Is offerup.com legit?
OfferUp.com appears to be a trusted platform with robust technical infrastructure and good security practices. While it has some minor branding omissions and its bot protection limited some checks, the core elements of trust are well-maintained.
Marketplace average: 77/100 · based on 15 sites
Checked: April 27, 2026 at 11:09 PM UTC
Is offerup.com a scam? Here's what we found.
The site uses modern TLS 1.3 encryption with a valid certificate from Google, and Google Web Risk reports no threats, indicating a strong security posture.
With over 23 years of operation, the domain demonstrates significant longevity and stability, even though the registrar is a common one.
The site is not found on any DNS blacklists, which is a positive indicator, though a Trustpilot presence could offer more external reputation insights.
While bot protection prevented checking contact info and social media, the primary branding issue is the missing favicon, which slightly diminishes the polished feel expected from an established company.
The presence of both Privacy Policy and Terms of Service pages demonstrates a commitment to legal compliance regarding user data and site usage.
The site boasts strong infrastructure, including DNSSEC, DMARC, and HSTS, all pointing to a well-configured and resilient online presence.
Signals Detected
This site has moderate global traffic
No structured data markup found
Domain created 2002-09-24T07:52:22Z (23 years, 11 months ago)
Registered through GoDaddy Corporate Domains, LLC
Expires in 150 days
DNSSEC status from WHOIS
Valid certificate, expires in 56 days
Certificate issued by Google Trust Services
Connection uses TLS 1.3
No favicon found — unusual for an established business
This business has no Trustpilot presence — not unusual for smaller or newer companies
Resolves to: 104.18.35.135, 172.64.152.121
Mail servers: us-smtp-inbound-1.mimecast.com., us-smtp-inbound-2.mimecast.com.
Domain has DMARC email authentication configured
DNS providers: jobs.ns.cloudflare.com., alice.ns.cloudflare.com.
No sitemap found — common for smaller sites
Site enforces HTTPS via HSTS
X-Frame-Options: SAMEORIGIN
Web server: cloudflare
No threats detected by Google Web Risk
No robots.txt file — common for small sites
Website returned HTTP 403 — likely WAF or bot protection blocking automated checks. The site is online but restricts non-browser access.
Bot protection prevented page inspection
Website has both privacy policy and terms of service pages
Bot protection prevented page inspection
Not found on any DNS blacklists
Could not query Wayback Machine
Could not query certificate transparency logs
Fast page load
Stay Safe Online
Good habits to protect yourself, no matter the scan result.
Never reuse passwords across sites.
Add a second layer of security to your accounts.
Always verify unfamiliar stores before entering payment info.