cygwin.com - URL scan, 19 Aug 2026
MalwareAnalyzer by Cyble scanned cygwin.com and returned a unknown verdict (score -12). The page resolved to 38.145.34.32 on Red Hat, Inc. in US. The domain was registered 9750 days ago through Nom-iq Ltd. dba COM LAUDE. 6 domains and 1 IP were contacted. 27 malware samples communicate with this URL (Genpack, Hoax, Container, Ausiv). This is a point-in-time observation from 19 Aug 2026; the page may have changed since.
Scan result
- Verdict: unknown (score -12) · Confidence 15%
- Scanned URL:
https://cygwin.com/ - Domain: cygwin.com · IP: 38.145.34.32 · AS174 · US
- Server: nginx
- Page title: Cygwin
- HTTP status: 200 · text/html; charset=UTF-8
- Registrar: Nom-iq Ltd. dba COM LAUDE · domain age 9750 days · created 1999-12-09
- TLS issuer: C=US, O=Let's Encrypt, CN=YR1 · valid to Oct 9 13: · subject CN=cygwin.com
- Scan tier: fast · observed 2026-08-19 23:57:12 UTC
Malware communicating with this URL (27)
These samples were observed contacting or being served from cygwin.com. Each links to its full analysis.
- Genpack - referenced ·
7fcf1dc3e823c3319fe8651187a19ff9· first seen 2026-08-19 - Hoax - referenced ·
e4f76bc4ad3e31479e1b529222b98e1f· first seen 2026-08-19 - 44bf1bc2296636f1d5d13f079b232db69cc98ec3e08dbf038b4abfdbe5c05984 - referenced ·
44bf1bc2296636f1d5d13f079b232db6· first seen 2026-08-19 - Genpack - referenced ·
6ac17f5f958f19e717a5411723c37ce9· first seen 2026-08-19 - Genpack - referenced ·
53d2536c7c08d7be8235442b4ee119ac· first seen 2026-08-19 - Container - referenced ·
103104a52e5293ce418944725df19e2b· first seen 2026-08-17 - Genpack - referenced ·
55645c363092d003a978246b75a134cb· first seen 2026-08-17 - Genpack - referenced ·
d6189085fd58281d1e911d42360f3c7a· first seen 2026-08-17 - Container - referenced ·
2a5650c5cdf06928aa787210453f7d13· first seen 2026-08-17 - Hoax - referenced ·
22dbfa6c9c814e692400a4250dc37a89· first seen 2026-08-16 - Ausiv - referenced ·
e0e52afb26074e437668e43217a043ed· first seen 2026-08-16 - HUILoader - referenced ·
07ce232c5ca744280c829ebaa1bbf04f· first seen 2026-08-16 - Autorun - referenced ·
f37ce67d88d899e6385d77dd2ef1ddc0· first seen 2026-08-15 - 8ddd700c118dec6bedb39ec95094630cd76c4cad94a8da68f3363c758d6cac81 - referenced ·
8ddd700c118dec6bedb39ec95094630c· first seen 2026-08-15 - 8bbde540c60676093715b4c8523581084f0f0a5888c5e7597282cd5bce78ec96 - referenced ·
8bbde540c60676093715b4c852358108· first seen 2026-08-15
Antivirus & YARA (0 of 47 engines)
No engine flagged this page's content.
Why this verdict
- Valid TLS, no impersonation or off-origin credential post
Detected technologies
- Nginx
Contacted infrastructure
- 38.145.34.32 - AS174 Red Hat, Inc. (United States)
Observed indicators
- cygwin.com
- x.cygwin.com
- sourceware.org
- www.linuxfoundation.org
- en.wikipedia.org
- www.crouchingtigerhiddenfruitbat.org
- 38.145.34.32
- https://cygwin.com/
- https://cygwin.com/style.css
- https://cygwin.com/index.html
- https://cygwin.com/install.html
- https://cygwin.com/packages/
- https://cygwin.com/licensing.html
- http://x.cygwin.com/
- https://cygwin.com/who.html
- https://cygwin.com/problems.html
- https://cygwin.com/lists.html
- https://cygwin.com/news.html
- https://cygwin.com/irc.html
- https://cygwin.com/goldstars/
Other scans of cygwin.com (10)
This host has been scanned before. Each scan is a separate observation, so a verdict here does not carry over to the others.
- 23 Aug 2026 - unknown
- 23 Aug 2026 - unknown
- 23 Aug 2026 - unknown
- 22 Aug 2026 - unknown ·
http://cygwin.com/cgi-bin2/package-grep.cgi?text=1&grep= - 22 Aug 2026 - unknown
- 22 Aug 2026 - unknown
- 22 Aug 2026 - unknown ·
http://mintty.github.io/ - 22 Aug 2026 - suspicious ·
https://www.mingw-w64.org/ - 22 Aug 2026 - unknown
- 21 Aug 2026 - unknown
Questions about cygwin.com
- Is cygwin.com safe?
- The scan of cygwin.com on 19 Aug 2026 reached no verdict either way (score -12). Too little was captured to judge it, which is an unknown rather than a pass.
- What malware is associated with cygwin.com?
- 27 analysed samples communicate with this URL, including Genpack, Hoax, Container, Ausiv.
- How was cygwin.com checked?
- A static pass resolved DNS, captured TLS and headers and followed the redirect chain, and where the fast tier allows, a headless browser rendered the page and recorded every request. Egress is SSRF-locked. Signatures that matched only page text are weighted far below one that matched a served file, because a page documenting malware matches the same rules.
Scanned at the fast tier - see how URL scanning works.
Scan another URL · Latest analyzed threats · All scans of cygwin.com
Scanned on MalwareAnalyzer by Cyble · Open interactive scan