nsis.sourceforge.io - URL scan, 19 Aug 2026
MalwareAnalyzer by Cyble scanned nsis.sourceforge.io and returned a unknown verdict (score -6). The page resolved to 104.18.10.31 on Cloudflare, Inc. in US. 2 domains and 4 IPs were contacted, over 1 HTTP request. 9 malware samples communicate with this URL (Pidgeon, Call4, Ipamor, Fesber). The request followed 3 redirects before landing. This is a point-in-time observation from 19 Aug 2026; the page may have changed since.
Scan result
- Verdict: unknown (score -6) · Confidence 12%
- Scanned URL:
http://nsis.sf.net/NSIS_Error - Domain: nsis.sourceforge.io · IP: 104.18.10.31 · AS13335 · US
- Server: cloudflare
- Page title: Why do I get NSIS Error - NSIS
- HTTP status: 200 · text/html; charset=UTF-8
- TLS issuer: C=US, O=Let's Encrypt, CN=YE2 · valid to Nov 10 19: · subject CN=sourceforge.io
- HTTP requests captured: 1
- Scan tier: fast · observed 2026-08-19 07:01:58 UTC
Redirect chain
http://nsis.sf.net/NSIS_Errorhttps://nsis.sf.net/NSIS_Errorhttps://nsis.sourceforge.net/NSIS_Errorhttps://nsis.sourceforge.io/NSIS_Error
Malware communicating with this URL (9)
These samples were observed contacting or being served from nsis.sourceforge.io. Each links to its full analysis.
- Pidgeon - referenced ·
d23f9cb490a9df16685c05b5516d05c1· first seen 2026-08-19 - 83554baeeb700815f9b6492584a1b1a40c64f752d1ff1a67cde079ad524b008f.exe - referenced ·
83554baeeb700815f9b6492584a1b1a4· first seen 2026-08-18 - Call4 - referenced ·
1c6c6373652d0f1ac1480fa4232b9270· first seen 2026-08-18 - Ipamor - referenced ·
2a19fc3d6cca39f5d995f3f1f26940ee· first seen 2026-08-18 - ebe31ad40a9ce206268d9f355e42ca4979847bfd861b3d157c06ed1bd842219c.exe - referenced ·
ebe31ad40a9ce206268d9f355e42ca49· first seen 2026-08-17 - Ipamor - referenced ·
0920901901576fcd0cb3c1900c5fc287· first seen 2026-08-15 - Pidgeon - referenced ·
83f93990620da956fffe203a2b77fd2c· first seen 2026-08-14 - Pidgeon - referenced ·
d7ed65ff3efc6dcc142cf59cb04f6f09· first seen 2026-08-13 - Fesber - referenced ·
ef8666042aec506aabf82bce1385b7c1· first seen 2026-08-12
Antivirus & YARA (0 of 47 engines)
No engine flagged this page's content.
Why this verdict
- Valid TLS, no impersonation or off-origin credential post
- Cross-host redirect chain
Detected technologies
- Cloudflare
Contacted infrastructure
- 104.18.10.31 - AS13335 Cloudflare, Inc. (United States)
- 104.18.20.237 - AS13335 Cloudflare, Inc. (United States)
- 104.18.21.237 - AS13335 Cloudflare, Inc. (United States)
- 104.18.13.149 - AS13335 Cloudflare, Inc. (United States)
Observed indicators
- nsis.sourceforge.io
- www.mediawiki.org
- 104.18.10.31
- 104.18.20.237
- 104.18.21.237
- 104.18.13.149
- https://nsis.sourceforge.io/NSIS_Error
- https://nsis.sourceforge.io/mediawiki/load.php?lang=en&modules=mediawiki.action.view.redirectPage%7Cskins.monobook.styles&only=styles&skin=monobook
- https://nsis.sourceforge.io/mediawiki/load.php?lang=en&modules=startup&only=scripts&raw=1&skin=monobook
- https://nsis.sourceforge.io/favicon.ico
- https://nsis.sourceforge.io/mediawiki/opensearch_desc.php
- https://nsis.sourceforge.io/mediawiki/api.php?action=rsd
- https://nsis.sourceforge.io/License
- https://nsis.sourceforge.io/mediawiki/index.php?title=Special:RecentChanges&feed=atom
- https://nsis.sourceforge.io/Why_do_I_get_NSIS_Error
- https://nsis.sourceforge.io/mediawiki/index.php?title=NSIS_Error&redirect=no
- https://nsis.sourceforge.io/Why_do_I_get_NSIS_Error%3F
- https://nsis.sourceforge.io/mediawiki/index.php?title=Why_do_I_get_NSIS_Error&oldid=24402
- https://nsis.sourceforge.io/Talk:Why_do_I_get_NSIS_Error
- https://nsis.sourceforge.io/mediawiki/index.php?title=Why_do_I_get_NSIS_Error&action=edit
Other scans of nsis.sourceforge.io (10)
This host has been scanned before. Each scan is a separate observation, so a verdict here does not carry over to the others.
- 23 Aug 2026 - unknown
- 23 Aug 2026 - unknown
- 22 Aug 2026 - unknown
- 21 Aug 2026 - unknown
- 20 Aug 2026 - unknown
- 20 Aug 2026 - unknown
- 19 Aug 2026 - unknown
- 18 Aug 2026 - unknown
- 18 Aug 2026 - unknown
- 17 Aug 2026 - unknown
Questions about nsis.sourceforge.io
- Is nsis.sourceforge.io safe?
- The scan of nsis.sourceforge.io on 19 Aug 2026 reached no verdict either way (score -6). Too little was captured to judge it, which is an unknown rather than a pass.
- What malware is associated with nsis.sourceforge.io?
- 9 analysed samples communicate with this URL, including Pidgeon, Call4, Ipamor, Fesber.
- How was nsis.sourceforge.io checked?
- A static pass resolved DNS, captured TLS and headers and followed the redirect chain, and where the fast tier allows, a headless browser rendered the page and recorded every request. Egress is SSRF-locked. Signatures that matched only page text are weighted far below one that matched a served file, because a page documenting malware matches the same rules.
Scanned at the fast tier - see how URL scanning works.
Scan another URL · Latest analyzed threats · All scans of nsis.sourceforge.io
Scanned on MalwareAnalyzer by Cyble · Open interactive scan