a.top - URL scan, 15 Aug 2026
MalwareAnalyzer by Cyble scanned a.top and returned a unknown verdict (score 0). The page resolved to 3.33.130.190 on Amazon Technologies Inc. in US. 1 domain and 1 IP were contacted. 18 malware samples communicate with this URL. This is a point-in-time observation from 15 Aug 2026; the page may have changed since.
Scan result
- Verdict: unknown (score 0) · Confidence 6%
- Scanned URL:
https://a.top/ - Domain: a.top · IP: 3.33.130.190 · AS16509 · US
- HTTP status: 200 · text/html
- TLS issuer: C=US, O=GoDaddy.com, CN=GoDaddy TLS Intermediate CA DV - R1v1 · valid to Dec 20 23: · subject CN=a.top
- Scan tier: fast · observed 2026-08-15 00:34:52 UTC
Malware communicating with this URL (18)
These samples were observed contacting or being served from a.top. Each links to its full analysis.
- popper.min.js - referenced ·
e290dc4993b9ae7d34440db26be412b4· first seen 2026-08-15 - 9ec3f1c174a58929296ade5ee480108d74f1c29298c7b8a53a4f4680614f370a - referenced ·
9ec3f1c174a58929296ade5ee480108d· first seen 2026-08-15 - 3903731066-lbx__pt_br.js - referenced ·
f7e2bc3ee0d4f9ae4d1267999a73f2e2· first seen 2026-08-12 - 1957234192-lbx__pt_br.js - referenced ·
3fd4edfa4121016e4536c4c49e1bd813· first seen 2026-08-14 - 6f77be7a27a3ea6993b8defa7f61f442aa1284d63924d4cdf6255e0b102fd0ec - referenced ·
6f77be7a27a3ea6993b8defa7f61f442· first seen 2026-08-14 - 3618766451-lbx__en_gb.js - referenced ·
88b4eee071a3e2d8836be1b02ec5b3e1· first seen 2026-08-14 - 998ab20451d9d4322ccabe305b175adf90e81e72b0e0ac6699c6a338c50bb6ea - referenced ·
998ab20451d9d4322ccabe305b175adf· first seen 2026-08-14 - 201988111-lbx__pt_br.js - referenced ·
d31bce676025d141cccecf7dcad29d2a· first seen 2026-08-14 - 3766621756-lbx__pt_br.js - referenced ·
e5823aed4ddaed520ef63a3ab556cae7· first seen 2026-08-12 - f.txt - referenced ·
0a51831b781627f061f6dce695c18a5c· first seen 2026-08-14 - 2028442393-lbx__pt_br.js - referenced ·
d99d1b9d9e7ba7705e74cb4c3c1ef382· first seen 2026-08-13 - fp.v3.js - referenced ·
9aa12d141f3c41629c83ac95bf3bebab· first seen 2026-08-13 - blockly_compressed.js - referenced ·
b3e34ea1b0d8bb10055de06e0e3bf866· first seen 2026-08-12 - codeMirror.bundle.min.js - referenced ·
7b5277fff495c8fc86f70c16bec5efaa· first seen 2026-08-12 - 4142632578-lbx__pt_br.js - referenced ·
78184f664658e232bcc5a34df70420a8· first seen 2026-08-12
Antivirus & YARA
The engine tier did not run for this scan, so its content is unjudged rather than clean.
Why this verdict
- Abuse-heavy TLD .top
- Valid TLS, no impersonation or off-origin credential post
Contacted infrastructure
- 3.33.130.190 - AS16509 Amazon Technologies Inc. (United States)
Observed indicators
- a.top
- 3.33.130.190
- https://a.top/
- https://a.top/lander
Other scans of a.top (8)
This host has been scanned before. Each scan is a separate observation, so a verdict here does not carry over to the others.
- 23 Aug 2026 - unknown
- 23 Aug 2026 - unknown
- 21 Aug 2026 - unknown
- 21 Aug 2026 - unknown
- 20 Aug 2026 - unknown
- 20 Aug 2026 - unknown
- 16 Aug 2026 - unknown
- 12 Aug 2026 - unknown
Questions about a.top
- Is a.top safe?
- The scan of a.top on 15 Aug 2026 reached no verdict either way (score 0). Too little was captured to judge it, which is an unknown rather than a pass.
- What malware is associated with a.top?
- 18 analysed samples communicate with this URL.
- How was a.top checked?
- A static pass resolved DNS, captured TLS and headers and followed the redirect chain, and where the fast tier allows, a headless browser rendered the page and recorded every request. Egress is SSRF-locked. Signatures that matched only page text are weighted far below one that matched a served file, because a page documenting malware matches the same rules.
Scanned at the fast tier - see how URL scanning works.
Scan another URL · Latest analyzed threats · All scans of a.top
Scanned on MalwareAnalyzer by Cyble · Open interactive scan