What Gridinsoft observed on Worktop.dev
A Gridinsoft threat analyst reviewed the site directly and documented the evidence behind this decision.
GMA-20260903174001-657d8997
- Reviewed
- by Gridinsoft Threat Analyst
- Analyst finding
- Safe
- Evidence basis
- First-party site analysis External vendor intelligence: Contradictory context — not used for this decision
The independent first-party review did not reproduce phishing, malware delivery, an unrelated redirect, or another malicious behavior in the reviewed current worktop.dev web and software-distribution scope. The exact reported legacy paths were blocked, and no current malicious URL, file, payload, or hash was identified. Retained external warnings were domain-level blacklist categories and were not used to determine this verdict.
Analyst findings
Review 6 documented observations View evidence
The sitemap exposed 26 public pages. Every page returned HTTP 200 at its expected worktop.dev URL. The reviewed pages described a Windows desktop-management utility and its documentation, guides, support, privacy, terms, download, and uninstall flows. No form, password field, file-upload field, iframe, unrelated final redirect, or automatic download was present. Four desktop and mobile user-agent checks returned identical homepage content.
-
HTTP status
200 -
Final URL
https://worktop.dev/ - Page element The public sitemap listed 26 same-site pages covering the product, documentation, guides, support, legal information, downloads, and uninstall instructions.
- Analyst observation No credential-collection form, password input, file-upload input, iframe, unrelated final redirect, or automatic download was observed across the sitemap-listed pages.
The public download page offered WorkTop 1.4.0 for Windows. The same-site download handler redirected to a versioned installer on artifacts.worktop.dev. The retrieved x64 package was a 10,875,256-byte NSIS Windows installer with SHA-256 24a217e4e5b663777ade4e21fc94bd0a2605ba484fb8ca682732529062bbf179. Its embedded Authenticode certificate data named Comunit AB, and its extracted components were consistent with the documented WorkTop desktop utility.
-
HTTP status
200 - Public artifact URL https://artifacts.worktop.dev/releases/1.4.0/worktop-1.4.0-x64-setup.exe
- File SHA-256 24a217e4e5b663777ade4e21fc94bd0a2605ba484fb8ca682732529062bbf179
- MIME type application/vnd.microsoft.portable-executable
- Certificate fact The installer contained an Authenticode PKCS#7 certificate chain whose leaf certificate subject organization and common name were Comunit AB.
- Analyst observation Static package inspection identified an NSIS installer containing the WorkTop application, installation helper, shell-extension library, uninstaller, and third-party license text; it did not expose a phishing page or an unrelated payload URL.
The public update endpoint returned structured metadata for WorkTop 1.4.0 and a versioned update archive on artifacts.worktop.dev. The SHA-256 published by the endpoint exactly matched the downloaded archive, which contained the same named application components as the installer package.
-
HTTP status
200 - Public artifact URL https://artifacts.worktop.dev/releases/1.4.0/worktop-1.4.0-x64-update.zip
- File SHA-256 8e3007f5da0fec12848aaccec8eb06b42d74651c27351e1c8e378afc5937079b
- Analyst observation The endpoint-declared SHA-256 matched the downloaded 12,899,117-byte ZIP archive.
The three specifically reported legacy paths /c5n9/, /7bay/, and /5fqe/ returned HTTP 403 in all twelve tested combinations of HTTP or HTTPS and the root or www host. No content, redirect destination, command response, or payload was served from those paths during the review.
-
HTTP status
403 - Analyst observation All twelve protocol, host, and path combinations for /c5n9/, /7bay/, and /5fqe/ were blocked with HTTP 403 without a redirect.
- Analyst observation No current malicious response or payload was reproduced at the reported legacy paths.
The public archive index contained a December 2021 root-domain capture that rendered a generic parked-domain page, a November 2023 root capture recorded as HTTP 404, and April 2026 captures of the current WorkTop product site. The current RDAP record gave a registration event on January 25, 2026. No archived capture of the three specifically reported legacy paths was found. This supports a material change in domain content but does not independently establish that malware was previously operated on the domain.
-
HTTP status
200 - Page element The December 2021 archived root page was a generic domain-parking page.
- Analyst observation The archive index recorded the root as HTTP 404 in November 2023 and the current WorkTop product site in April 2026.
- DNS fact The current RDAP record reported a registration event at 2026-01-25T20:57:14.051Z.
- Analyst observation No archived capture was returned for /c5n9/, /7bay/, or /5fqe/; the historical review therefore did not confirm a prior live malware gateway or payload.
The root and www hosts served the same product site over HTTPS. Current DNS placed the root, www, and artifact hosts behind Cloudflare, while the checkout link used a Lemon Squeezy storefront on store.worktop.dev. Certificate Transparency showed the current root, wildcard, artifact, and store certificate history beginning after the January 2026 registration event.
- Certificate fact The live certificate covered worktop.dev and *.worktop.dev and was valid during the recorded review.
- DNS fact The root, www, and artifacts hosts resolved through Cloudflare during the review.
-
Final URL
https://worktop.dev/
Scope and limitations
- The Windows binaries were reviewed statically and were not executed in this investigation.
- The result applies to the public pages, download and update flows, exact artifact hashes, and reported legacy paths observed at the recorded time; it does not certify future content or different file versions.
- Public archive evidence confirmed changes in domain content but did not independently confirm the claimed historical malware gateway or any historical payload.
Help protect others by sharing this page on social media! The more people who know about worktop.dev, the fewer chances they have to deceive someone else. Help others evaluate worktop.dev by sharing this page on social media!