c.top - URL scan, 20 Aug 2026
MalwareAnalyzer by Cyble scanned c.top and returned a unknown verdict (score 0). The page resolved to 104.21.68.222 on Cloudflare, Inc. in US. The domain was registered 3045 days ago through Dynadot LLC. 2 domains and 1 IP were contacted, over 4 HTTP requests. 38 malware samples communicate with this URL (Gootloader). This is a point-in-time observation from 20 Aug 2026; the page may have changed since.
Scan result
- Verdict: unknown (score 0) · Confidence 6%
- Scanned URL:
https://c.top/ - Domain: c.top · IP: 104.21.68.222 · AS13335 · US
- Server: cloudflare
- Page title: TikTok批量起号 + AI矩阵带货课程 | 2980元/年
- HTTP status: 200 · text/html; charset=utf-8
- Registrar: Dynadot LLC · domain age 3045 days · created 2018-04-19
- Registrant country: CN
- TLS issuer: C=US, O=Google Trust Services, CN=WE1 · valid to Nov 14 07: · subject CN=c.top
- HTTP requests captured: 4
- Scan tier: fast · observed 2026-08-20 23:13:25 UTC
Malware communicating with this URL (38)
These samples were observed contacting or being served from c.top. Each links to its full analysis.
- e5b364ca127b24d904f14450e809284700b94ee3435731d74da7a8a5c422e3cc - referenced ·
e5b364ca127b24d904f14450e8092847· first seen 2026-08-20 - 497c3d3bc4061e06ea844a22b9055f08858688c3e119121be7c571599aea8743 - referenced ·
497c3d3bc4061e06ea844a22b9055f08· first seen 2026-08-20 - f5c1380a5ebbe9ebc15216e4d3d5a90d14baad352dc1dd32052861a2e31142e2 - referenced ·
f5c1380a5ebbe9ebc15216e4d3d5a90d· first seen 2026-08-20 - e4d806696bfe6b69754e9c979d02c986c5b20a7e91bc3b5525aa1ada6289f229 - referenced ·
e4d806696bfe6b69754e9c979d02c986· first seen 2026-08-20 - 3d8b407f6823d3b9dfb08ec1de5362790fc714ce995fafe755483c7e46b12348 - referenced ·
3d8b407f6823d3b9dfb08ec1de536279· first seen 2026-08-20 - bc5cfe0aa2f68e2bae85b914e2902385b015969253e39a9cb6e03ae0c2e91177 - referenced ·
bc5cfe0aa2f68e2bae85b914e2902385· first seen 2026-08-20 - 54b42d5c52e78ee91dfc574d2893c0137f40a9d30bcd45c9bc48bd578729d337 - referenced ·
54b42d5c52e78ee91dfc574d2893c013· first seen 2026-08-20 - e10f2a1e2dd8f9b6de2dba4dc6834c0b89fe52f1fe3918f71cd29529edb5244e - referenced ·
e10f2a1e2dd8f9b6de2dba4dc6834c0b· first seen 2026-08-19 - fe47c899d05a1f5bafd6f9432e67c58fb6091399d6387b70a0fcb541895896b4 - referenced ·
fe47c899d05a1f5bafd6f9432e67c58f· first seen 2026-08-19 - f.txt - referenced ·
5c4ece1f1a97a6ff05e1622f544e1b58· first seen 2026-08-19 - Gootloader - referenced ·
f1cbe5f24bb5373e39fa3abb363f16cf· first seen 2026-08-19 - f.txt - referenced ·
71f8db09aec8b4eb26c6a884d4bf2f98· first seen 2026-08-17 - f.txt - referenced ·
8e3a58508731d3d50693b9eefa594ea7· first seen 2026-08-17 - 73d8de459d4cb33e21e4a2a19a48aa88bbe70c30adc734c618376073b5fdeeb1 - referenced ·
73d8de459d4cb33e21e4a2a19a48aa88· first seen 2026-08-16 - 094c934d46e82b6704887bcfbfc8d1b61f6a1fa0637077b30c02d838057b66cc - referenced ·
094c934d46e82b6704887bcfbfc8d1b6· first seen 2026-08-16
Antivirus & YARA (0 of 47 engines)
No engine flagged this page's content.
Why this verdict
- Abuse-heavy TLD .top
- Valid TLS, no impersonation or off-origin credential post
Detected technologies
- Cloudflare
- Cloudflare Insights
Contacted infrastructure
- 104.21.68.222 - AS13335 Cloudflare, Inc. (United States)
Observed indicators
- c.top
- static.cloudflareinsights.com
- 104.21.68.222
- https://c.top/
- https://c.top/static/css/styles.css
- https://c.top/static/css/nav.css
- https://c.top/static/js/auth.js?v=2026051602
- https://c.top/courses.html
- https://c.top/software.html
- https://c.top/contact.html
- https://c.top/login.html
- https://c.top/register.html
- https://c.top/software.html#software-n_power_video_matrix
- https://c.top/software.html#software-vip_student_downloader
- https://c.top/software.html#software-smart_scene_splitter
- https://c.top/software.html#software-flow_omni_studio
- https://c.top/software.html#software-grok_imagine_batch
- https://c.top/software.html#software-hailuo_international
- https://c.top/software.html#software-higgsfield_tiktok_agent
- https://c.top/software.html#software-runway_tiktok_agent
Other scans of c.top (7)
This host has been scanned before. Each scan is a separate observation, so a verdict here does not carry over to the others.
- 23 Aug 2026 - unknown
- 23 Aug 2026 - unknown
- 21 Aug 2026 - unknown
- 21 Aug 2026 - unknown
- 20 Aug 2026 - unknown
- 20 Aug 2026 - unknown
- 15 Aug 2026 - unknown
Questions about c.top
- Is c.top safe?
- The scan of c.top on 20 Aug 2026 reached no verdict either way (score 0). Too little was captured to judge it, which is an unknown rather than a pass.
- What malware is associated with c.top?
- 38 analysed samples communicate with this URL, including Gootloader.
- How was c.top checked?
- A static pass resolved DNS, captured TLS and headers and followed the redirect chain, and where the fast tier allows, a headless browser rendered the page and recorded every request. Egress is SSRF-locked. Signatures that matched only page text are weighted far below one that matched a served file, because a page documenting malware matches the same rules.
Scanned at the fast tier - see how URL scanning works.
Scan another URL · Latest analyzed threats · All scans of c.top
Scanned on MalwareAnalyzer by Cyble · Open interactive scan