cygwin.com - URL scan, 22 Aug 2026
MalwareAnalyzer by Cyble scanned cygwin.com and returned a unknown verdict (score 6). The page resolved to 38.145.34.32 on Red Hat, Inc. in US. The domain was registered 9752 days ago through Nom-iq Ltd. dba COM LAUDE. 1 domain and 1 IP were contacted. 49 malware samples communicate with this URL (Genpack, DCOM, Lmir, Delf). This is a point-in-time observation from 22 Aug 2026; the page may have changed since.
Scan result
- Verdict: unknown (score 6) · Confidence 9%
- Scanned URL:
http://cygwin.com/cgi-bin2/package-grep.cgi?text=1&grep= - Domain: cygwin.com · IP: 38.145.34.32 · AS174 · US
- Server: nginx
- Page title: 403 Forbidden
- HTTP status: 403 · text/html
- Registrar: Nom-iq Ltd. dba COM LAUDE · domain age 9752 days · created 1999-12-09
- Scan tier: fast · observed 2026-08-22 20:27:08 UTC
Malware communicating with this URL (49)
These samples were observed contacting or being served from cygwin.com. Each links to its full analysis.
- aa9d6c9ac0d7f13bbbc306763ab9ee9087908a3a494826decb966b612e221ee5 - referenced ·
aa9d6c9ac0d7f13bbbc306763ab9ee90· first seen 2026-08-22 - Genpack - referenced ·
4e4aabacdc290694e658496f9260e617· first seen 2026-08-22 - DCOM - referenced ·
f4327e86cd60f8f6733ce3d7e42cfc87· first seen 2026-08-22 - d889e8b7caf30f77f95ac8f1a386cd627b5176f0bc6133a9c0d58e7b7779ca16 - referenced ·
d889e8b7caf30f77f95ac8f1a386cd62· first seen 2026-08-22 - Genpack - referenced ·
6c2f106594d0074d030911d67142ba59· first seen 2026-08-22 - Lmir - referenced ·
448879649f6e11e857d3f172b29b604f· first seen 2026-08-22 - Delf - referenced ·
0bedadf9dcb2337d6825d9f393f54a5a· first seen 2026-08-21 - Zusy - referenced ·
5249811dbdbffabb0f3cf2b0c55e852d· first seen 2026-08-21 - Genpack - referenced ·
7b50a460f3c491761b726927f1bbac27· first seen 2026-08-21 - Genpack - referenced ·
5f8927626487cf418223556650776fc1· first seen 2026-08-21 - HUILoader - referenced ·
9626184a3a0e74a12313f48efe3ba8a1· first seen 2026-08-21 - Genpack - referenced ·
343d9918e78e0b2b0ad07b69dbb5501e· first seen 2026-08-21 - Maldoc - referenced ·
bd3d4826bddd2877c5242556543ea508· first seen 2026-08-21 - Genpack - referenced ·
8c185d6cd1d387230296836ed68ebc64· first seen 2026-08-21 - Vindor - referenced ·
15bc7dfbcf548b8cef9c6957f9a030c9· first seen 2026-08-21
Antivirus & YARA (0 of 48 engines)
No engine flagged this page's content.
Why this verdict
- Served over plaintext HTTP
Detected technologies
- Nginx
Contacted infrastructure
- 38.145.34.32 - AS174 Red Hat, Inc. (United States)
Observed indicators
- cygwin.com
- 38.145.34.32
- http://cygwin.com/cgi-bin2/package-grep.cgi?text=1&grep=
Other scans of cygwin.com (10)
This host has been scanned before. Each scan is a separate observation, so a verdict here does not carry over to the others.
- 24 Aug 2026 - unknown ·
https://cygwin.com/ - 23 Aug 2026 - unknown ·
https://cygwin.com/ - 23 Aug 2026 - unknown ·
https://cygwin.com/ - 23 Aug 2026 - unknown ·
https://cygwin.com/ - 22 Aug 2026 - unknown ·
https://cygwin.com/ - 22 Aug 2026 - unknown ·
https://cygwin.com/ - 22 Aug 2026 - unknown ·
http://mintty.github.io/ - 22 Aug 2026 - suspicious ·
https://www.mingw-w64.org/ - 22 Aug 2026 - unknown ·
https://cygwin.com/ - 21 Aug 2026 - unknown ·
https://cygwin.com/
Questions about cygwin.com
- Is cygwin.com safe?
- The scan of cygwin.com on 22 Aug 2026 reached no verdict either way (score 6). Too little was captured to judge it, which is an unknown rather than a pass.
- What malware is associated with cygwin.com?
- 49 analysed samples communicate with this URL, including Genpack, DCOM, Lmir, Delf.
- How was cygwin.com checked?
- A static pass resolved DNS, captured TLS and headers and followed the redirect chain, and where the fast tier allows, a headless browser rendered the page and recorded every request. Egress is SSRF-locked. Signatures that matched only page text are weighted far below one that matched a served file, because a page documenting malware matches the same rules.
Scanned at the fast tier - see how URL scanning works.
Scan another URL · Latest analyzed threats · All scans of cygwin.com
Scanned on MalwareAnalyzer by Cyble · Open interactive scan