The scan of offsets.top on 22 Aug 2026 reached no verdict either way (score 0). Too little was captured to judge it, which is an unknown rather than a pass.

What malware is associated with offsets.top?

3 analysed samples communicate with this URL, including Gootloader.

How was offsets.top checked?

A static pass resolved DNS, captured TLS and headers and followed the redirect chain, and where the fast tier allows, a headless browser rendered the page and recorded every request. Egress is SSRF-locked. Signatures that matched only page text are weighted far below one that matched a served file, because a page documenting malware matches the same rules.

offsets.top - URL scan, 22 Aug 2026

MalwareAnalyzer by Cyble scanned offsets.top and returned a unknown verdict (score 0). The page resolved to 172.67.131.242 on Cloudflare, Inc. in US. 1 domain and 1 IP were contacted. 3 malware samples communicate with this URL (Gootloader). This is a point-in-time observation from 22 Aug 2026; the page may have changed since.

Scan result

Verdict: unknown (score 0) · Confidence 6%
Scanned URL: https://offsets.top/
Domain: offsets.top · IP: 172.67.131.242 · AS13335 · US
Server: cloudflare
Page title: Just a moment...
HTTP status: 403 · text/html; charset=UTF-8
TLS issuer: C=US, O=Google Trust Services, CN=WE1 · valid to Nov 5 08: · subject CN=offsets.top
Scan tier: fast · observed 2026-08-22 07:03:42 UTC

Malware communicating with this URL (3)

These samples were observed contacting or being served from offsets.top. Each links to its full analysis.

773b6f77af06f9f89704763249fc0b433a19e2ad76629e30a407e538e723135e - referenced · 773b6f77af06f9f89704763249fc0b43 · first seen 2026-08-22
a1be19891b68ad0da52007a4aeca67dc004dc1332706c5718628a1a62ea1d833 - referenced · a1be19891b68ad0da52007a4aeca67dc · first seen 2026-08-21
Gootloader - referenced · a219dfaf4b5acc45855fdd5fc1e5278f · first seen 2026-08-19

Antivirus & YARA (0 of 48 engines)

No engine flagged this page's content.

Why this verdict

Abuse-heavy TLD .top
Valid TLS, no impersonation or off-origin credential post

Detected technologies

Cloudflare

Contacted infrastructure

172.67.131.242 - AS13335 Cloudflare, Inc. (United States)

Observed indicators

offsets.top
172.67.131.242
https://offsets.top/
https://offsets.top/cdn-cgi/challenge-platform/h/b/orchestrate/chl_page/v1?ray=a2f004eb2b93185b

Questions about offsets.top

Is offsets.top safe?: The scan of offsets.top on 22 Aug 2026 reached no verdict either way (score 0). Too little was captured to judge it, which is an unknown rather than a pass.
What malware is associated with offsets.top?: 3 analysed samples communicate with this URL, including Gootloader.
How was offsets.top checked?: A static pass resolved DNS, captured TLS and headers and followed the redirect chain, and where the fast tier allows, a headless browser rendered the page and recorded every request. Egress is SSRF-locked. Signatures that matched only page text are weighted far below one that matched a served file, because a page documenting malware matches the same rules.

Scanned at the fast tier - see how URL scanning works.

Scan another URL · Latest analyzed threats · All scans of offsets.top

Scanned on MalwareAnalyzer by Cyble · Open interactive scan