cygwin.com - URL scan, 24 Aug 2026
MalwareAnalyzer by Cyble scanned cygwin.com and returned a unknown verdict (score -12). The page resolved to 38.145.34.32 on Red Hat, Inc. in US. The domain was registered 9754 days ago through Nom-iq Ltd. dba COM LAUDE. 6 domains and 1 IP were contacted. 60 malware samples communicate with this URL (Genpack, Ausiv, Delf, Dqan). This is a point-in-time observation from 24 Aug 2026; the page may have changed since.
Scan result
- Verdict: unknown (score -12) · Confidence 15%
- Scanned URL:
https://cygwin.com/ - Domain: cygwin.com · IP: 38.145.34.32 · AS174 · US
- Server: nginx
- Page title: Cygwin
- HTTP status: 200 · text/html; charset=UTF-8
- Registrar: Nom-iq Ltd. dba COM LAUDE · domain age 9754 days · created 1999-12-09
- TLS issuer: C=US, O=Let's Encrypt, CN=YR1 · valid to Oct 9 13: · subject CN=cygwin.com
- Scan tier: fast · observed 2026-08-24 03:22:27 UTC
Malware communicating with this URL (60)
These samples were observed contacting or being served from cygwin.com. Each links to its full analysis.
- b63a766a049b107ef2b20e0554f0aae276af5dfec24061cad64f192149743455 - referenced ·
b63a766a049b107ef2b20e0554f0aae2· first seen 2026-08-24 - Genpack - referenced ·
5c25f03ca0a606bb7a16fc30fc1f2601· first seen 2026-08-23 - Ausiv - referenced ·
da193049cd2aa56bd238af23b6e33ba6· first seen 2026-08-23 - Delf - referenced ·
8ca2533fcd9f0fff46a600ea117cf0b8· first seen 2026-08-23 - 81ffd070f0374d065775c673c68d80d0141b3ac281bac8ddd3036e50b4062b1d - referenced ·
81ffd070f0374d065775c673c68d80d0· first seen 2026-08-23 - 25701bf096dbd433eb90bc7ea0d76e7a4c072d0ea969538a7ded27a9b93da040 - referenced ·
25701bf096dbd433eb90bc7ea0d76e7a· first seen 2026-08-23 - Dqan - referenced ·
13d348b0b3ea2d9cbb985825ec51c1a7· first seen 2026-08-23 - Vindor - referenced ·
379f04b3181d93335f3d7aae7ee74147· first seen 2026-08-23 - 7c012e7f799e2a493de5520501bcab0cbdae943fa793dedd3cbd2a5dc53a7326 - referenced ·
7c012e7f799e2a493de5520501bcab0c· first seen 2026-08-23 - Ipamor - referenced ·
8a72fb623f07b32f9554b9b14e04275e· first seen 2026-08-23 - Genpack - referenced ·
5faad36c1aeb7d28db013fce9bf5fd28· first seen 2026-08-23 - aa9d6c9ac0d7f13bbbc306763ab9ee9087908a3a494826decb966b612e221ee5 - referenced ·
aa9d6c9ac0d7f13bbbc306763ab9ee90· first seen 2026-08-22 - Genpack - referenced ·
4e4aabacdc290694e658496f9260e617· first seen 2026-08-22 - DCOM - referenced ·
f4327e86cd60f8f6733ce3d7e42cfc87· first seen 2026-08-22 - d889e8b7caf30f77f95ac8f1a386cd627b5176f0bc6133a9c0d58e7b7779ca16 - referenced ·
d889e8b7caf30f77f95ac8f1a386cd62· first seen 2026-08-22
Antivirus & YARA (0 of 48 engines)
No engine flagged this page's content.
Why this verdict
- Valid TLS, no impersonation or off-origin credential post
Detected technologies
- Nginx
Contacted infrastructure
- 38.145.34.32 - AS174 Red Hat, Inc. (United States)
Observed indicators
- cygwin.com
- x.cygwin.com
- sourceware.org
- www.linuxfoundation.org
- en.wikipedia.org
- www.crouchingtigerhiddenfruitbat.org
- 38.145.34.32
- https://cygwin.com/
- https://cygwin.com/style.css
- https://cygwin.com/index.html
- https://cygwin.com/install.html
- https://cygwin.com/packages/
- https://cygwin.com/licensing.html
- http://x.cygwin.com/
- https://cygwin.com/who.html
- https://cygwin.com/problems.html
- https://cygwin.com/lists.html
- https://cygwin.com/news.html
- https://cygwin.com/irc.html
- https://cygwin.com/goldstars/
Other scans of cygwin.com (10)
This host has been scanned before. Each scan is a separate observation, so a verdict here does not carry over to the others.
- 23 Aug 2026 - unknown
- 23 Aug 2026 - unknown
- 23 Aug 2026 - unknown
- 22 Aug 2026 - unknown ·
http://cygwin.com/cgi-bin2/package-grep.cgi?text=1&grep= - 22 Aug 2026 - unknown
- 22 Aug 2026 - unknown
- 22 Aug 2026 - unknown ·
http://mintty.github.io/ - 22 Aug 2026 - suspicious ·
https://www.mingw-w64.org/ - 22 Aug 2026 - unknown
- 21 Aug 2026 - unknown
Questions about cygwin.com
- Is cygwin.com safe?
- The scan of cygwin.com on 24 Aug 2026 reached no verdict either way (score -12). Too little was captured to judge it, which is an unknown rather than a pass.
- What malware is associated with cygwin.com?
- 60 analysed samples communicate with this URL, including Genpack, Ausiv, Delf, Dqan.
- How was cygwin.com checked?
- A static pass resolved DNS, captured TLS and headers and followed the redirect chain, and where the fast tier allows, a headless browser rendered the page and recorded every request. Egress is SSRF-locked. Signatures that matched only page text are weighted far below one that matched a served file, because a page documenting malware matches the same rules.
Scanned at the fast tier - see how URL scanning works.
Scan another URL · Latest analyzed threats · All scans of cygwin.com
Scanned on MalwareAnalyzer by Cyble · Open interactive scan