The scan of u4.sh on 19 Aug 2026 reached no verdict either way (score 0). Too little was captured to judge it, which is an unknown rather than a pass.

What malware is associated with u4.sh?

8 analysed samples communicate with this URL, including Zbot, Tiny, Fareit.

How was u4.sh checked?

A static pass resolved DNS, captured TLS and headers and followed the redirect chain, and where the fast tier allows, a headless browser rendered the page and recorded every request. Egress is SSRF-locked. Signatures that matched only page text are weighted far below one that matched a served file, because a page documenting malware matches the same rules.

u4.sh - URL scan, 19 Aug 2026

MalwareAnalyzer by Cyble scanned u4.sh and returned a unknown verdict (score 0). 1 domain and 0 IPs were contacted. 8 malware samples communicate with this URL (Zbot, Tiny, Fareit). This is a point-in-time observation from 19 Aug 2026; the page may have changed since.

Scan result

Verdict: unknown (score 0) · Confidence 3%
Scanned URL: https://u4.sh/
Domain: u4.sh
Scan tier: fast · observed 2026-08-19 11:42:52 UTC

Malware communicating with this URL (8)

These samples were observed contacting or being served from u4.sh. Each links to its full analysis.

Zbot - referenced · 8e108830eb08f96c52549dca024c65c6 · first seen 2026-08-19
Tiny - referenced · 0c659dbe2bfb06475f738817f61e3c1f · first seen 2026-08-18
Tiny - referenced · 8f0a20acd319e305c8c29468529b43f6 · first seen 2026-08-13
Zbot - referenced · c8f5a1032f770a377b3435336d8ff461 · first seen 2026-08-13
Tiny - referenced · 8e4f61f7a2f25fafd0dda53620956fb2 · first seen 2026-08-12
Tiny - referenced · f65a11c888d2ecbc422eb68f65e2830d · first seen 2026-08-12
Fareit - referenced · 77232accc7b545041145a8d1b1c7ebd4 · first seen 2026-08-11
Fareit - referenced · 9039dda99673329b43a82cfff69a6c5b · first seen 2026-08-11

Why this verdict

Target did not respond (DNS/connection failure or timeout); verdict from URL structure only

Observed indicators

u4.sh
https://u4.sh/

Other scans of u4.sh (3)

This host has been scanned before. Each scan is a separate observation, so a verdict here does not carry over to the others.

18 Aug 2026 - unknown
12 Aug 2026 - unknown
11 Aug 2026 - unknown

Questions about u4.sh

Is u4.sh safe?: The scan of u4.sh on 19 Aug 2026 reached no verdict either way (score 0). Too little was captured to judge it, which is an unknown rather than a pass.
What malware is associated with u4.sh?: 8 analysed samples communicate with this URL, including Zbot, Tiny, Fareit.
How was u4.sh checked?: A static pass resolved DNS, captured TLS and headers and followed the redirect chain, and where the fast tier allows, a headless browser rendered the page and recorded every request. Egress is SSRF-locked. Signatures that matched only page text are weighted far below one that matched a served file, because a page documenting malware matches the same rules.

Scanned at the fast tier - see how URL scanning works.

Scan another URL · Latest analyzed threats · All scans of u4.sh

Scanned on MalwareAnalyzer by Cyble · Open interactive scan