If you've landed on vistar.my.salesforce.com, you're looking at a Salesforce login portal belonging to Vistar. That's not a random website — it's a custom subdomain that Salesforce gives to its business customers. So the question 'is vistar.my.salesforce.com a scam' doesn't really apply here; it's part of Salesforce's own infrastructure. The connection is encrypted properly, the site enforces HTTPS, and it uses all the browser protections you'd want from a login page. There are no third-party threats, no blacklist entries, and the certificate is valid from a trusted issuer. For anyone trying to log into a Vistar Salesforce account, this is the real deal. The lack of an about page or privacy policy on the login form itself is expected — Salesforce handles those at the corporate level. If you're an authorized user, proceed with confidence. If you're unsure whether you should be logging in here, check with your company's IT team, but the site itself has no trust issues.
In plain English
This is a legitimate Salesforce login page, likely for Vistar's own instance. The security is top-notch, and the ownership is clear because it's a subdomain of salesforce.com. You can safely log in here if you're a Vistar employee or authorized partner.
Where the score comes from
This is about as good as it gets for a login page. A valid certificate from a top issuer, modern encryption enforced, and all the browser protections that prevent common attacks are in place. No red flags.
The domain is a subdomain of salesforce.com, a globally recognized company. The WHOIS record not matching is expected for a subdomain, and the ownership is clear from the domain name itself. No mystery here.
No blacklists, no threats detected, and the site responds quickly. The lack of web archive history is typical for a login portal that doesn't need cached snapshots. Nothing concerning.
For a dedicated login page, missing an About page or contact info is completely normal. Users are expected to already have a relationship with the organization. The page serves its single purpose without extra fluff.
There are no privacy policy or terms of service on this subdomain, but that's because Salesforce itself provides those for the entire platform. For a corporate login portal, separate legal pages aren't required.
Strong DNS setup with DNSSEC, a fast connection over a reputable cloud provider, and multiple security headers. Everything a secure login should have is configured properly.
What we checked
Run this site? Show your score.
Add a trust badge so visitors can see your live score for themselves.
Get your badge →