The scan of paint.net on 15 Aug 2026 reached no verdict either way (score -12). Too little was captured to judge it, which is an unknown rather than a pass.

What malware is associated with paint.net?

2 analysed samples communicate with this URL, including Emotet.

How was paint.net checked?

A static pass resolved DNS, captured TLS and headers and followed the redirect chain, and where the fast tier allows, a headless browser rendered the page and recorded every request. Egress is SSRF-locked. Signatures that matched only page text are weighted far below one that matched a served file, because a page documenting malware matches the same rules.

paint.net - URL scan, 15 Aug 2026

MalwareAnalyzer by Cyble scanned paint.net and returned a unknown verdict (score -12). The page resolved to 50.87.184.106 on Unified Layer in US. 15 domains and 1 IP were contacted, over 2 HTTP requests. 2 malware samples communicate with this URL (Emotet). This is a point-in-time observation from 15 Aug 2026; the page may have changed since.

Scan result

Verdict: unknown (score -12) · Confidence 15%
Scanned URL: https://paint.net/
Domain: paint.net · IP: 50.87.184.106 · AS46606 · US
Server: Apache
Page title: Paint.NET - Free Software for Digital Photo Editing
HTTP status: 200 · text/html
TLS issuer: C=US, O=Let's Encrypt, CN=R13 · valid to Aug 25 23: · subject CN=cpanel.paint.net
HTTP requests captured: 2
Scan tier: fast · observed 2026-08-15 10:29:51 UTC

Malware communicating with this URL (2)

These samples were observed contacting or being served from paint.net. Each links to its full analysis.

Emotet - referenced · 3497949116243d6f192836d2d1ca227d · first seen 2026-08-15
virussign.com_593458b033468cce0a4fdfae56b14af0.vir - referenced · c2cf4793a64d555769a8322b6e5c85ca · first seen 2026-08-12

Antivirus & YARA (0 of 44 engines)

No engine flagged this page's content.

Why this verdict

Valid TLS, no impersonation or off-origin credential post

Detected technologies

Apache

Contacted infrastructure

50.87.184.106 - AS46606 Unified Layer (United States)

Observed indicators

paint.net
blog.paint.net
www.google.com
forums.paint.net
x.com
bsky.app
blogs.windows.com
lifehacker.com
web.archive.org
blog.codinghorror.com
pagead2.googlesyndication.com
en.wikipedia.org
www.microsoft.com
www.paypal.com
www.dotpdn.com
50.87.184.106
https://paint.net/
https://paint.net/favicon.ico
https://paint.net/favicon-32.png
https://paint.net/favicon-16.png

Other scans of paint.net (4)

This host has been scanned before. Each scan is a separate observation, so a verdict here does not carry over to the others.

22 Aug 2026 - unknown
17 Aug 2026 - unknown
16 Aug 2026 - unknown
12 Aug 2026 - unknown

Questions about paint.net

Is paint.net safe?: The scan of paint.net on 15 Aug 2026 reached no verdict either way (score -12). Too little was captured to judge it, which is an unknown rather than a pass.
What malware is associated with paint.net?: 2 analysed samples communicate with this URL, including Emotet.
How was paint.net checked?: A static pass resolved DNS, captured TLS and headers and followed the redirect chain, and where the fast tier allows, a headless browser rendered the page and recorded every request. Egress is SSRF-locked. Signatures that matched only page text are weighted far below one that matched a served file, because a page documenting malware matches the same rules.

Scanned at the fast tier - see how URL scanning works.

Scan another URL · Latest analyzed threats · All scans of paint.net

Scanned on MalwareAnalyzer by Cyble · Open interactive scan