What Gridinsoft observed on localto.net
A Gridinsoft threat analyst reviewed the site directly and documented the evidence behind this decision.
GMA-20261026105006-5745a7d4
- Reviewed
- by Gridinsoft Threat Analyst
- Analyst finding
- Shared reverse-proxy service
- Evidence basis
- First-party site analysis External vendor intelligence: Context only — not used for this decision
The public responses support distinguishing the service root from customer tunnels. The material customer-controlled namespace was not reviewed deeply enough for a whole-domain Safe conclusion, and no current harmful payload was reproduced in the sampled responses.
Analyst findings
Review 3 documented observations View evidence
The root returns HTTP 200 with Domain Not Found. The www host and the sampled tenant 8xzlyusic3.localto.net return Tunnel Stopped. These are service-state pages, not observed phishing forms or malware payloads. They do not reveal what other active tunnels serve.
- Public artifact URL https://localto.net/
- Public artifact URL https://www.localto.net/
- Public artifact URL https://8xzlyusic3.localto.net/
The operator describes a reverse-proxy tunnelling service. Its public terms prohibit fraudulent, unlawful and malicious use. The abuse page requests a tunnel URL or subdomain, behavior description, observation time and evidence. The form was read without submitting a report. Posted rules are not proof of enforcement or of the safety of all customer endpoints.
- Public artifact URL https://localtonet.com/terms
- Public artifact URL https://localtonet.com/abuse
Existing URLscan index entries include the root and separate tenant hosts; the reviewed recent entries show inactive service pages. OTX returns eight historical apex references, with overlapping sources, and none for www. An actual 13 July 2026 archive replay also shows Domain Not Found at the root. Those records are not a reproduction of current harmful tenant behavior or a complete inventory of the namespace.
- Public artifact URL https://urlscan.io/result/01a17281-5276-70a8-86d7-c94d48b71a16/
- Public artifact URL https://otx.alienvault.com/indicator/domain/localto.net
- Public artifact URL https://web.archive.org/web/20260713031912/http://localto.net/
Scope and limitations
- No account was created, tunnel activated, proxy client installed, private endpoint accessed, abuse report submitted or executable run. One tenant sample cannot certify or condemn all tenants; the historical trigger for the parent signature was not established.
Help protect others by sharing this page on social media! The more people who know about localto.net, the fewer chances they have to deceive someone else. Help others evaluate localto.net by sharing this page on social media!