s.to - URL scan, 23 Aug 2026
MalwareAnalyzer by Cyble scanned s.to and returned a unknown verdict (score 0). 1 domain and 0 IPs were contacted. 146 malware samples communicate with this URL (Zusy). This is a point-in-time observation from 23 Aug 2026; the page may have changed since.
Scan result
- Verdict: unknown (score 0) · Confidence 3%
- Scanned URL:
https://s.to/ - Domain: s.to
- Scan tier: fast · observed 2026-08-23 09:33:37 UTC
Malware communicating with this URL (146)
These samples were observed contacting or being served from s.to. Each links to its full analysis.
- 8b49b7e33dc0aa44125c6312147c28b5bfd0da38f8aa373eed085c100c67b903 - referenced ·
8b49b7e33dc0aa44125c6312147c28b5· first seen 2026-08-23 - ba44f77e1040c9bb227107ea7f006988dab5e8321dabda777a8b3eb93c820420 - referenced ·
ba44f77e1040c9bb227107ea7f006988· first seen 2026-08-23 - fb5ddff9adb3f6fed6bfb25113d100fa3ef02cb5e5456f82cb57fff7cc2de89f - referenced ·
fb5ddff9adb3f6fed6bfb25113d100fa· first seen 2026-08-23 - 2047b4c6fbfa2aa4a34f1ead89fe1db546a5993ae9606aea1f40898003c96d72 - referenced ·
2047b4c6fbfa2aa4a34f1ead89fe1db5· first seen 2026-08-23 - Zusy - referenced ·
ae4325adef38d801d40307df93effaf7· first seen 2026-08-23 - 3c5a91c53956354faf5edc79b8f8302298ace598a4bab80ce67480fd8451d1e8 - referenced ·
3c5a91c53956354faf5edc79b8f83022· first seen 2026-08-23 - cdc5d0c2a3f89bbc70615ef8eb6ff3f59b01492a7dea0cb33a31557f253c47c0 - referenced ·
cdc5d0c2a3f89bbc70615ef8eb6ff3f5· first seen 2026-08-23 - b552d41fa43553b762cc62fb9cc4ce9708481812f94e9740319d615422c7b2c4 - referenced ·
b552d41fa43553b762cc62fb9cc4ce97· first seen 2026-08-23 - 1d458207334f13d506e93cf6df9a90a9b0be57edb6406ef630b6d02d54a26f66 - referenced ·
1d458207334f13d506e93cf6df9a90a9· first seen 2026-08-22 - f43f824834393638b6cac5c9b38dc9e2882779af11d8a82dac523f31b8f943a8 - referenced ·
f43f824834393638b6cac5c9b38dc9e2· first seen 2026-08-22 - 37a4c918116b14a1aef5e18b93c5cd967c1748b453745b55c78b96ce5c265efb - referenced ·
37a4c918116b14a1aef5e18b93c5cd96· first seen 2026-08-22 - cd6f53c605922d17f49add340f9521a7d7f4c91c9871bf1d9e2c1cef6ae8d8ed - referenced ·
cd6f53c605922d17f49add340f9521a7· first seen 2026-08-22 - c18be3894f602bdc5470290f1f605a7916babd8de65085106c5359c2c4d7a343 - referenced ·
c18be3894f602bdc5470290f1f605a79· first seen 2026-08-22 - 3b85d4c32fccb5bc4c395d7482e81307c4e4865637ecff5848b659677f61347e - referenced ·
3b85d4c32fccb5bc4c395d7482e81307· first seen 2026-08-22 - cbc531d9eb5abb6f3d835c2b199f2f9089efa99eb341a3477228ae09fa7a5044 - referenced ·
cbc531d9eb5abb6f3d835c2b199f2f90· first seen 2026-08-22
Why this verdict
- Target did not respond (DNS/connection failure or timeout); verdict from URL structure only
Observed indicators
- s.to
- https://s.to/
Other scans of s.to (10)
This host has been scanned before. Each scan is a separate observation, so a verdict here does not carry over to the others.
- 24 Aug 2026 - unknown
- 23 Aug 2026 - unknown
- 23 Aug 2026 - unknown
- 22 Aug 2026 - unknown
- 22 Aug 2026 - unknown
- 22 Aug 2026 - unknown
- 21 Aug 2026 - unknown
- 21 Aug 2026 - unknown
- 21 Aug 2026 - unknown
- 21 Aug 2026 - unknown
Questions about s.to
- Is s.to safe?
- The scan of s.to on 23 Aug 2026 reached no verdict either way (score 0). Too little was captured to judge it, which is an unknown rather than a pass.
- What malware is associated with s.to?
- 146 analysed samples communicate with this URL, including Zusy.
- How was s.to checked?
- A static pass resolved DNS, captured TLS and headers and followed the redirect chain, and where the fast tier allows, a headless browser rendered the page and recorded every request. Egress is SSRF-locked. Signatures that matched only page text are weighted far below one that matched a served file, because a page documenting malware matches the same rules.
Scanned at the fast tier - see how URL scanning works.
Scan another URL · Latest analyzed threats · All scans of s.to
Scanned on MalwareAnalyzer by Cyble · Open interactive scan