The scan of offset.top on 21 Aug 2026 reached no verdict either way (score 12). Too little was captured to judge it, which is an unknown rather than a pass.

What malware is associated with offset.top?

7 analysed samples communicate with this URL, including Gootloader.

How was offset.top checked?

A static pass resolved DNS, captured TLS and headers and followed the redirect chain, and where the fast tier allows, a headless browser rendered the page and recorded every request. Egress is SSRF-locked. Signatures that matched only page text are weighted far below one that matched a served file, because a page documenting malware matches the same rules.

offset.top - URL scan, 21 Aug 2026

MalwareAnalyzer by Cyble scanned offset.top and returned a unknown verdict (score 12). 1 domain and 0 IPs were contacted. 7 malware samples communicate with this URL (Gootloader). This is a point-in-time observation from 21 Aug 2026; the page may have changed since.

Scan result

Verdict: unknown (score 12) · Confidence 18%
Scanned URL: https://offset.top/
Domain: offset.top
Scan tier: fast · observed 2026-08-21 22:28:37 UTC

Malware communicating with this URL (7)

These samples were observed contacting or being served from offset.top. Each links to its full analysis.

027f51e2373e2dea5bd64f50037a2708150a00914ed9987655a73b4e29c062d9 - referenced · 027f51e2373e2dea5bd64f50037a2708 · first seen 2026-08-21
a138b6e1f54d7a69ea5361529149ed607142893c690bb993b4a15f239c039e2a - referenced · a138b6e1f54d7a69ea5361529149ed60 · first seen 2026-08-20
ecd4762a2fab3af780c45919b2f7c01298e7df04e13820c3e1027790a9eb56f6 - referenced · ecd4762a2fab3af780c45919b2f7c012 · first seen 2026-08-17
11b89592d7d737fed81aa8079faf398af78551fc483ff1273237fb8b97611335 - referenced · 11b89592d7d737fed81aa8079faf398a · first seen 2026-08-16
bb1af9646a123d5376a8422cdaaba5e1b73f4394fbabf86c5416b964a65adfe4 - referenced · bb1af9646a123d5376a8422cdaaba5e1 · first seen 2026-08-15
Gootloader - referenced · 7c83cf241d34c75c75aa1d81bf333aac · first seen 2026-08-15
30781c9ea633021ee4a92768e3df0b462b529c24e143324878dcc841650d03a3 - referenced · 30781c9ea633021ee4a92768e3df0b46 · first seen 2026-08-12

Why this verdict

Abuse-heavy TLD .top
Target did not respond (DNS/connection failure or timeout); verdict from URL structure only

Observed indicators

offset.top
https://offset.top/

Other scans of offset.top (5)

This host has been scanned before. Each scan is a separate observation, so a verdict here does not carry over to the others.

24 Aug 2026 - unknown
22 Aug 2026 - unknown
20 Aug 2026 - unknown
15 Aug 2026 - unknown
12 Aug 2026 - unknown

Questions about offset.top

Is offset.top safe?: The scan of offset.top on 21 Aug 2026 reached no verdict either way (score 12). Too little was captured to judge it, which is an unknown rather than a pass.
What malware is associated with offset.top?: 7 analysed samples communicate with this URL, including Gootloader.
How was offset.top checked?: A static pass resolved DNS, captured TLS and headers and followed the redirect chain, and where the fast tier allows, a headless browser rendered the page and recorded every request. Egress is SSRF-locked. Signatures that matched only page text are weighted far below one that matched a served file, because a page documenting malware matches the same rules.

Scanned at the fast tier - see how URL scanning works.

Scan another URL · Latest analyzed threats · All scans of offset.top

Scanned on MalwareAnalyzer by Cyble · Open interactive scan