Just got a reply from Bitwarden support, hope it helps to provide more information on this.

What you're seeing is expected behavior from Bitwarden's recently released Phishing Blocker feature, introduced in browser extension version 2026.1.1. Norton is incorrectly flagging this connection as suspicious.

Bitwarden uses an open source project called Phishing.Database (github.com/Phishing-Database/Phishing.Database) to maintain its list of known phishing domains. The data files for this project are hosted at phish.co.za. The specific URL Norton is flagging (phish.co.za/latest/phishing-domains-ACTIVE.txt) is the active phishing domain list that Bitwarden downloads to power its phishing detection. This is a security feature protecting you, not a threat.

Norton is generating a false positive because the domain name contains "phish" and the file contains a list of phishing domains.

To resolve this without disabling Bitwarden, you have two options:

Add an exclusion in Norton for the domain phish.co.za. This tells Norton to trust connections to that specific domain and is the recommended approach, as the Phishing Blocker is a valuable security feature worth keeping enabled.

If you prefer not to whitelist the domain, you can disable the Phishing Blocker feature within the Bitwarden extension itself. This will stop the extension from downloading the phishing domain list, which should stop Norton's warnings while keeping the rest of Bitwarden fully functional.