The scan of txa.pl on 19 Aug 2026 reached no verdict either way (score -2). Too little was captured to judge it, which is an unknown rather than a pass.

What malware is associated with txa.pl?

1 analysed samples communicate with this URL, including Zusy.

How was txa.pl checked?

A static pass resolved DNS, captured TLS and headers and followed the redirect chain, and where the fast tier allows, a headless browser rendered the page and recorded every request. Egress is SSRF-locked. Signatures that matched only page text are weighted far below one that matched a served file, because a page documenting malware matches the same rules.

txa.pl - URL scan, 19 Aug 2026

MalwareAnalyzer by Cyble scanned txa.pl and returned a unknown verdict (score -2), categorised as credential-harvest. The page resolved to 77.79.227.242 on ATMAN Network ECO-Servers in PL. 3 domains and 1 IP were contacted. 1 malware sample communicates with this URL (Zusy). This is a point-in-time observation from 19 Aug 2026; the page may have changed since.

Scan result

Verdict: unknown (score -2) · Confidence 8%
Scanned URL: https://txa.pl/
Domain: txa.pl · IP: 77.79.227.242 · AS57367 · PL
Server: Caddy
Page title: Oferta domeny txa.pl
HTTP status: 200 · text/html; charset=utf-8
TLS issuer: C=US, O=Let's Encrypt, CN=YE2 · valid to Oct 25 10: · subject CN=txa.pl
Scan tier: fast · observed 2026-08-19 21:51:09 UTC

Malware communicating with this URL (1)

These samples were observed contacting or being served from txa.pl. Each links to its full analysis.

Zusy - referenced · 9151934fd7f28da15c9fcb2158635b8a · first seen 2026-08-19

Antivirus & YARA (0 of 47 engines)

No engine flagged this page's content.

Why this verdict

Valid TLS, no impersonation or off-origin credential post
Credential-harvesting form

Detected technologies

Caddy

Contacted infrastructure

77.79.227.242 - AS57367 ATMAN Network ECO-Servers (Poland)

Observed indicators

txa.pl
fonts.googleapis.com
ddregistrar.pl
77.79.227.242
https://txa.pl/
https://fonts.googleapis.com/css2?family=Inter:wght@400;600;700&display=swap
https://txa.pl/static/fav/favicon.ico
https://txa.pl/static/fav/favicon-32x32.png
https://txa.pl/static/fav/favicon-16x16.png
https://txa.pl/static/fav/apple-touch-icon.png
https://txa.pl/static/fav/android-chrome-192x192.png
https://txa.pl/static/fav/android-chrome-512x512.png
https://ddregistrar.pl/regulamin/polityka-prywatnosci/
https://ddregistrar.pl/

Questions about txa.pl

Is txa.pl safe?: The scan of txa.pl on 19 Aug 2026 reached no verdict either way (score -2). Too little was captured to judge it, which is an unknown rather than a pass.
What malware is associated with txa.pl?: 1 analysed samples communicate with this URL, including Zusy.
How was txa.pl checked?: A static pass resolved DNS, captured TLS and headers and followed the redirect chain, and where the fast tier allows, a headless browser rendered the page and recorded every request. Egress is SSRF-locked. Signatures that matched only page text are weighted far below one that matched a served file, because a page documenting malware matches the same rules.

Scanned at the fast tier - see how URL scanning works.

Scan another URL · Latest analyzed threats · All scans of txa.pl

Scanned on MalwareAnalyzer by Cyble · Open interactive scan