Triggers a snort rule that usage of a .top domain is an indicator of compromise. May be a false positive. Surprised there are no false positive reports on the primary snort website. Interesting since I did not click this article, yet used the Octal8 client to read ycombinator. Wondering if this is a good link or not. Will check it out later.