Because the official domain ( 1337x.to ) is often blocked by ISPs, many "fake" mirror sites (e.g., 1377x.to ) exist specifically to distribute malware or steal user data.