The scan of 1.io on 19 Aug 2026 reached no verdict either way (score -4). Too little was captured to judge it, which is an unknown rather than a pass.

What malware is associated with 1.io?

1 analysed samples communicate with this URL, including AsyncRAT.

How was 1.io checked?

A static pass resolved DNS, captured TLS and headers and followed the redirect chain, and where the fast tier allows, a headless browser rendered the page and recorded every request. Egress is SSRF-locked. Signatures that matched only page text are weighted far below one that matched a served file, because a page documenting malware matches the same rules.

1.io - URL scan, 19 Aug 2026

MalwareAnalyzer by Cyble scanned 1.io and returned a unknown verdict (score -4). The page resolved to 13.43.125.84 on Amazon Data Services UK in GB. 1 domain and 1 IP were contacted, over 3 HTTP requests. 1 malware sample communicates with this URL (AsyncRAT). This is a point-in-time observation from 19 Aug 2026; the page may have changed since.

Scan result

Verdict: unknown (score -4) · Confidence 10%
Scanned URL: https://1.io/
Domain: 1.io · IP: 13.43.125.84 · AS16509 · GB
Server: nginx
Page title: ONE.io
HTTP status: 200 · text/html
TLS issuer: C=US, O=Amazon, CN=Amazon RSA 2048 M01 · valid to Mar 3 23: · subject CN=1.io
HTTP requests captured: 3
Scan tier: fast · observed 2026-08-19 10:49:57 UTC

Malware communicating with this URL (1)

These samples were observed contacting or being served from 1.io. Each links to its full analysis.

AsyncRAT - referenced · 64d6925c0c945e4867e62a6218ab1241 · first seen 2026-08-19

Antivirus & YARA (0 of 47 engines)

No engine flagged this page's content.

Why this verdict

Valid TLS, no impersonation or off-origin credential post
Certificate issued < 48h ago

Detected technologies

Nginx

Contacted infrastructure

13.43.125.84 - AS16509 Amazon Data Services UK (United Kingdom)

Observed indicators

1.io
13.43.125.84
https://1.io/
https://1.io/favicon.ico
https://1.io/assets/manifest.json
https://1.io/env-config.js?t=%NX_TIMESTAMP%
https://1.io/main.beb2a9bbd96366d9.css
https://1.io/runtime.923ad9c25628078a.js
https://1.io/main.ab31a4ecec338ad8.js

Questions about 1.io

Is 1.io safe?: The scan of 1.io on 19 Aug 2026 reached no verdict either way (score -4). Too little was captured to judge it, which is an unknown rather than a pass.
What malware is associated with 1.io?: 1 analysed samples communicate with this URL, including AsyncRAT.
How was 1.io checked?: A static pass resolved DNS, captured TLS and headers and followed the redirect chain, and where the fast tier allows, a headless browser rendered the page and recorded every request. Egress is SSRF-locked. Signatures that matched only page text are weighted far below one that matched a served file, because a page documenting malware matches the same rules.

Scanned at the fast tier - see how URL scanning works.

Scan another URL · Latest analyzed threats · All scans of 1.io

Scanned on MalwareAnalyzer by Cyble · Open interactive scan