cygwin.com - URL scan, 21 Aug 2026
MalwareAnalyzer by Cyble scanned cygwin.com and returned a unknown verdict (score -12). The page resolved to 38.145.34.32 on Red Hat, Inc. in US. The domain was registered 9751 days ago through Nom-iq Ltd. dba COM LAUDE. 6 domains and 1 IP were contacted. 38 malware samples communicate with this URL (Genpack, Maldoc, Vindor, Generickdz). This is a point-in-time observation from 21 Aug 2026; the page may have changed since.
Scan result
- Verdict: unknown (score -12) · Confidence 15%
- Scanned URL:
https://cygwin.com/ - Domain: cygwin.com · IP: 38.145.34.32 · AS174 · US
- Server: nginx
- Page title: Cygwin
- HTTP status: 200 · text/html; charset=UTF-8
- Registrar: Nom-iq Ltd. dba COM LAUDE · domain age 9751 days · created 1999-12-09
- TLS issuer: C=US, O=Let's Encrypt, CN=YR1 · valid to Oct 9 13: · subject CN=cygwin.com
- Scan tier: fast · observed 2026-08-21 07:17:20 UTC
Malware communicating with this URL (38)
These samples were observed contacting or being served from cygwin.com. Each links to its full analysis.
- Genpack - referenced ·
343d9918e78e0b2b0ad07b69dbb5501e· first seen 2026-08-21 - Maldoc - referenced ·
bd3d4826bddd2877c5242556543ea508· first seen 2026-08-21 - Genpack - referenced ·
8c185d6cd1d387230296836ed68ebc64· first seen 2026-08-21 - Vindor - referenced ·
15bc7dfbcf548b8cef9c6957f9a030c9· first seen 2026-08-21 - bb319f6e6ad9e5d5457a8e05f513c2743a532218990ef8af90699d0cdc797419 - referenced ·
bb319f6e6ad9e5d5457a8e05f513c274· first seen 2026-08-21 - Generickdz - referenced ·
b02318fd36dbb66df4b9144042d21627· first seen 2026-08-20 - Genpack - referenced ·
d77c0ab6a9d9f9585da088d8aac0af2b· first seen 2026-08-20 - aa0ad47e309663506e5aa207def9298a4c9787351b8f2ac8ed842b01b531ada5 - referenced ·
aa0ad47e309663506e5aa207def9298a· first seen 2026-08-20 - cd7b74796df993b488b175b2833e8834b88ccabeddfb093877492a846fcb5855 - referenced ·
cd7b74796df993b488b175b2833e8834· first seen 2026-08-20 - Porcupine - referenced ·
363a622be722fd2576bf45338e0e95a3· first seen 2026-08-20 - Genpack - referenced ·
ce310f5bb193dbde6c7eef25f0d74e08· first seen 2026-08-20 - Genpack - referenced ·
7fcf1dc3e823c3319fe8651187a19ff9· first seen 2026-08-19 - Hoax - referenced ·
e4f76bc4ad3e31479e1b529222b98e1f· first seen 2026-08-19 - 44bf1bc2296636f1d5d13f079b232db69cc98ec3e08dbf038b4abfdbe5c05984 - referenced ·
44bf1bc2296636f1d5d13f079b232db6· first seen 2026-08-19 - Genpack - referenced ·
6ac17f5f958f19e717a5411723c37ce9· first seen 2026-08-19
Antivirus & YARA (0 of 47 engines)
No engine flagged this page's content.
Why this verdict
- Valid TLS, no impersonation or off-origin credential post
Detected technologies
- Nginx
Contacted infrastructure
- 38.145.34.32 - AS174 Red Hat, Inc. (United States)
Observed indicators
- cygwin.com
- x.cygwin.com
- sourceware.org
- www.linuxfoundation.org
- en.wikipedia.org
- www.crouchingtigerhiddenfruitbat.org
- 38.145.34.32
- https://cygwin.com/
- https://cygwin.com/style.css
- https://cygwin.com/index.html
- https://cygwin.com/install.html
- https://cygwin.com/packages/
- https://cygwin.com/licensing.html
- http://x.cygwin.com/
- https://cygwin.com/who.html
- https://cygwin.com/problems.html
- https://cygwin.com/lists.html
- https://cygwin.com/news.html
- https://cygwin.com/irc.html
- https://cygwin.com/goldstars/
Other scans of cygwin.com (10)
This host has been scanned before. Each scan is a separate observation, so a verdict here does not carry over to the others.
- 24 Aug 2026 - unknown
- 23 Aug 2026 - unknown
- 23 Aug 2026 - unknown
- 23 Aug 2026 - unknown
- 22 Aug 2026 - unknown ·
http://cygwin.com/cgi-bin2/package-grep.cgi?text=1&grep= - 22 Aug 2026 - unknown
- 22 Aug 2026 - unknown
- 22 Aug 2026 - unknown ·
http://mintty.github.io/ - 22 Aug 2026 - suspicious ·
https://www.mingw-w64.org/ - 22 Aug 2026 - unknown
Questions about cygwin.com
- Is cygwin.com safe?
- The scan of cygwin.com on 21 Aug 2026 reached no verdict either way (score -12). Too little was captured to judge it, which is an unknown rather than a pass.
- What malware is associated with cygwin.com?
- 38 analysed samples communicate with this URL, including Genpack, Maldoc, Vindor, Generickdz.
- How was cygwin.com checked?
- A static pass resolved DNS, captured TLS and headers and followed the redirect chain, and where the fast tier allows, a headless browser rendered the page and recorded every request. Egress is SSRF-locked. Signatures that matched only page text are weighted far below one that matched a served file, because a page documenting malware matches the same rules.
Scanned at the fast tier - see how URL scanning works.
Scan another URL · Latest analyzed threats · All scans of cygwin.com
Scanned on MalwareAnalyzer by Cyble · Open interactive scan