s.to - URL scan, 19 Aug 2026
MalwareAnalyzer by Cyble scanned s.to and returned a unknown verdict (score 0). 1 domain and 0 IPs were contacted. 58 malware samples communicate with this URL. This is a point-in-time observation from 19 Aug 2026; the page may have changed since.
Scan result
- Verdict: unknown (score 0) · Confidence 3%
- Scanned URL:
https://s.to/ - Domain: s.to
- Scan tier: fast · observed 2026-08-19 22:30:55 UTC
Malware communicating with this URL (58)
These samples were observed contacting or being served from s.to. Each links to its full analysis.
- a9941d5325767efb6ba9c215b808dd8cb52a2cbbb98c17645b8d2d1f4328fcff - referenced ·
a9941d5325767efb6ba9c215b808dd8c· first seen 2026-08-19 - b5fb3ddd5245a098ff012fcaea0df39818b6b452c9895559c9eba0e501ba1378 - referenced ·
b5fb3ddd5245a098ff012fcaea0df398· first seen 2026-08-19 - ec9e271ba6f654828e4c04133ffe660e35dc053d254695788abce87bd5c45787 - referenced ·
ec9e271ba6f654828e4c04133ffe660e· first seen 2026-08-19 - 3f14fb41dae64632c62124a088e8ac6f575ee262b89c5f77c5ac0583c8b18a1d - referenced ·
3f14fb41dae64632c62124a088e8ac6f· first seen 2026-08-19 - 1d2dd2448c3826e61bdc668f3adf31a0d2b97f3750d10e837549b8b579b3861f - referenced ·
1d2dd2448c3826e61bdc668f3adf31a0· first seen 2026-08-19 - 422cb334bc86679924fd4765c0c40a67bea2624571f1a0dbcaac399d28827b42 - referenced ·
422cb334bc86679924fd4765c0c40a67· first seen 2026-08-18 - 457ac8067a994cee211a30f5dbdd4059a8cdea3eb90aef783bc7f711972eb749 - referenced ·
457ac8067a994cee211a30f5dbdd4059· first seen 2026-08-17 - 42cc4af952c4c4c6436f7267da54cfa85cce9f071306cbf4cc8c7bbbff03ec43 - referenced ·
42cc4af952c4c4c6436f7267da54cfa8· first seen 2026-08-17 - 8187d06de4ffffa29b87e22a8965d377f3e3909d737a7d97d45e8d972bb80a2d - referenced ·
8187d06de4ffffa29b87e22a8965d377· first seen 2026-08-17 - 8e13162f6ffa18d223dde680a6a30e356e8a49e588f2350888ad9a0a82d73f50 - referenced ·
8e13162f6ffa18d223dde680a6a30e35· first seen 2026-08-17 - f486f02c5539ff79fc80008380b4c1fa3f93b0a5ab58efb10e5d962cfe0c683f - referenced ·
f486f02c5539ff79fc80008380b4c1fa· first seen 2026-08-17 - e83e7afd79ebd716053f788aaddbbfca941a5b0095ef136efdd5eaa8157518ac - referenced ·
e83e7afd79ebd716053f788aaddbbfca· first seen 2026-08-17 - 5335d0fc5968a82b61c6932c19a425cbc19c3bc0e5d59049c49962c7639314ff - referenced ·
5335d0fc5968a82b61c6932c19a425cb· first seen 2026-08-17 - 5deafbf7d1f186b92b733a204bd9ed25d021794fd5beb0f8074b92d0ab41aee0 - referenced ·
5deafbf7d1f186b92b733a204bd9ed25· first seen 2026-08-16 - 5fd7e7484cf60b97f04f0f259e0c93d327bbfda22ed5a74ac1d140f604b053ba - referenced ·
5fd7e7484cf60b97f04f0f259e0c93d3· first seen 2026-08-16
Why this verdict
- Target did not respond (DNS/connection failure or timeout); verdict from URL structure only
Observed indicators
- s.to
- https://s.to/
Other scans of s.to (10)
This host has been scanned before. Each scan is a separate observation, so a verdict here does not carry over to the others.
- 24 Aug 2026 - unknown
- 23 Aug 2026 - unknown
- 23 Aug 2026 - unknown
- 23 Aug 2026 - unknown
- 22 Aug 2026 - unknown
- 22 Aug 2026 - unknown
- 22 Aug 2026 - unknown
- 21 Aug 2026 - unknown
- 21 Aug 2026 - unknown
- 21 Aug 2026 - unknown
Questions about s.to
- Is s.to safe?
- The scan of s.to on 19 Aug 2026 reached no verdict either way (score 0). Too little was captured to judge it, which is an unknown rather than a pass.
- What malware is associated with s.to?
- 58 analysed samples communicate with this URL.
- How was s.to checked?
- A static pass resolved DNS, captured TLS and headers and followed the redirect chain, and where the fast tier allows, a headless browser rendered the page and recorded every request. Egress is SSRF-locked. Signatures that matched only page text are weighted far below one that matched a served file, because a page documenting malware matches the same rules.
Scanned at the fast tier - see how URL scanning works.
Scan another URL · Latest analyzed threats · All scans of s.to
Scanned on MalwareAnalyzer by Cyble · Open interactive scan