1337x.to: is it safe? Ads, redirects and how to remove them
1337x.to is a torrent search website, not a program, and opening it installs nothing. We could not test the site itself in October 2026 because it answered our browser with a bot check, so the risk to weigh is in the ads that lead off it, the notification requests and the files downloaded from torrents.
Facts checked October 10, 2026. Removal steps tested on Windows 11 (26H2) and checked against Microsoft's and the browser makers' current documentation.
Automatic
Get a free scan and check if your PC is infected.
Fortect finds malware, unwanted programs and the Windows damage they leave behind, and repairs it in one pass.
If redirects to 1337x.to keep coming back, a free scan can check extensions, programs and browser settings in one pass.
Do it yourself · free Remove 1337x.to yourself 1 step, about 5 minutes, no software needed.
1337x.to: summary
| Type | Torrent search website that shows third-party ads; not malware. The redirects, pop-ups and notifications seen around it are what people call the virus |
|---|---|
| Risk | Medium: the site installs nothing; the ads, redirects, notification requests and files downloaded from torrents are the risk |
| Symptoms | Tabs or ads that lead to 1337x.to or other sites you did not choose, notifications from 1337x.to, a changed start page or search engine, a slow browser |
| How to get rid of it | Take the notification permission back, remove unknown extensions and programs, run a Microsoft Defender full and offline scan if you ran a file, reset the browser |
| Our check (6 October 2026) | Not tested: only Cloudflare's bot check loaded (status 403); nothing on this one visit says nothing about the real page |
| Installed on the PC | Nothing: visiting a website installs no program; files from the ads, fake alerts or bundled installers that sent you there are what to remove |
| Removal | Scan the PC with security software to find and remove the malware and anything installed with it. Fortect scans Windows for malware and repairs the system files and settings it damaged. Remove it nowTo use the full-featured product, you have to purchase a license for Fortect. The scan is free. |
Show 12 more facts
| Microsoft detection | None: Microsoft Defender has no detection name for the website, because nothing is installed by visiting it |
|---|---|
| Running since | 1 November 2022 (current registry record, paid until 5 April 2030; registrar Tonic) |
| First reported by us | 4 June 2021 |
| Evidence | Our test of the site, the registry record, PCrisk's description, our 2021 report and its pictures |
| Name | 1337x.to |
| Domains | 1337x.to |
| Ads shown as | Redirects through ad pages |
| Browsers | Chrome, Edge and Firefox |
| First seen | 4 June 2021 |
| Distribution | Typically ad scripts on free streaming, file-hosting and adult sites, typo domains and hacked websites |
| Damage | Redirects to scam pages, fake updates and tech support scams |
| Facts checked | 6 October 2026 |
Facts checked on 6 October 2026 against our own test of the site in desktop Chromium from Lithuania (it reached only Cloudflare's bot check), the registry's RDAP record, PCrisk's description and the browser, Windows and FTC help pages. The test covers one visit to a check page.
What 1337x.to is and why people call it a virus
1337x.to is a website, not a program: it is a torrent search site, a list of links to files that other people share. Opening it does not install anything. The "1337x.to virus" people search for is the redirects, pop-up ads and notification requests that appear around sites of this kind, and the files they lead to.
- 1
You search or browse
The start page has a search box for torrents and quick links to movies, television, games, music, applications, anime and documentaries, as our 2021 picture shows. There is also a sign-in and registration form.
- 2
You open a listing
A listing points to a file that a stranger uploaded. The site does not make the file; the name and description tell you nothing about what is inside.
- 3
The ads and the file are the risk
The page earns from advertising. Ads can open new tabs, ask to show notifications or offer a "player" or "update", and a downloaded file can carry more than the film or program it claims to be.
- What it is
- A torrent search website, not an installed program or a Windows file
- What people call the virus
- Redirects to other sites, pop-up ads, notification alerts and a changed start page or search engine, seen after visiting or after installing something else
- Where the harm starts
- In ads that lead off the site and in files downloaded from torrents, not in the page loading
- Look-alike addresses
- Many addresses copy the name, for example 1337x.is or 1337xto.to, which people also search for; we did not open them
Our 2021 guide called the site a browser hijacker that arrives with free programs. A website cannot change a browser's start page by itself being opened; a program or extension on the computer does that, and the site may be only the address it sends you to. The rest of this page separates the two.
Why the 1337x search engine is not working and what 13377x is
When the 1337x search engine is not working, the cause is usually on the way to the site, not on your PC.
In our October 2026 test the address answered with a Cloudflare bot check, and a page stuck on that check never shows search results. Some internet providers also block torrent sites by court order. Our reading is that a failed search is not a sign of infection, so there is nothing to remove.
Do not fix a broken search by installing a "1337x search" extension or an unblocker app. Such tools often change your start page and search engine, which is the hijack this guide helps you undo. If your search page changed on its own, open your browser's search engine settings and set the one you chose back. Then remove any extension you do not recognise.
Search engine 13377x is a misspelling of 1337x with an extra 7. We found no reliable source that ties a real service to that spelling. Typo addresses like this are often parked domains that show ads or redirect you to other sites. If a misspelled name opens a page that asks you to allow notifications, choose Block, and take back any permission you already gave in your browser's site settings.
Is 1337x.to dangerous?
Our test on 6 October 2026
We loaded https://1337x.to/ in a clean desktop Chromium browser from Lithuania, with no extension and no account, and did not click anything. We never got past the site's bot check, so this test says almost nothing about the site itself.
1337x.to home page · desktop Chromium · Lithuania (EU) · 6 October 2026
- Page answeredStatus 403 with the title "Just a moment...": a Cloudflare page headed "Performing security verification" that checks whether a visitor is a bot.
- The real pageNot seen. Our automated browser did not pass the check, so we saw none of the site's own content or ads.
- Notification requestNone on this one visit, but the page that loaded was only the check page.
- Pop-ups and redirectsNone on this one visit; the address stayed
https://1337x.to/. - Ad networksNone identified. Only Cloudflare's own challenge addresses were contacted, so this says nothing about the ads the real page shows.
Not tested Nothing on this one visit is not the same as nothing there. We saw only a bot check, and ad networks choose what to show by country, device, a delay or a second visit. Treat the site as one whose ads can lead off it, as the 2020 notification in our old picture did.
What changed since our 2021 report
June 2021
Our first guide: a torrent site and a "hijacker"
We published the guide on 4 June 2021 and updated it on 16 June 2021. It described the site as a torrent search with a search box and quick links to games, music, applications, anime and documentaries, and as a hijacker that changes browser settings.
The 1337x start page and a panel of the software the site says it runs, from our 2021 guide. 2020 to 2021
A casino notification in the browser
Our picture shows a Chrome notification labelled "1337x.to" in Korean, offering a free spin on a slot machine. That is what a notification ad looks like: it comes from a site the visitor allowed, it is not a message from Windows or Chrome, and it is an advertisement for a casino.
A Chrome notification marked 1337x.to advertising a slot machine, from our 2021 guide. The picture is a collage with a stock photo of a woman. 1 November 2022
The registry record starts
The domain registration record for 1337x.to shows it as registered on 1 November 2022, last changed on 18 April 2023 and paid until 5 April 2030; the registrar is Tonic. That is later than our 2021 guide, so the address we described in 2021 was registered again or moved. The record does not show who runs it today.
6 October 2026
Our new check: a bot check, nothing else
Our test browser met Cloudflare's verification page and nothing of the site.
Look-alike addresses
The name 1337x is used on many addresses, and which one is genuine can change. We opened only 1337x.to, so we say nothing about the others.
| Address you see | What we know |
|---|---|
1337x.to | The address we tested. Registered 1 November 2022 according to its record; on 6 October 2026 it answered with a Cloudflare bot check. |
1337x.is | A different domain that people search for. We did not open it and do not know who runs it. |
1337xto.to | A different domain from 1337x.to: the extra letters before .to make it another name. We did not open it. |
| Any other name that contains "1337x" | Not proof of anything. Anyone can register a close name, and a clone can show different ads or serve different files. |
| A page that reached you from an ad, pop-up or email | Treat it as unknown, however much it looks like the site. |
The FTC explains that fake pages copy a real brand to collect passwords or card numbers or to push a download. Read the address bar before you type a sign-in or any detail, and use a sign-in password you use nowhere else.
The real risks, from most to least serious
"1337x.to virus" is not an accurate name: loading the page installs nothing. These are the ways a visit or a download can still go wrong, in the order we would worry about them.
- High
Running a file from a torrent or an ad
Torrents named as cracks, keygens, activators, game "cracks" or full versions of paid software are where adware and trojans are commonly hidden, and a fake player or update from an ad is the same trap. Our 2021 guide also said that some ransomware families, which it named Copa and Kolz, spread through torrent files; we could not confirm that, but the warning stands for any program file that comes with a film or a song.
- Medium
Clicking Allow on a notification request
One click lets the page send adverts to the desktop until the permission is removed, and the adverts keep arriving after the visit. The casino notification in our 2021 picture is an example.
- Medium
Redirects and pop-up ads
Ads can open new tabs or take the current tab to another address. Our 2021 guide said that most ads it saw were for casinos, adult sites or other torrent sites; we cannot repeat that count, because it came from a third party, and we saw no ads in 2026. The point stands that an ad is chosen by whoever pays for the traffic that day.
- Medium
Adult links without an age check
Our 2021 guide said a quick link on the start page led to adult content without an age check. We could not open the page in 2026, so we cannot say if it still does. Such pages carry ads of the worst kind and are a common starting point for scam pages.
- Medium
Mislabelled or infected downloads
A torrent is uploaded by a stranger and only its uploader knows what it holds. A video that asks for an extra codec or player is a trap.
- Low
Copyright
Downloading a film, episode, album, game or program from a torrent without the owner's permission infringes copyright in many countries, and some internet providers pass on warnings. Torrents of public-domain, open-source and openly licensed files are different.
File types that a film, show or song torrent should never contain
- .exe
- .msi
- .scr
- .bat
- .cmd
- .lnk
- .js
- .vbs
A video torrent normally holds .mkv, .mp4 or .avi plus subtitles; music holds .mp3 or .flac. If you only see one of the types above, delete it without opening it.
Accounts, cookies and what a site can learn
Our 2021 guide listed what tracking cookies of such programs collect and warned about registering on the site. We did not read the site's own privacy policy in 2026, because we could not open the site, so the list below is what any site with ads and accounts can collect, not what 1337x.to does.
What a torrent site with ads and accounts can see
- Your IP address
- Which listings you open and search for
- Cookies and similar identifiers from the site and its ad networks
- Browser and device details
- A user name, password, email address and country if you register
The 2021 picture shows the registration form: it asks for a user name, a password, an email address and a country. A password used on the site must not be one you use anywhere else, and a main email address is better not given.
How the changed start page and search engine get there
Programs that change the start page, search engine, new tab or toolbars, and open sites like this one, arrive inside installers and with downloads. Our 2021 guide described these as browser hijackers.
- 1
A free tool is downloaded
A converter, a downloader, a video player, a cracked program or a torrent "setup" file, from a site that is not the maker's.
- 2
The setup hides a choice
The quick path (Recommended, Express or Next) accepts bundled add-ons, toolbars or a second program. The Custom or Advanced path shows them and lets you untick them.
- 3
The add-on changes the browser
It replaces the start page, search provider or new tab, adds toolbars, slows the browser and sends visits to affiliate addresses, which is where an address such as
1337x.tocan come in.
Fake scanners work the other way round: a page says a virus has been found and offers a free antivirus. Running it installs the unwanted program, spyware or a trojan. A web page cannot scan your computer, and neither Windows nor your browser is updated by a page.
How to remove 1337x.to
How to stop the 1337x.to redirects
Work in this order and test a few links after each step, so you know which one was the cause.
Which browser shows the ads?
Remove extensions you do not recognise
Paste
chrome://extensionsinto the address bar and click Remove on anything you did not install yourself, especially torrent clients or tools, "search" or PDF helpers added recently.Full procedure with screenshots: Remove a browser extension
Clear the site data
Press Ctrl + Shift + Delete, choose All time, tick Cookies and other site data and Cached images and files, and click Delete data.
Reset Chrome
Open Settings > Reset settings > Restore settings to their original defaults and confirm with Reset settings. This resets the start page, search engine and pinned tabs and turns off extensions; bookmarks and saved passwords stay. To stop notifications after you close Chrome, also turn off Settings > System > Continue running background apps when Google Chrome is closed.
Full procedure with screenshots: Reset a browser and fix a hijacked search engine
Remove extensions you do not recognise
Paste
edge://extensionsinto the address bar and click Remove under anything you did not install yourself.Full procedure with screenshots: Remove a browser extension
Clear the site data
Open Settings > Privacy, search, and services > Delete browsing data > Choose what to clear, set All time, tick Cookies and other site data and Cached images and files, and click Clear now.
Reset Edge
Open Settings > Reset settings > Restore settings to their default values and confirm with Reset. Extensions are turned off and the start page goes back to default; favourites, history and saved passwords stay. To stop notifications after you close Edge, turn off Settings > System and performance > Continue running background extensions and apps when Microsoft Edge is closed.
Full procedure with screenshots: Reset a browser and fix a hijacked search engine
Remove add-ons you do not recognise
Paste
about:addonsinto the address bar, open Extensions, and choose Remove from the three-dot menu of anything you did not install yourself.Full procedure with screenshots: Remove a browser extension
Clear cookies and site data
Open Settings > Privacy & Security > Cookies and Site Data > Clear Data, tick both boxes and click Clear.
Refresh Firefox
Open the menu > Help > More troubleshooting information and click Refresh Firefox. Add-ons and custom settings are removed and the home page goes back to default; bookmarks, history and passwords stay.
Full procedure with screenshots: Reset a browser and fix a hijacked search engine
Take back the notification permission
Safari 18 and later on macOS: open Safari > Settings > Websites > Notifications, select
1337x.to(or any site you do not recognise) and set it to Deny, or click Remove. Untick Allow websites to ask for permission to send notifications at the bottom so no site can ask again.Remove extensions you do not recognise
In Safari > Settings > Extensions, select anything you did not install yourself and click Uninstall.
Clear the site data
In Safari > Settings > Privacy > Manage Website Data, remove the site's data, or use History > Clear History > all history. To empty the cache as well, turn on Show features for web developers in Settings > Advanced and choose Develop > Empty Caches.
Check the Mac for apps from the ads
Ads also target Mac users with fake players and "cleaners". In Finder > Applications, move anything unknown to the Bin. In System Settings > General > Login Items & Extensions, remove unknown items. Then use Go > Go to Folder to check
/Library/LaunchAgents,~/Library/LaunchAgents,/Library/LaunchDaemonsand/Library/Application Supportfor folders and files with the same unknown names, and empty the Bin.
Then, whichever browser you use
Step 1: Scan the PC if you downloaded anything from the ads
Most people who only saw the notifications can skip this step. If a notification or the page it opened made you download or run a file, delete the file and run a full scan, then a Microsoft Defender Offline scan.
In Windows 11 and Windows 10 open Windows Security > Virus & threat protection > Scan options, select Microsoft Defender Antivirus (offline scan) and click Scan now. The PC restarts and the scan takes about 15 minutes, so save your work first.
Windows 11: Windows Security > Virus & threat protection > Scan options. Full procedure with screenshots: Run a Microsoft Defender Offline scan
After removal: keep the ads from coming back
If you clicked an ad or ran a file
The browser steps above are enough if all you saw were notifications or redirects. If a page, an ad or a torrent led you to run something, or your start page or search engine changed, do these three things as well.
- 1
Uninstall what came with it
Open Settings > Apps > Installed apps in Windows 11 (Apps & features in Windows 10), sort by install date and uninstall anything you installed on the day the problem began, and anything you do not remember choosing (Uninstall a program or app in Windows On uGetFix).
- 2
Scan, then scan offline
Run a Microsoft Defender Full scan, then the Microsoft Defender Antivirus (offline scan), which restarts the PC and checks it before Windows starts, where trojans and backdoors that hide in a running system are easier to see.
- 3
Reset the browser
Hijackers change the start page, search engine, new tab and extensions. Use the reset step for your browser above, and then check the start page and search engine once more by hand.
A removal does not always put the system back as it was: programs of this kind can leave extra entries and settings behind. If the PC is slow or odd after the scan, check Startup apps in Task Manager and the installed apps again. If you typed a password, card number or other details into a page an ad opened, change that password now and call your bank about the card.
How to keep it from happening again
Do
- Turn off notification requests: in Chrome, Settings > Privacy and security > Site settings > Notifications > Don't allow sites to send notifications.
- Get programs only from their makers' sites or the Microsoft Store, not from a torrent or a download page.
- When an installer offers Custom or Advanced setup, choose it and untick extra programs and pre-ticked offers; read the licence and privacy text first.
- Keep Microsoft Defender SmartScreen on, or Chrome's Enhanced protection: both warn before known malicious pages and downloads. A security program from a known maker also helps to block malware before it runs.
- Keep a current backup of your files (File History or OneDrive), so an infection or a failed disk does not cost you your documents.
- On public networks, a VPN hides your IP address from the sites and ad networks you visit; it does not block ads or malware, and it does not make a download safe.
Don't
- Click Allow on a page that says you must allow notifications to continue, to prove you are not a robot or to see a download.
- Run an
.exe,.msior.scrfile that a film, show or song torrent gave you. - Click the large "Download", "Play" or "Start" buttons that sit around a torrent listing: they are ads, not the file.
- Believe a page that says your computer is infected or needs an update.
- Use a password on a torrent site that you use anywhere else.
- Trust ads on torrent, file-conversion and adult sites: they are used for drive-by downloads and browser hijacking.
Safer ways to get what you are looking for
Start from the owner's own site: you get the file the maker intended, with no third-party ads between you and it.
| You want | Where to get it |
|---|---|
| A Linux system or open-source program | The project's own download page; many offer their own official torrent |
| Films, shows and music | A licensed streaming or purchase service; your library may lend them free |
| Old films, books and recordings in the public domain | The Internet Archive |
| Games | The publisher's store or a store such as the Microsoft Store, Steam or GOG |
| Paid software | The maker's site; ask for a free trial or a free alternative instead of a crack |
If you do use a torrent site, use a browser profile with notifications blocked, close every ad rather than click it, check file types before opening anything and scan a download before you run it.
Questions about 1337x.to
Is 1337x.to safe?
Not entirely, and we could not test it fully. On 6 October 2026 our test browser met a Cloudflare bot check and never reached the site, so we saw no ads, no pop-ups and no notification request, and that proves nothing about a real visitor.
A torrent site lives on advertising, and our 2021 guide showed a casino notification marked with its name. The bigger risk is the files: a torrent is uploaded by a stranger. Use a browser with notifications blocked, close ads instead of clicking them, and never run an .exe or .scr file that comes with a film, song or game.
Does 1337x.to have a virus?
No, the website itself is not a virus, and opening it installs nothing. What people call the 1337x.to virus are the redirects, pop-ups, notification adverts and changed browser settings seen around it, and those come from ads or from a program installed with something else.
If your start page or search engine was changed, look for a program or extension that did it. Check Installed apps in Windows and your browser's extensions, run a Microsoft Defender full scan and the offline scan, and then reset the browser.
How do I stop 1337x.to notifications and pop-ups?
Remove the site from the list of sites allowed to send notifications in your browser. In Chrome open chrome://settings/content/notifications, in Edge edge://settings/content/notifications, and in Firefox Settings > Privacy & Security > Permissions > Notifications > Settings. Delete 1337x.to, www.1337x.to and any address you do not recognise, and block them so they cannot ask again.
Do this in every browser and profile you use. Nothing needs uninstalling for this. If pop-ups keep coming from changing addresses, check the extensions and installed apps.
Is 1337x.is or 1337xto.to the same site?
Not necessarily. 1337x.is and 1337xto.to are different domains from 1337x.to, even though people search for them with the same name. We opened only 1337x.to, so we cannot say who runs the others, what they show or what they serve.
A close name proves nothing, because anyone can register one, and a clone can carry other ads or other files. Do not sign in or use a password you use elsewhere on an address you reached through an ad, pop-up or email, and read the address bar before you type anything.
Why did my browser's start page or search engine change?
A program or extension on the computer changed it, not the website. It usually arrived with a free tool, a downloader, a cracked program or a torrent setup file, inside the quick or Recommended install path that accepts bundled add-ons.
Open Installed apps and sort by install date, remove programs you do not remember choosing, remove unknown extensions, and run a Defender full and offline scan. Finish by resetting the browser, which restores the start page and search engine, and then check both by hand.
Can a torrent site infect my computer?
Visiting a torrent page does not install a program by itself, but what you run from it can. Fake players, codecs and updates offered by ads, and program files inside a film, show or song torrent, are the usual route to adware, trojans and sometimes ransomware.
Our 2021 guide named two ransomware families spread through torrents; we could not confirm them, so we only say that any .exe, .msi or .scr file in a media torrent should be deleted unopened. Scan every download before you run it.
Is it legal to use 1337x.to?
A torrent search site lists links, and whether using it is legal depends on what you download and where you live. Downloading a film, episode, album, game or paid program without the owner's permission infringes copyright in many countries, and some internet providers pass on warnings.
Torrents of public-domain, open-source and openly licensed files are different. We are not lawyers, and we did not read the site's own terms in 2026 because we could not open the site. Check the law where you live before you download.
Do I need a VPN for 1337x.to?
A VPN is not needed to make the site or its downloads safe. It hides your IP address from the sites and ad networks you visit and encrypts your traffic on public networks, which is a privacy gain.
It does not block ads, notification requests, pop-ups or malicious files, and it does not make a torrent safe to open. Notification permission, browser extensions and the files you run are the real risks, and a VPN changes none of them. Keep Defender SmartScreen on and check file types before opening a download.
What is the safest way to get what I am looking for?
Start at the owner's own site. For open-source programs and Linux systems, use the project's download page, and many offer an official torrent.
For films, shows and music use a licensed streaming or purchase service, or your library; for old recordings and books in the public domain use the Internet Archive; for games the publisher's store, the Microsoft Store, Steam or GOG.
For paid software ask for a free trial or a free alternative instead of a crack. You then avoid third-party ads and unknown uploaders entirely.
Will Fortect remove 1337x.to?
Fortect scans Windows for malware and unwanted programs and repairs the system files and settings they change, and its free scan shows what it finds on your PC before you decide anything.
For 1337x.to, follow the plan above as well: the browser steps take back permissions and settings that no scanner treats as a threat, and uninstalling the program that brought it removes the source.
Run Microsoft Defender's full scan and, if anything was found, its offline scan as a second opinion. If the symptoms are gone after the plan and both scans are clean, there is nothing more to do.
Sources
- RDAP lookup: 1337x.to registration record (read October 6, 2026)
- PCrisk: 1337x.to ads removal guide (read October 6, 2026)
- Google Chrome Help: Use notifications to get alerts (no longer online) (read October 6, 2026)
- FTC: How to recognize, remove and avoid malware (read October 6, 2026)