index.crates.io - URL scan, 17 Aug 2026
MalwareAnalyzer by Cyble scanned index.crates.io and returned a unknown verdict (score -12). The page resolved to 151.101.30.137 on Fastly, Inc. in US. 7 domains and 1 IP were contacted. 25 malware samples communicate with this URL (HUILoader, REvil). This is a point-in-time observation from 17 Aug 2026; the page may have changed since.
Scan result
- Verdict: unknown (score -12) · Confidence 15%
- Scanned URL:
https://index.crates.io/ - Domain: index.crates.io · IP: 151.101.30.137 · AS54113 · US
- Server: AmazonS3
- Page title: The crates.io package index
- HTTP status: 200 · text/html
- TLS issuer: C=BE, O=GlobalSign nv-sa, CN=GlobalSign Atlas R3 DV TLS CA 2025 Q4 · valid to Jan 5 14: · subject CN=index.crates.io
- Scan tier: fast · observed 2026-08-17 03:24:11 UTC
Malware communicating with this URL (25)
These samples were observed contacting or being served from index.crates.io. Each links to its full analysis.
- 976286fb575cf6c6dcfd50695cb538d3d764642ea36122209d11d104d0ca5182.elf - referenced ·
976286fb575cf6c6dcfd50695cb538d3· first seen 2026-08-17 - HUILoader - referenced ·
287d1076dba5769e5b228e8b93289173· first seen 2026-08-15 - virussign.com_f0cd9075e08ba3d0f497b27d767c2030.vir - referenced ·
236c50263c145bb85a57493c1834ae91· first seen 2026-08-15 - bc9eb5dab0d00a0de7c8df3b1d342b5ff435bc8a8cb40a04aaadb869755fe081.exe - referenced ·
bc9eb5dab0d00a0de7c8df3b1d342b5f· first seen 2026-08-15 - HUILoader - referenced ·
3844a0277a6613b916974dafbfb62079· first seen 2026-08-13 - HUILoader - referenced ·
083a48414c7623d5007135f3903cf499· first seen 2026-08-13 - HUILoader - referenced ·
326d916b57d00a594bdf820fada4475d· first seen 2026-08-13 - HUILoader - referenced ·
827392ee7e404a315a0261f9ea2db6f2· first seen 2026-08-13 - REvil - referenced ·
6167be94c33b2a86f9820cbc1b901700· first seen 2026-08-13 - HUILoader - referenced ·
33ec6eb0b04a3f34b3aea302f64a26b0· first seen 2026-08-13 - HUILoader - referenced ·
d0365e1871c4f291c01d24e32608b069· first seen 2026-08-13 - HUILoader - referenced ·
ad144970d4d05f32f0e169f0172327a0· first seen 2026-08-13 - HUILoader - referenced ·
795f5d4d8a484fb274dab7eae466b026· first seen 2026-08-13 - HUILoader - referenced ·
98472053ca17e0461811c0c0b0b46603· first seen 2026-08-12 - HUILoader - referenced ·
4de1a1e342735b777ec3ef25edcec854· first seen 2026-08-12
Antivirus & YARA (0 of 47 engines)
No engine flagged this page's content.
Why this verdict
- Valid TLS, no impersonation or off-origin credential post
Detected technologies
- Fastly
Contacted infrastructure
- 151.101.30.137 - AS54113 Fastly, Inc. (US)
Observed indicators
- index.crates.io
- cdnjs.cloudflare.com
- crates.io
- doc.rust-lang.org
- rust-lang.github.io
- github.com
- www.rust-lang.org
- 151.101.30.137
- https://index.crates.io/
- https://cdnjs.cloudflare.com/ajax/libs/github-markdown-css/5.6.1/github-markdown.min.css
- https://crates.io/
- https://doc.rust-lang.org/cargo
- https://rust-lang.github.io/rfcs/2789-sparse-index.html
- https://github.com/rust-lang/crates.io-index
- https://doc.rust-lang.org/cargo/reference/registry-index.html#index-format
- https://www.rust-lang.org/governance/teams/dev-tools#team-crates-io
Other scans of index.crates.io (8)
This host has been scanned before. Each scan is a separate observation, so a verdict here does not carry over to the others.
- 19 Aug 2026 - unknown
- 15 Aug 2026 - unknown
- 15 Aug 2026 - unknown
- 13 Aug 2026 - unknown
- 13 Aug 2026 - unknown
- 12 Aug 2026 - unknown
- 12 Aug 2026 - unknown
- 11 Aug 2026 - unknown
Questions about index.crates.io
- Is index.crates.io safe?
- The scan of index.crates.io on 17 Aug 2026 reached no verdict either way (score -12). Too little was captured to judge it, which is an unknown rather than a pass.
- What malware is associated with index.crates.io?
- 25 analysed samples communicate with this URL, including HUILoader, REvil.
- How was index.crates.io checked?
- A static pass resolved DNS, captured TLS and headers and followed the redirect chain, and where the fast tier allows, a headless browser rendered the page and recorded every request. Egress is SSRF-locked. Signatures that matched only page text are weighted far below one that matched a served file, because a page documenting malware matches the same rules.
Scanned at the fast tier - see how URL scanning works.
Scan another URL · Latest analyzed threats · All scans of index.crates.io
Scanned on MalwareAnalyzer by Cyble · Open interactive scan