a.top - URL scan, 23 Aug 2026
MalwareAnalyzer by Cyble scanned a.top and returned a unknown verdict (score 0). The page resolved to 15.197.148.33 on Amazon Technologies Inc. in US. The domain was registered 4252 days ago through GoDaddy.com. 1 domain and 1 IP were contacted. 42 malware samples communicate with this URL (Smuggling). This is a point-in-time observation from 23 Aug 2026; the page may have changed since.
Scan result
- Verdict: unknown (score 0) · Confidence 6%
- Scanned URL:
https://a.top/ - Domain: a.top · IP: 15.197.148.33 · AS16509 · US
- HTTP status: 200 · text/html
- Registrar: GoDaddy.com · domain age 4252 days · created 2014-12-31
- Registrant country: US
- TLS issuer: C=US, O=GoDaddy.com, CN=GoDaddy TLS Intermediate CA DV - R1v1 · valid to Dec 20 23: · subject CN=a.top
- Scan tier: fast · observed 2026-08-23 03:33:45 UTC
Malware communicating with this URL (42)
These samples were observed contacting or being served from a.top. Each links to its full analysis.
- 1edddbb1f62b69c632c5a558b8a24a4e6531fa5c286a915c854ec865150d5c5b - referenced ·
1edddbb1f62b69c632c5a558b8a24a4e· first seen 2026-08-23 - 225379861f291b792f2c31b00b3998a8dacca2edf56501f9853eb00a5011b118 - referenced ·
225379861f291b792f2c31b00b3998a8· first seen 2026-08-22 - 48977bb365ff0a866a675942f0df2477d9daa8bfcc4bf109fc5c9cea9945d061 - referenced ·
48977bb365ff0a866a675942f0df2477· first seen 2026-08-22 - Smuggling - referenced ·
630d51fd622d82e09c557c6ded08b3cd· first seen 2026-08-22 - 178f58c015c9e29282f6bebc4b55dc5560345ef6659eb79c18609703fbd13a7e - referenced ·
178f58c015c9e29282f6bebc4b55dc55· first seen 2026-08-22 - 6922ab9500e548a2c8b6d9892b80718faed2b617dcfa3c6b3e67970ef29da3ee - referenced ·
6922ab9500e548a2c8b6d9892b80718f· first seen 2026-08-21 - ba17d8c78a3a4efb7f54f00403d1d81b80569d3573b14242bd0b55ecb33c3ede - referenced ·
ba17d8c78a3a4efb7f54f00403d1d81b· first seen 2026-08-21 - 5d2b889a01f761b084546c4ac5fc4c05da23ae6bcb027f68c5719bff4d0f76ee - referenced ·
5d2b889a01f761b084546c4ac5fc4c05· first seen 2026-08-21 - 5a59a539fd641a9bccfb867ed853aeb8a0be17e919164a089598921a010a6d36 - referenced ·
5a59a539fd641a9bccfb867ed853aeb8· first seen 2026-08-21 - 216a769ca8207cf2489353580d73c6084e37300cf6fc7d9bb3bff9e23d688621 - referenced ·
216a769ca8207cf2489353580d73c608· first seen 2026-08-20 - 75dddabf09140ec98f00ece2c32cd9ca0bafd88d70824a7a605af725add5f0cb - referenced ·
75dddabf09140ec98f00ece2c32cd9ca· first seen 2026-08-20 - 47e679c63f027c299be79ebceb4b8d988f6f7cf92f41882d774962916a844bff - referenced ·
47e679c63f027c299be79ebceb4b8d98· first seen 2026-08-20 - f5c1380a5ebbe9ebc15216e4d3d5a90d14baad352dc1dd32052861a2e31142e2 - referenced ·
f5c1380a5ebbe9ebc15216e4d3d5a90d· first seen 2026-08-20 - 74507f058e5690afde02291f4abda58ada51da2a9164bc78ee560e21b0bed683 - referenced ·
74507f058e5690afde02291f4abda58a· first seen 2026-08-20 - f.txt - referenced ·
5c4ece1f1a97a6ff05e1622f544e1b58· first seen 2026-08-19
Antivirus & YARA (0 of 48 engines)
No engine flagged this page's content.
Why this verdict
- Abuse-heavy TLD .top
- Valid TLS, no impersonation or off-origin credential post
Contacted infrastructure
- 15.197.148.33 - AS16509 Amazon Technologies Inc. (United States)
Observed indicators
- a.top
- 15.197.148.33
- https://a.top/
- https://a.top/lander
Other scans of a.top (8)
This host has been scanned before. Each scan is a separate observation, so a verdict here does not carry over to the others.
- 23 Aug 2026 - unknown
- 21 Aug 2026 - unknown
- 21 Aug 2026 - unknown
- 20 Aug 2026 - unknown
- 20 Aug 2026 - unknown
- 16 Aug 2026 - unknown
- 15 Aug 2026 - unknown
- 12 Aug 2026 - unknown
Questions about a.top
- Is a.top safe?
- The scan of a.top on 23 Aug 2026 reached no verdict either way (score 0). Too little was captured to judge it, which is an unknown rather than a pass.
- What malware is associated with a.top?
- 42 analysed samples communicate with this URL, including Smuggling.
- How was a.top checked?
- A static pass resolved DNS, captured TLS and headers and followed the redirect chain, and where the fast tier allows, a headless browser rendered the page and recorded every request. Egress is SSRF-locked. Signatures that matched only page text are weighted far below one that matched a served file, because a page documenting malware matches the same rules.
Scanned at the fast tier - see how URL scanning works.
Scan another URL · Latest analyzed threats · All scans of a.top
Scanned on MalwareAnalyzer by Cyble · Open interactive scan