Domain
bitwarden.com
Aggregated from public BGP, CT logs, our scan layer, honeypots and global probes.
Run a live full scan of bitwarden.com
On-demand: ports, banners, TLS, tech-stack, subdomains and origin/IP-leak detection. Results are shared publicly for everyone to link to.
Hosting IPs
—
A/AAAA targets
Subdomains
—
CT + scan + body
Record Types
—
seen in DNS
Observed Certs
—
in our scans
DNS Records
A
151.101.1.91, 151.101.129.91, 151.101.193.91, 151.101.65.91
AAAA
—
MX
1 aspmx.l.google.com, 10 alt3.aspmx.l.google.com, 10 alt4.aspmx.l.google.com, 5 alt1.aspmx.l.google.com, 5 alt2.aspmx.l.google.com
NS
igor.ns.cloudflare.com, rose.ns.cloudflare.com
TXT
6e81d67c-d407-4e9f-bf25-3372f01f3e9c, MS=C8E6AF80F5B0DD0B5AD483EDFDB8C55CB3A9B468, MS=ms10313433, OOSSRH-94202, anthropic-domain-verification-ce78r2=C3El56QZ4UekFLhM2BhH1Vcr7, atlassian-domain-verification=8wc47B5qEzmZSWU3FaWKd6EzPpPeW33aqHzS5Go1iZwceU4RHIAg8m825izy4gvE, brave-ledger-verification=f8b96f2d0f5fd1db7ac8753f8d38b219911e5d32b0f955537479416ac5f53a20, bw=Qa/t9YOKsFsU9/qhVNesyup0byKExijKNhGjcj9N9lLB
CNAME
—
CAA
—
WHOIS / Registration
Registration data planned
Registrar, creation/expiry dates and domain status via RDAP. Rolling out gradually — bulk WHOIS is rate-limited, so we resolve on a prioritized cadence.
Subdomains
Subdomain enumeration pending
Every subdomain ever issued a TLS cert under this apex — extracted from Certificate Transparency logs, our own scan observations and body references.
Tech Stack
Tech detection pending
Wappalyzer-rules detect CMS, frameworks, analytics, JS libs and server-side languages on this domain.
TLS Certificates
Subject: notifications.bitwarden.com
Issuer: YE2
SANs: notifications.bitwarden.com
Subject: notifications.bitwarden.com
Issuer: YE2
SANs: notifications.bitwarden.com
Subject: notifications.bitwarden.com
Issuer: YE2
SANs: notifications.bitwarden.com
Subject: notifications.bitwarden.com
Issuer: YE2
SANs: notifications.bitwarden.com
Subject: defensearchitecturesystems-bitwarden.com
Issuer: R3
SANs: defensearchitecturesystems-bitwarden.com
Subject: notifications.bitwarden.com
Issuer: YE2
SANs: notifications.bitwarden.com
Subject: notifications.bitwarden.com
Issuer: YE2
SANs: notifications.bitwarden.com
Subject: notifications.bitwarden.com
Issuer: R13
SANs: notifications.bitwarden.com
Subject: notifications.bitwarden.com
Issuer: R13
SANs: notifications.bitwarden.com
Subject: notifications.bitwarden.com
Issuer: R13
SANs: notifications.bitwarden.com
Subject: notifications.bitwarden.com
Issuer: R13
SANs: notifications.bitwarden.com
Subject: notifications.bitwarden.com
Issuer: R13
SANs: notifications.bitwarden.com
Subject: notifications.bitwarden.com
Issuer: R13
SANs: notifications.bitwarden.com
IPs Citing This Domain
Hosts whose HTML body references this domain. Strong signal for origin/mirror/embed discovery.
149.28.90.29:443
href · ×3
168.138.208.253:443
href · ×2
146.190.93.154:443
href · ×2
143.198.204.61:443
href · ×2
172.104.95.92:443
href · ×2
51.15.64.39:443
href · ×2
72.193.247.82:443
href · ×1
216.158.226.201:443
href · ×1
141.144.203.172:443
href · ×1
176.61.12.8:80
href · ×1
195.201.133.196:443
href · ×1
103.115.189.92:80
href · ×1
216.158.226.201:80
href · ×1
67.230.160.54:80
href · ×1
192.248.148.119:443
href · ×1
150.136.38.199:443
href · ×1
168.119.156.145:443
href · ×1
Origin / IP-Leak
USP
When a hostname is served behind a CDN (e.g. Cloudflare), the origin server can sometimes be identified by matching its TLS cert against the protected hostname. Findings shown here are heuristic candidates, not guarantees.
No origin-IP leaks detected (yet)
Either this domain doesn't sit behind a CDN, or we haven't seen a TLS cert from a non-CDN IP matching this hostname. Run a fullscan to refresh the cert→IP cross-reference.
Threat Intelligence
Domain threat-intel pending
Matches in URLhaus, OpenPhish, PhishTank, malware feeds, and Spamhaus DBL.
History
Passive DNS — every value this name ever resolved to and when we first / last observed it. Updates every cycle of our forward-DNS crawler.
| Type | Value | First seen | Last seen |
|---|---|---|---|
| TXT | 6e81d67c-d407-4e9f-bf25-3372f01f3e9c | 2026-05-26 03:19:32.089 | 2026-07-28 13:22:58.632 |
| MX | 10 alt3.aspmx.l.google.com | 2026-05-26 03:19:32.089 | 2026-07-28 13:22:58.632 |
| TXT | google-site-verification=V8p-QL6humc_vX6Wi9FiTa5a9Lzx9DVp120jW8-ow2o | 2026-05-26 03:19:32.089 | 2026-07-28 13:22:58.632 |
| TXT | bw=Qa/t9YOKsFsU9/qhVNesyup0byKExijKNhGjcj9N9lLB | 2026-05-26 03:19:32.089 | 2026-07-28 13:22:58.632 |
| TXT | notion-domain-verification=XzPFwn4FBKjH89oYjUHwuyxGxzAURG6QuniFMOL06mh | 2026-05-26 03:19:32.089 | 2026-07-28 13:22:58.632 |
| TXT | MS=C8E6AF80F5B0DD0B5AD483EDFDB8C55CB3A9B468 | 2026-05-26 03:19:32.089 | 2026-07-28 13:22:58.632 |
| TXT | h1-domain-verification=EjLrcRwtpQU1iHokYvvNt79uhuwHR92BxrRG6pmohr1w5fk7 | 2026-05-26 03:19:32.089 | 2026-07-28 13:22:58.632 |
| TXT | google-site-verification=02PtJycFi417SDMgi-3vPDRsgJP98CCWVXdenimqMv0 | 2026-05-26 03:19:32.089 | 2026-07-28 13:22:58.632 |
| TXT | zapier-domain-verification-challenge=0520755a-cbd5-4697-b1aa-28c91f5261e7 | 2026-05-26 03:19:32.089 | 2026-07-28 13:22:58.632 |
| TXT | MS=ms10313433 | 2026-05-26 03:19:32.089 | 2026-07-28 13:22:58.632 |
| NS | rose.ns.cloudflare.com | 2026-05-26 03:19:32.089 | 2026-07-28 13:22:58.632 |
| A | 151.101.129.91 | 2026-05-26 03:19:32.089 | 2026-07-28 13:22:58.632 |
| TXT | stripe-verification=0F73E504516F9675013BCA18CE721381363172A7A3A881A8C26DCC31524FA0FB | 2026-05-26 03:19:32.089 | 2026-07-28 13:22:58.632 |
| TXT | v=spf1 include:spf.braintreegateway.com include:_spf.google.com include:amazonses.com include:_spf.freshsales.io include:22371289.spf07.hubspotemail.net ~all | 2026-05-26 03:19:32.089 | 2026-07-28 13:22:58.632 |
| A | 151.101.65.91 | 2026-05-26 03:19:32.089 | 2026-07-28 13:22:58.632 |
| MX | 5 alt2.aspmx.l.google.com | 2026-05-26 03:19:32.089 | 2026-07-28 13:22:58.632 |
| A | 151.101.1.91 | 2026-05-26 03:19:32.089 | 2026-07-28 13:22:58.632 |
| MX | 10 alt4.aspmx.l.google.com | 2026-05-26 03:19:32.089 | 2026-07-28 13:22:58.632 |
| MX | 1 aspmx.l.google.com | 2026-05-26 03:19:32.089 | 2026-07-28 13:22:58.632 |
| TXT | OOSSRH-94202 | 2026-05-26 03:19:32.089 | 2026-07-28 13:22:58.632 |
| TXT | brave-ledger-verification=f8b96f2d0f5fd1db7ac8753f8d38b219911e5d32b0f955537479416ac5f53a20 | 2026-05-26 03:19:32.089 | 2026-07-28 13:22:58.632 |
| MX | 5 alt1.aspmx.l.google.com | 2026-05-26 03:19:32.089 | 2026-07-28 13:22:58.632 |
| A | 151.101.193.91 | 2026-05-26 03:19:32.089 | 2026-07-28 13:22:58.632 |
| TXT | h1-domain-verification=qhyNWpPNpjZeDLwbHo51AG1rqfQPD5qG9R8hvCmAdPB82MKQ | 2026-05-26 03:19:32.089 | 2026-07-28 13:22:58.632 |
| TXT | stripe-verification=a048802b74e7474c811a37b7e45e4f0f10bbea9a16038574b6cceeab11b8068c | 2026-05-26 03:19:32.089 | 2026-07-28 13:22:58.632 |
| NS | igor.ns.cloudflare.com | 2026-05-26 03:19:32.089 | 2026-07-28 13:22:58.632 |
| TXT | anthropic-domain-verification-ce78r2=C3El56QZ4UekFLhM2BhH1Vcr7 | 2026-05-26 03:19:32.089 | 2026-07-28 13:22:58.632 |
| TXT | slack-domain-verification=LMpgXAy3wScSisUrOiOzxYpUfciykE41MfblnAQc | 2026-05-26 03:19:32.089 | 2026-07-28 13:22:58.632 |
| TXT | atlassian-domain-verification=8wc47B5qEzmZSWU3FaWKd6EzPpPeW33aqHzS5Go1iZwceU4RHIAg8m825izy4gvE | 2026-05-26 03:19:32.089 | 2026-07-28 13:22:58.632 |