settings.to - URL scan, 22 Aug 2026
MalwareAnalyzer by Cyble scanned settings.to and returned a unknown verdict (score -12). The page resolved to 104.219.250.37 on NAMECHEAP-NET - Namecheap, Inc., US in US. The domain was registered 1210 days ago through NAMECHEAP. 6 domains and 1 IP were contacted, over 2 HTTP requests. 3 malware samples communicate with this URL (Gootloader). This is a point-in-time observation from 22 Aug 2026; the page may have changed since.
Scan result
- Verdict: unknown (score -12) · Confidence 15%
- Scanned URL:
https://settings.to/ - Domain: settings.to · IP: 104.219.250.37 · AS22612 · US
- Server: nginx/1.28.3 (Ubuntu)
- HTTP status: 200 · text/html
- Registrar: NAMECHEAP · domain age 1210 days · created 2023-04-30
- TLS issuer: C=US, O=Let's Encrypt, CN=YE1 · valid to Nov 8 22: · subject CN=settings.to
- HTTP requests captured: 2
- Scan tier: fast · observed 2026-08-22 08:38:14 UTC
Malware communicating with this URL (3)
These samples were observed contacting or being served from settings.to. Each links to its full analysis.
- bcd0f5f28dc1438e3c2781b8f491db4a8b52036c9f18436d837cf49a0087d118 - referenced ·
bcd0f5f28dc1438e3c2781b8f491db4a· first seen 2026-08-22 - e24a78015cd4166e1eb909978a86d5585ae1c9b4ee436a7988f8c128bc6e0d86 - referenced ·
e24a78015cd4166e1eb909978a86d558· first seen 2026-08-21 - Gootloader - referenced ·
a219dfaf4b5acc45855fdd5fc1e5278f· first seen 2026-08-19
Antivirus & YARA (0 of 48 engines)
No engine flagged this page's content.
Why this verdict
- Valid TLS, no impersonation or off-origin credential post
Detected technologies
- Nginx
Contacted infrastructure
- 104.219.250.37 - AS22612 NAMECHEAP-NET - Namecheap, Inc., US (US)
Observed indicators
- settings.to
- lander.parity.domains
- www.namecheap.com
- ap.www.namecheap.com
- apps.apple.com
- play.google.com
- 104.219.250.37
- https://settings.to/
- https://settings.to/assets/index-BuG04mTK.js
- https://settings.to/assets/index-B_f2Ggms.css
- https://lander.parity.domains/js/pa-6FZUe2Iv3m6Yx_KBS2sv2.js
- https://www.namecheap.com/?utm_source=parkingpage&utm_medium=referral&utm_campaign=nc_market
- https://settings.to/logo.svg
- https://www.namecheap.com/myaccount/login/?utm_source=parkingpage&utm_medium=referral&utm_campaign=nc_market
- https://www.namecheap.com/support/knowledgebase/article.aspx/239/2201/how-can-i-renew-my-domain/?utm_source=parkingpage&utm_medium=referral&utm_campaign=nc_market
- https://www.namecheap.com/support/knowledgebase/article.aspx/242/2207/what-is-the-domain-redemption-grace-period/?utm_source=parkingpage&utm_medium=referral&utm_campaign=nc_market
- https://ap.www.namecheap.com/?utm_source=parkingpage&utm_medium=referral&utm_campaign=nc_market
- https://www.namecheap.com/market/?utm_source=parkingpage&utm_medium=referral&utm_campaign=nc_market
- https://apps.apple.com/us/app/namecheap-auctions/id6743634772?itscg=30200&itsct=apps_box_badge&mttnsubad=6743634772
- https://settings.to/appstore.svg
Other scans of settings.to (1)
This host has been scanned before. Each scan is a separate observation, so a verdict here does not carry over to the others.
- 21 Aug 2026 - unknown
Questions about settings.to
- Is settings.to safe?
- The scan of settings.to on 22 Aug 2026 reached no verdict either way (score -12). Too little was captured to judge it, which is an unknown rather than a pass.
- What malware is associated with settings.to?
- 3 analysed samples communicate with this URL, including Gootloader.
- How was settings.to checked?
- A static pass resolved DNS, captured TLS and headers and followed the redirect chain, and where the fast tier allows, a headless browser rendered the page and recorded every request. Egress is SSRF-locked. Signatures that matched only page text are weighted far below one that matched a served file, because a page documenting malware matches the same rules.
Scanned at the fast tier - see how URL scanning works.
Scan another URL · Latest analyzed threats · All scans of settings.to
Scanned on MalwareAnalyzer by Cyble · Open interactive scan