The scan of this.to on 14 Aug 2026 reached no verdict either way (score -12). Too little was captured to judge it, which is an unknown rather than a pass.

What malware is associated with this.to?

8 analysed samples communicate with this URL.

How was this.to checked?

A static pass resolved DNS, captured TLS and headers and followed the redirect chain, and where the fast tier allows, a headless browser rendered the page and recorded every request. Egress is SSRF-locked. Signatures that matched only page text are weighted far below one that matched a served file, because a page documenting malware matches the same rules.

this.to - URL scan, 14 Aug 2026

MalwareAnalyzer by Cyble scanned this.to and returned a unknown verdict (score -12). The page resolved to 216.150.1.1 on Vercel, Inc in US. 3 domains and 1 IP were contacted, over 15 HTTP requests. 8 malware samples communicate with this URL. This is a point-in-time observation from 14 Aug 2026; the page may have changed since.

Scan result

Verdict: unknown (score -12) · Confidence 15%
Scanned URL: https://this.to/
Domain: this.to · IP: 216.150.1.1 · AS16509 · US
Server: Vercel
Page title: this.to — the simplest way to create a searchable member vault
HTTP status: 200 · text/html; charset=utf-8
TLS issuer: C=US, O=Let's Encrypt, CN=YR1 · valid to Nov 1 09: · subject CN=this.to
HTTP requests captured: 15
Scan tier: fast · observed 2026-08-14 11:23:32 UTC

Malware communicating with this URL (8)

These samples were observed contacting or being served from this.to. Each links to its full analysis.

521a940c7302b8ce2b5a55bd7beb3e2583c073b5b101453a4d34c39d88197220 - referenced · 521a940c7302b8ce2b5a55bd7beb3e25 · first seen 2026-08-14
3618766451-lbx__en_gb.js - referenced · 88b4eee071a3e2d8836be1b02ec5b3e1 · first seen 2026-08-14
201988111-lbx__pt_br.js - referenced · d31bce676025d141cccecf7dcad29d2a · first seen 2026-08-14
da3c6485fc7c24b48f0f99593fce3b2ca129f683badc82d7b0bcd5977b18e895 - referenced · da3c6485fc7c24b48f0f99593fce3b2c · first seen 2026-08-13
codeMirror.plugin.js - referenced · 534519d5ab2b0875fba6b331b82a6872 · first seen 2026-08-12
codeMirror.plugin.min.js - referenced · c87f083330dda171b3a1c1b912c21859 · first seen 2026-08-12
codeMirror.bundle.min.js - referenced · 7b5277fff495c8fc86f70c16bec5efaa · first seen 2026-08-12
a087174c61632d342b0cbed9fc2ee6b62823fe99aed7df6bdb5afe352cc123c6 - referenced · a087174c61632d342b0cbed9fc2ee6b6 · first seen 2026-08-12

Antivirus & YARA (0 of 44 engines)

No engine flagged this page's content.

Why this verdict

Valid TLS, no impersonation or off-origin credential post

Detected technologies

Vercel
Next.js

Contacted infrastructure

216.150.1.1 - AS16509 Vercel, Inc (United States)

Observed indicators

this.to
clerk.this.to
images.unsplash.com
216.150.1.1
https://this.to/
https://this.to/_next/static/chunks/7033f24d09eea7e3.css
https://this.to/_next/static/chunks/df85897aff50e2c7.css
https://this.to/_next/static/chunks/f0f16363684401dd.js
https://this.to/_next/static/chunks/d9a1ac7dac50a49f.js
https://this.to/_next/static/chunks/bd4ab1517efdc1c3.js
https://this.to/_next/static/chunks/5476504fbe1f5f80.js
https://this.to/_next/static/chunks/da1ebc61b4c2a760.js
https://this.to/_next/static/chunks/e3c56e37a20391eb.js
https://this.to/_next/static/chunks/turbopack-b212ddb74bc6bb80.js
https://this.to/_next/static/chunks/8a07e07106d6caa4.js
https://this.to/_next/static/chunks/6412a65c4350f826.js
https://this.to/_next/static/chunks/6f385e8a85b0c1cf.js
https://this.to/_next/static/chunks/4aa0750b0dae29e2.js
https://this.to/_next/static/chunks/3a20575a46a72867.js
https://this.to/_next/static/chunks/e31dc7c63d3aed27.js

Other scans of this.to (3)

This host has been scanned before. Each scan is a separate observation, so a verdict here does not carry over to the others.

24 Aug 2026 - unknown
19 Aug 2026 - unknown
12 Aug 2026 - unknown

Questions about this.to

Is this.to safe?: The scan of this.to on 14 Aug 2026 reached no verdict either way (score -12). Too little was captured to judge it, which is an unknown rather than a pass.
What malware is associated with this.to?: 8 analysed samples communicate with this URL.
How was this.to checked?: A static pass resolved DNS, captured TLS and headers and followed the redirect chain, and where the fast tier allows, a headless browser rendered the page and recorded every request. Egress is SSRF-locked. Signatures that matched only page text are weighted far below one that matched a served file, because a page documenting malware matches the same rules.

Scanned at the fast tier - see how URL scanning works.

Scan another URL · Latest analyzed threats · All scans of this.to

Scanned on MalwareAnalyzer by Cyble · Open interactive scan