The scan of l.top on 15 Aug 2026 reached no verdict either way (score 12). Too little was captured to judge it, which is an unknown rather than a pass.

What malware is associated with l.top?

5 analysed samples communicate with this URL.

How was l.top checked?

A static pass resolved DNS, captured TLS and headers and followed the redirect chain, and where the fast tier allows, a headless browser rendered the page and recorded every request. Egress is SSRF-locked. Signatures that matched only page text are weighted far below one that matched a served file, because a page documenting malware matches the same rules.

l.top - URL scan, 15 Aug 2026

MalwareAnalyzer by Cyble scanned l.top and returned a unknown verdict (score 12). 1 domain and 0 IPs were contacted. 5 malware samples communicate with this URL. This is a point-in-time observation from 15 Aug 2026; the page may have changed since.

Scan result

Verdict: unknown (score 12) · Confidence 18%
Scanned URL: https://l.top/
Domain: l.top
Scan tier: fast · observed 2026-08-15 07:46:17 UTC

Malware communicating with this URL (5)

These samples were observed contacting or being served from l.top. Each links to its full analysis.

bf50405c693aa24c441c04fc5460d865a1d5f297115c96b483b8c9c35dc81187 - referenced · bf50405c693aa24c441c04fc5460d865 · first seen 2026-08-15
popper.min.js - referenced · e290dc4993b9ae7d34440db26be412b4 · first seen 2026-08-15
9ec3f1c174a58929296ade5ee480108d74f1c29298c7b8a53a4f4680614f370a - referenced · 9ec3f1c174a58929296ade5ee480108d · first seen 2026-08-15
b5c8f7eafa889b373e76c0183903323ecc4c6873ef06f979f60dded1a4d9e3cc - referenced · b5c8f7eafa889b373e76c0183903323e · first seen 2026-08-12
4edd6e0bd9a145346a9777c16a62a2e20e0dbbf07e4e8db43417a62ee96ab0b7 - referenced · 4edd6e0bd9a145346a9777c16a62a2e2 · first seen 2026-08-11

Why this verdict

Abuse-heavy TLD .top
Target did not respond (DNS/connection failure or timeout); verdict from URL structure only

Observed indicators

l.top
https://l.top/

Other scans of l.top (3)

This host has been scanned before. Each scan is a separate observation, so a verdict here does not carry over to the others.

23 Aug 2026 - unknown
22 Aug 2026 - unknown
12 Aug 2026 - unknown

Questions about l.top

Is l.top safe?: The scan of l.top on 15 Aug 2026 reached no verdict either way (score 12). Too little was captured to judge it, which is an unknown rather than a pass.
What malware is associated with l.top?: 5 analysed samples communicate with this URL.
How was l.top checked?: A static pass resolved DNS, captured TLS and headers and followed the redirect chain, and where the fast tier allows, a headless browser rendered the page and recorded every request. Egress is SSRF-locked. Signatures that matched only page text are weighted far below one that matched a served file, because a page documenting malware matches the same rules.

Scanned at the fast tier - see how URL scanning works.

Scan another URL · Latest analyzed threats · All scans of l.top

Scanned on MalwareAnalyzer by Cyble · Open interactive scan