e.to - URL scan, 20 Aug 2026
MalwareAnalyzer by Cyble scanned e.to and returned a unknown verdict (score -12). The page resolved to 76.223.54.146 on Amazon.com, Inc. in US. The domain was registered 1451 days ago through Government of Kingdom of Tonga. 1 domain and 1 IP were contacted. 20 malware samples communicate with this URL (Zusy, VMProtect). This is a point-in-time observation from 20 Aug 2026; the page may have changed since.
Scan result
- Verdict: unknown (score -12) · Confidence 15%
- Scanned URL:
https://e.to/ - Domain: e.to · IP: 76.223.54.146 · AS16509 · US
- HTTP status: 200 · text/html
- Registrar: Government of Kingdom of Tonga · domain age 1451 days · created 2022-08-30
- TLS issuer: C=US, O=GoDaddy.com, CN=GoDaddy TLS Intermediate CA DV - R1v1 · valid to Dec 11 17: · subject CN=e.to
- Scan tier: fast · observed 2026-08-20 18:58:41 UTC
Malware communicating with this URL (20)
These samples were observed contacting or being served from e.to. Each links to its full analysis.
- 75dddabf09140ec98f00ece2c32cd9ca0bafd88d70824a7a605af725add5f0cb - referenced ·
75dddabf09140ec98f00ece2c32cd9ca· first seen 2026-08-20 - 497c3d3bc4061e06ea844a22b9055f08858688c3e119121be7c571599aea8743 - referenced ·
497c3d3bc4061e06ea844a22b9055f08· first seen 2026-08-20 - f5c1380a5ebbe9ebc15216e4d3d5a90d14baad352dc1dd32052861a2e31142e2 - referenced ·
f5c1380a5ebbe9ebc15216e4d3d5a90d· first seen 2026-08-20 - Zusy - referenced ·
bd5c0f624f28222600083f487fbac6fc· first seen 2026-08-20 - 25151118146677e52e8ef347f55c0ae9c662687f99953ecddb1fa64a49c8ebe0 - referenced ·
25151118146677e52e8ef347f55c0ae9· first seen 2026-08-19 - VMProtect - referenced ·
19cb8df79a83dfc143d131c5c5f0f4e4· first seen 2026-08-19 - c85bf99298e182fa4fa6d6a08cdf0df78e1049944190440f0447f6516792a2e5 - referenced ·
c85bf99298e182fa4fa6d6a08cdf0df7· first seen 2026-08-18 - fb17303d9ff2f65626155051a193940b0fd1c717d1ba8a9074a0b2d94f1eea6a - referenced ·
fb17303d9ff2f65626155051a193940b· first seen 2026-08-16 - f3a91608f3336e83a2227b52afff45f9ec390a3145032052a4cbbb5ca1a3de3c - referenced ·
f3a91608f3336e83a2227b52afff45f9· first seen 2026-08-15 - 998ab20451d9d4322ccabe305b175adf90e81e72b0e0ac6699c6a338c50bb6ea - referenced ·
998ab20451d9d4322ccabe305b175adf· first seen 2026-08-14 - 8765229.pdf - referenced ·
3aed80c001397fb1cbb41407e8ac468e· first seen 2026-08-13 - codeMirror.plugin.min.js - referenced ·
c87f083330dda171b3a1c1b912c21859· first seen 2026-08-12 - codeMirror.bundle.min.js - referenced ·
7b5277fff495c8fc86f70c16bec5efaa· first seen 2026-08-12 - 54808d28c720599d8588557fc11bba5c90bdc65e8004483bf5f2c560a50d7f07 - referenced ·
54808d28c720599d8588557fc11bba5c· first seen 2026-08-12 - a3b19300725028649baf4dbb8bda65557a880c56459399183f88c18c3721c63c - referenced ·
a3b19300725028649baf4dbb8bda6555· first seen 2026-08-12
Antivirus & YARA (0 of 47 engines)
No engine flagged this page's content.
Why this verdict
- Valid TLS, no impersonation or off-origin credential post
Contacted infrastructure
- 76.223.54.146 - AS16509 Amazon.com, Inc. (United States)
Observed indicators
- e.to
- 76.223.54.146
- https://e.to/
- https://e.to/lander
Other scans of e.to (7)
This host has been scanned before. Each scan is a separate observation, so a verdict here does not carry over to the others.
- 22 Aug 2026 - unknown
- 20 Aug 2026 - unknown
- 19 Aug 2026 - unknown
- 16 Aug 2026 - unknown
- 14 Aug 2026 - unknown
- 12 Aug 2026 - unknown
- 11 Aug 2026 - unknown
Questions about e.to
- Is e.to safe?
- The scan of e.to on 20 Aug 2026 reached no verdict either way (score -12). Too little was captured to judge it, which is an unknown rather than a pass.
- What malware is associated with e.to?
- 20 analysed samples communicate with this URL, including Zusy, VMProtect.
- How was e.to checked?
- A static pass resolved DNS, captured TLS and headers and followed the redirect chain, and where the fast tier allows, a headless browser rendered the page and recorded every request. Egress is SSRF-locked. Signatures that matched only page text are weighted far below one that matched a served file, because a page documenting malware matches the same rules.
Scanned at the fast tier - see how URL scanning works.
Scan another URL · Latest analyzed threats · All scans of e.to
Scanned on MalwareAnalyzer by Cyble · Open interactive scan