The scan of a.to on 20 Aug 2026 reached no verdict either way (score 0). Too little was captured to judge it, which is an unknown rather than a pass.

What malware is associated with a.to?

7 analysed samples communicate with this URL, including Bulz.

How was a.to checked?

A static pass resolved DNS, captured TLS and headers and followed the redirect chain, and where the fast tier allows, a headless browser rendered the page and recorded every request. Egress is SSRF-locked. Signatures that matched only page text are weighted far below one that matched a served file, because a page documenting malware matches the same rules.

a.to - URL scan, 20 Aug 2026

MalwareAnalyzer by Cyble scanned a.to and returned a unknown verdict (score 0). 1 domain and 0 IPs were contacted. 7 malware samples communicate with this URL (Bulz). This is a point-in-time observation from 20 Aug 2026; the page may have changed since.

Scan result

Verdict: unknown (score 0) · Confidence 3%
Scanned URL: https://a.to/
Domain: a.to
Scan tier: fast · observed 2026-08-20 23:13:25 UTC

Malware communicating with this URL (7)

These samples were observed contacting or being served from a.to. Each links to its full analysis.

e5b364ca127b24d904f14450e809284700b94ee3435731d74da7a8a5c422e3cc - referenced · e5b364ca127b24d904f14450e8092847 · first seen 2026-08-20
c85bf99298e182fa4fa6d6a08cdf0df78e1049944190440f0447f6516792a2e5 - referenced · c85bf99298e182fa4fa6d6a08cdf0df7 · first seen 2026-08-18
Bulz - referenced · 8dc76b26a57b33449daa302c1907c3c2 · first seen 2026-08-15
3618766451-lbx__en_gb.js - referenced · 88b4eee071a3e2d8836be1b02ec5b3e1 · first seen 2026-08-14
201988111-lbx__pt_br.js - referenced · d31bce676025d141cccecf7dcad29d2a · first seen 2026-08-14
codeMirror.plugin.min.js - referenced · c87f083330dda171b3a1c1b912c21859 · first seen 2026-08-12
codeMirror.bundle.min.js - referenced · 7b5277fff495c8fc86f70c16bec5efaa · first seen 2026-08-12

Why this verdict

Target did not respond (DNS/connection failure or timeout); verdict from URL structure only

Observed indicators

a.to
https://a.to/

Other scans of a.to (1)

This host has been scanned before. Each scan is a separate observation, so a verdict here does not carry over to the others.

22 Aug 2026 - unknown

Questions about a.to

Is a.to safe?: The scan of a.to on 20 Aug 2026 reached no verdict either way (score 0). Too little was captured to judge it, which is an unknown rather than a pass.
What malware is associated with a.to?: 7 analysed samples communicate with this URL, including Bulz.
How was a.to checked?: A static pass resolved DNS, captured TLS and headers and followed the redirect chain, and where the fast tier allows, a headless browser rendered the page and recorded every request. Egress is SSRF-locked. Signatures that matched only page text are weighted far below one that matched a served file, because a page documenting malware matches the same rules.

Scanned at the fast tier - see how URL scanning works.

Scan another URL · Latest analyzed threats · All scans of a.to

Scanned on MalwareAnalyzer by Cyble · Open interactive scan