The scan of 1.to on 20 Aug 2026 reached no verdict either way (score 8). Too little was captured to judge it, which is an unknown rather than a pass.

What malware is associated with 1.to?

1 analysed samples communicate with this URL, including Ursu.

How was 1.to checked?

A static pass resolved DNS, captured TLS and headers and followed the redirect chain, and where the fast tier allows, a headless browser rendered the page and recorded every request. Egress is SSRF-locked. Signatures that matched only page text are weighted far below one that matched a served file, because a page documenting malware matches the same rules.

1.to - URL scan, 20 Aug 2026

MalwareAnalyzer by Cyble scanned 1.to and returned a unknown verdict (score 8). The page resolved to 100.50.238.73 on Amazon.com, Inc. in US. The domain was registered 2508 days ago through humbly LLC. 4 domains and 1 IP were contacted, over 5 HTTP requests. 1 malware sample communicates with this URL (Ursu). This is a point-in-time observation from 20 Aug 2026; the page may have changed since.

Scan result

Verdict: unknown (score 8) · Confidence 11%
Scanned URL: https://1.to/
Domain: 1.to · IP: 100.50.238.73 · AS16509 · US
Page title: 1.to - a really cool domain parked on Park.io | Park.io
HTTP status: 200 · text/html; charset=utf-8
Registrar: humbly LLC · domain age 2508 days · created 2019-10-08
TLS issuer: C=US, O=Amazon, CN=Amazon RSA 2048 M01 · valid to Nov 11 23: · subject CN=*.park.io
HTTP requests captured: 5
Scan tier: fast · observed 2026-08-20 11:52:36 UTC

Malware communicating with this URL (1)

These samples were observed contacting or being served from 1.to. Each links to its full analysis.

Ursu - referenced · d40b7935c1d4aafadaac8489ec94a1c8 · first seen 2026-08-20

Antivirus & YARA (0 of 47 engines)

No engine flagged this page's content.

Why this verdict

Untrusted certificate (ERR_TLS_CERT_ALTNAME_INVALID)

Detected technologies

Google Analytics
jQuery
Bootstrap

Contacted infrastructure

100.50.238.73 - AS16509 Amazon.com, Inc. (United States)

Observed indicators

1.to
www.googletagmanager.com
fonts.googleapis.com
park.io
100.50.238.73
https://1.to/
https://www.googletagmanager.com/gtag/js?id=G-H56EFGGDMM
http://1.to/
https://fonts.googleapis.com/css?family=Open+Sans:400,700,800
https://1.to/images/favicon.ico
https://1.to/images/system-icons/apple-icon-57x57.png
https://1.to/images/system-icons/apple-icon-60x60.png
https://1.to/images/system-icons/apple-icon-72x72.png
https://1.to/images/system-icons/apple-icon-76x76.png
https://1.to/images/system-icons/apple-icon-114x114.png
https://1.to/images/system-icons/apple-icon-120x120.png
https://1.to/images/system-icons/apple-icon-144x144.png
https://1.to/images/system-icons/apple-icon-152x152.png
https://1.to/images/system-icons/apple-icon-180x180.png
https://1.to/images/system-icons/android-icon-192x192.png

Questions about 1.to

Is 1.to safe?: The scan of 1.to on 20 Aug 2026 reached no verdict either way (score 8). Too little was captured to judge it, which is an unknown rather than a pass.
What malware is associated with 1.to?: 1 analysed samples communicate with this URL, including Ursu.
How was 1.to checked?: A static pass resolved DNS, captured TLS and headers and followed the redirect chain, and where the fast tier allows, a headless browser rendered the page and recorded every request. Egress is SSRF-locked. Signatures that matched only page text are weighted far below one that matched a served file, because a page documenting malware matches the same rules.

Scanned at the fast tier - see how URL scanning works.

Scan another URL · Latest analyzed threats · All scans of 1.to

Scanned on MalwareAnalyzer by Cyble · Open interactive scan