ytmp3.cx and ytmp3.ai: two addresses, one destination, checked on 16 September 2026

ytmp3.cx and ytmp3.ai in one sentence

Type either address and you do not stay there. On 16 September 2026, ytmp3.cx and ytmp3.ai each answered with a single 301 redirect to convertytmp3.org, and the page that came back was the same file both times: 7,621 bytes, the same checksum, the same title. They are not two services to choose between, but two old front doors pointing at one current one.

Below is what we typed, what came back, and where published safety reporting stops. Every address we checked sits on the ytmp3 sites index.

What we saw on 16 September 2026

Each address was requested over HTTPS with a desktop Chrome user agent, following redirects. The http:// and www. forms behaved identically: one hop, then HTTP 200.

The destination runs to 222 visible words and offers MP3 and MP4 only, described as MP3 (up to 240 minutes / 192 kbps) and MP4 (up to 30 minutes / 360p), with an FAQ saying the quality cannot be changed. Its canonical tag names convertytmp3.org, not either address you typed. Nothing on it asked us to install an app; its navigation ran Home, FAQ, Add-on and Bookmarklet.

ytmp3.cx

RDAP, read that morning, gives a registration date of 13 March 2021 and an expiry in March 2027. The registrar is CentralNic Ltd and the nameservers are run by Njalla, a privacy-oriented provider. The certificate the domain presented was issued by Let's Encrypt on 31 August 2026, sixteen days before our check, which points to a name still being maintained rather than one left to lapse.

The Internet Archive's earliest capture, 8 May 2024, shows ytmp3.cx hosting its own converter rather than a redirect: 162 words, and copy saying it converted videos up to 90 minutes, always at the highest available quality. Neither statement matches today's destination. By the most recent capture, 8 December 2025, it served no page of its own: the address had become a 301 to ytmp3.ai.

urlscan.io holds 48 scans whose final landing domain was ytmp3.cx, from 12 May 2024 to 29 October 2025, across three IP addresses. Scans submitted against ytmp3.cc were already ending on ytmp3.cx by 22 June 2024, which is the link to the address most people remember; more on our ytmp3.cc page. A urlscan.io scan of 1 September 2025 records a JavaScript file served at /sw.js with version, publisher and zone parameters.

ytmp3.ai

This one is young. RDAP gives a registration date of 11 July 2025, a transfer that October and an expiry in 2029. The registrar is Realtime Register B.V., the nameservers differ from those on ytmp3.cx, and its registrant contacts all read Privacy Protect. Its certificate comes from DigiCert's RapidSSL authority, not the Let's Encrypt one on ytmp3.cx, though both names resolve to the same machine.

The archive record is short, as a July 2025 registration implies. The earliest capture, 1 November 2025, shows ytmp3.ai running its own converter at 219 words, with the same 90-minute limit ytmp3.cx had used eighteen months before. The latest, 14 May 2026, is a 301 to yt2mp3.gs. urlscan.io agrees: scans landed on ytmp3.ai from 1 November 2025 to 27 February 2026, then on ytmp3.gs, then yt2mp3.gs, then convertytmp3.org from 29 June onward.

Are they the same site?

Here is what we can show. Both addresses resolve to 88.80.22.66, and a reverse lookup of that address returns convertytmp3.org. ytmp3.cx and convertytmp3.org list the same three Njalla nameservers, and convertytmp3.org was registered only on 27 June 2026.

Here is where we stop. The registry records for all three addresses name no person and no company, so we cannot tell you who runs them. Shared destination is a fact; shared ownership is a guess.

Two points of care. Comparitech's write-up on the .cc address describes a similar run of moves and says it would be highly unusual for a legitimate business to change address four times in under twelve months. It names a first hop we could not find, on a suffix that is not a delegated top-level domain, so it is that publication's account, not confirmation of ours. Second, not every ytmp3 address is in this group: the same day, ytmp3.nu redirected elsewhere on a different IP, covered on our ytmp3.nu page. TorrentFreak wrote of blocked ripper domains in June 2026 that they are not the original sites that operated under these names.

Is ytmp3.cx safe? Is ytmp3.ai safe?

We did not run either address through an antivirus product or complete a conversion. We fetched the pages, read the script they load, and the files it refers to.

At page load the destination is clean in a narrow sense: no service worker registration, no notification request, no reference to any ad or push network we searched for. On its own that finding would mislead. The single script it loads hands the conversion to a separate host, epsiloncloud.org, named in the file only as a base64 string, and it injects a third-party advertising script from the host 9hito.com once you click Convert. That injected file returned 63,294 bytes of obfuscated JavaScript containing the strings ServiceWorker, Notification, Push and Subscribe. Separately, convertytmp3.org/sw.js returns a live service worker whose whole job is to import a script from another host. We are describing code, not labelling companies. The point is simple: the quiet page you land on is not the page you get after you press Convert.

Published reporting describes what that kind of layer does in practice, though every write-up we verified concerns a different address in this family. MalwareTips says of ytmp3.cc that the site tries to trick you into subscribing to its push notifications, and PCrisk that it opens pages that demand permission to enable notifications. ExpressVPN reports that visitors to that address are bombarded with pop-ups and redirects to third-party sites, while Moonlock is careful to say Ytmp3.cc itself is not a virus. Softorino concludes of the brand generally that YTMP3 is not safe as a regular YouTube-to-MP3 workflow in 2026. None of them names .cx or .ai.

Against that, PCrisk's URL scanner reported on 2 September 2026 that convertytmp3.org came back as "No Threats Found", with one engine out of 91 flagging it. That is one aggregator on one day, not a standing verdict, but the current destination is not broadly blocklisted.

A short checklist, whichever converter you use:

• Check the address bar once the redirect settles. If the name you typed has gone, you are on someone else's page.
• Refuse notification prompts. Chrome blocks pop-ups by default, so a stream of them afterwards usually means something was granted permission; Chrome's notification settings show where to take it back, and our ytmp3 pop-ups page has the steps for each browser.
• Treat a Download button that appears before the conversion finishes as an advert.
• YouTube's terms say you are not allowed to access, reproduce, download content except as expressly authorised.

If you came here for a converter

This site runs one. Paste a single YouTube link and you get an MP3 at 192 to 320 kbps, or the video as MP4 at up to 1080p. One video per link, no playlists, no account, no adverts, no app to install, and we never ask permission to send notifications. What we keep is set out in our privacy notice, and rights holders can reach us on the DMCA page. Otherwise, paste a link on the home page.