (page content)
YARA: ReversingLabs [yara]: RL_RedLine_Stealer (page content)
YARA: Yara-Rules community [yara]: YR_AntiVM_Sandbox (page content)

Why this verdict

3 antivirus/YARA engines flagged the page content: DLV_HTML_Smuggling, RL_RedLine_Stealer, YR_AntiVM_Sandbox
Domain impersonates outlook (combosquat)

Detected technologies

Cloudflare

Contacted infrastructure

172.67.222.228 - AS13335 Cloudflare, Inc. (United States)

Observed indicators

vault.outlooktax.com
172.67.222.228
https://vault.outlooktax.com/
https://vault.outlooktax.com/images/apple-touch-icon.png
https://vault.outlooktax.com/images/favicon-32x32.png
https://vault.outlooktax.com/images/favicon-16x16.png
https://vault.outlooktax.com/images/safari-pinned-tab.svg
https://vault.outlooktax.com/cca56971e438d22818d6.json
https://vault.outlooktax.com/theme_head.6991036cc6ce1ab5eee1.js
https://vault.outlooktax.com/styles.e0d917251059d9b7ecdc.css
https://vault.outlooktax.com/css/vaultwarden.css
https://vault.outlooktax.com/app/polyfills.17d66214ebf3b773befe.js
https://vault.outlooktax.com/app/vendor.80483f0813b2a0b605c5.js
https://vault.outlooktax.com/app/main.315b37140f687b534696.js
https://vault.outlooktax.com/styles.31d6cfe0d16ae931b73c.js

Questions about vault.outlooktax.com

Is vault.outlooktax.com safe?: No. MalwareAnalyzer scanned vault.outlooktax.com on 20 Aug 2026 and returned a malicious verdict with a score of 95 out of 100, categorised as phishing. Treat it as hostile until it is re-checked.
How was vault.outlooktax.com checked?: A static pass resolved DNS, captured TLS and headers and followed the redirect chain, and where the standard tier allows, a headless browser rendered the page and recorded every request. Egress is SSRF-locked. Signatures that matched only page text are weighted far below one that matched a served file, because a page documenting malware matches the same rules.

Scanned at the standard tier - see how URL scanning works.

Scan another URL · Latest analyzed threats · All scans of vault.outlooktax.com

Scanned on MalwareAnalyzer by Cyble · Open interactive scan