cygwin.com - URL scan, 22 Aug 2026
MalwareAnalyzer by Cyble scanned cygwin.com and returned a unknown verdict (score -12). The page resolved to 38.145.34.32 on Red Hat, Inc. in US. The domain was registered 9752 days ago through Nom-iq Ltd. dba COM LAUDE. 6 domains and 1 IP were contacted. 45 malware samples communicate with this URL (Genpack, Lmir, Delf, Zusy). This is a point-in-time observation from 22 Aug 2026; the page may have changed since.
Scan result
- Verdict: unknown (score -12) · Confidence 15%
- Scanned URL:
https://cygwin.com/ - Domain: cygwin.com · IP: 38.145.34.32 · AS174 · US
- Server: nginx
- Page title: Cygwin
- HTTP status: 200 · text/html; charset=UTF-8
- Registrar: Nom-iq Ltd. dba COM LAUDE · domain age 9752 days · created 1999-12-09
- TLS issuer: C=US, O=Let's Encrypt, CN=YR1 · valid to Oct 9 13: · subject CN=cygwin.com
- Scan tier: fast · observed 2026-08-22 10:06:59 UTC
Malware communicating with this URL (45)
These samples were observed contacting or being served from cygwin.com. Each links to its full analysis.
- Genpack - referenced ·
6c2f106594d0074d030911d67142ba59· first seen 2026-08-22 - Lmir - referenced ·
448879649f6e11e857d3f172b29b604f· first seen 2026-08-22 - Delf - referenced ·
0bedadf9dcb2337d6825d9f393f54a5a· first seen 2026-08-21 - Zusy - referenced ·
5249811dbdbffabb0f3cf2b0c55e852d· first seen 2026-08-21 - Genpack - referenced ·
7b50a460f3c491761b726927f1bbac27· first seen 2026-08-21 - Genpack - referenced ·
5f8927626487cf418223556650776fc1· first seen 2026-08-21 - HUILoader - referenced ·
9626184a3a0e74a12313f48efe3ba8a1· first seen 2026-08-21 - Genpack - referenced ·
343d9918e78e0b2b0ad07b69dbb5501e· first seen 2026-08-21 - Maldoc - referenced ·
bd3d4826bddd2877c5242556543ea508· first seen 2026-08-21 - Genpack - referenced ·
8c185d6cd1d387230296836ed68ebc64· first seen 2026-08-21 - Vindor - referenced ·
15bc7dfbcf548b8cef9c6957f9a030c9· first seen 2026-08-21 - bb319f6e6ad9e5d5457a8e05f513c2743a532218990ef8af90699d0cdc797419 - referenced ·
bb319f6e6ad9e5d5457a8e05f513c274· first seen 2026-08-21 - Generickdz - referenced ·
b02318fd36dbb66df4b9144042d21627· first seen 2026-08-20 - Genpack - referenced ·
d77c0ab6a9d9f9585da088d8aac0af2b· first seen 2026-08-20 - aa0ad47e309663506e5aa207def9298a4c9787351b8f2ac8ed842b01b531ada5 - referenced ·
aa0ad47e309663506e5aa207def9298a· first seen 2026-08-20
Antivirus & YARA (0 of 48 engines)
No engine flagged this page's content.
Why this verdict
- Valid TLS, no impersonation or off-origin credential post
Detected technologies
- Nginx
Contacted infrastructure
- 38.145.34.32 - AS174 Red Hat, Inc. (United States)
Observed indicators
- cygwin.com
- x.cygwin.com
- sourceware.org
- www.linuxfoundation.org
- en.wikipedia.org
- www.crouchingtigerhiddenfruitbat.org
- 38.145.34.32
- https://cygwin.com/
- https://cygwin.com/style.css
- https://cygwin.com/index.html
- https://cygwin.com/install.html
- https://cygwin.com/packages/
- https://cygwin.com/licensing.html
- http://x.cygwin.com/
- https://cygwin.com/who.html
- https://cygwin.com/problems.html
- https://cygwin.com/lists.html
- https://cygwin.com/news.html
- https://cygwin.com/irc.html
- https://cygwin.com/goldstars/
Other scans of cygwin.com (10)
This host has been scanned before. Each scan is a separate observation, so a verdict here does not carry over to the others.
- 24 Aug 2026 - unknown
- 23 Aug 2026 - unknown
- 23 Aug 2026 - unknown
- 23 Aug 2026 - unknown
- 22 Aug 2026 - unknown ·
http://cygwin.com/cgi-bin2/package-grep.cgi?text=1&grep= - 22 Aug 2026 - unknown
- 22 Aug 2026 - unknown ·
http://mintty.github.io/ - 22 Aug 2026 - suspicious ·
https://www.mingw-w64.org/ - 22 Aug 2026 - unknown
- 21 Aug 2026 - unknown
Questions about cygwin.com
- Is cygwin.com safe?
- The scan of cygwin.com on 22 Aug 2026 reached no verdict either way (score -12). Too little was captured to judge it, which is an unknown rather than a pass.
- What malware is associated with cygwin.com?
- 45 analysed samples communicate with this URL, including Genpack, Lmir, Delf, Zusy.
- How was cygwin.com checked?
- A static pass resolved DNS, captured TLS and headers and followed the redirect chain, and where the fast tier allows, a headless browser rendered the page and recorded every request. Egress is SSRF-locked. Signatures that matched only page text are weighted far below one that matched a served file, because a page documenting malware matches the same rules.
Scanned at the fast tier - see how URL scanning works.
Scan another URL · Latest analyzed threats · All scans of cygwin.com
Scanned on MalwareAnalyzer by Cyble · Open interactive scan