upx.github.io - URL scan, 24 Aug 2026
MalwareAnalyzer by Cyble scanned upx.github.io and returned a unknown verdict (score -6). The page resolved to 185.199.109.153 on GitHub, Inc. in US. 4 domains and 4 IPs were contacted. 86 malware samples communicate with this URL (Mirai, Midie). The request followed 3 redirects before landing. This is a point-in-time observation from 24 Aug 2026; the page may have changed since.
Scan result
- Verdict: unknown (score -6) · Confidence 12%
- Scanned URL:
http://upx.sf.net/ - Domain: upx.github.io · IP: 185.199.109.153 · AS54113 · US
- Server: GitHub.com
- Page title: UPX: the Ultimate Packer for eXecutables - Homepage
- HTTP status: 200 · text/html; charset=utf-8
- TLS issuer: C=US, O=Let's Encrypt, CN=YR1 · valid to Oct 31 23: · subject CN=*.github.io
- Scan tier: fast · observed 2026-08-24 03:27:00 UTC
Redirect chain
http://upx.sf.net/https://upx.sf.net/https://upx.sourceforge.net/https://upx.github.io/
Malware communicating with this URL (86)
These samples were observed contacting or being served from upx.github.io. Each links to its full analysis.
- Mirai - referenced ·
23c64cd813bcb30a7bfbc1de4fe45d33· first seen 2026-08-24 - e51c0db804508c31cb85c858eebb684d14d5386ca7ad733b97d460ef763546e7.bin - referenced ·
e51c0db804508c31cb85c858eebb684d· first seen 2026-08-23 - cb13c93cd04a0a56ed96954ce2bb28e066ab75dfc53d6528a31d317e6a94db62.bin - referenced ·
cb13c93cd04a0a56ed96954ce2bb28e0· first seen 2026-08-23 - f2006a57f197a51049224e841ace1bb1eed5de15cceabe20353e76ab4c9e4d6b.bin - referenced ·
f2006a57f197a51049224e841ace1bb1· first seen 2026-08-23 - 6f6287e9e363e5457912abb4100053964f28d4d2a0bd3c6046f9035f89022073.bin - referenced ·
6f6287e9e363e5457912abb410005396· first seen 2026-08-23 - c7cf5a8802506852d057798cfcd862f89af5a48f3239fbb3e905f112987f0cd6.bin - referenced ·
c7cf5a8802506852d057798cfcd862f8· first seen 2026-08-23 - bfb4fc546e7c80572a85cea5828f27621dcefb05a35c06685e43cc67f8d3a48b.bin - referenced ·
bfb4fc546e7c80572a85cea5828f2762· first seen 2026-08-23 - 9e2e7f57fa1f117b911b741e29fde7a53c047ed34ceb3ccef354db2bb4c38017.bin - referenced ·
9e2e7f57fa1f117b911b741e29fde7a5· first seen 2026-08-23 - 1d471fb55a817e1c4a8188c9cd9432640df171afb9da62f1cb3c3b667532959a - referenced ·
1d471fb55a817e1c4a8188c9cd943264· first seen 2026-08-23 - Midie - referenced ·
b45c1cd2b06fd01e4b964f1566f9a921· first seen 2026-08-23 - Mirai - referenced ·
28708524a0409fa372c828dfc817712c· first seen 2026-08-22 - dc658cbd0da1e0dec652c7eee703c204ec803f66d15d47e127e9a72ffe4a204c - referenced ·
dc658cbd0da1e0dec652c7eee703c204· first seen 2026-08-22 - Mirai - referenced ·
50aea936b06ead9afc1877f47d264024· first seen 2026-08-20 - f0aa83bbbd2c75e2f71ec16029ee5fcfad59f3a8efa30a500b815f0f6c18d987.bin - referenced ·
f0aa83bbbd2c75e2f71ec16029ee5fcf· first seen 2026-08-19 - Mirai - referenced ·
fe95a35a549a6e1783f30a0727ad1b78· first seen 2026-08-17
Antivirus & YARA (0 of 48 engines)
No engine flagged this page's content.
Why this verdict
- Valid TLS, no impersonation or off-origin credential post
- Cross-host redirect chain
Detected technologies
- GitHub Pages
- Fastly
Contacted infrastructure
- 185.199.109.153 - AS54113 GitHub, Inc. (United States)
- 104.18.20.237 - AS13335 Cloudflare, Inc. (United States)
- 104.18.21.237 - AS13335 Cloudflare, Inc. (United States)
- 104.18.13.149 - AS13335 Cloudflare, Inc. (United States)
Observed indicators
- upx.github.io
- github.com
- www.oberhumer.com
- www.bitwagon.com
- 185.199.109.153
- 104.18.20.237
- 104.18.21.237
- 104.18.13.149
- https://upx.github.io/
- https://upx.github.io/css/modern-normalize-min.css
- https://upx.github.io/css/fonts-min.css
- https://upx.github.io/css/cayman-upx-min.css
- https://github.com/upx/upx
- https://github.com/upx/upx/releases/latest
- https://upx.github.io/upx-COPYING.txt
- https://upx.github.io/upx-license.html
- https://www.oberhumer.com/
- https://www.bitwagon.com/
- https://github.com/upx
Other scans of upx.github.io (10)
This host has been scanned before. Each scan is a separate observation, so a verdict here does not carry over to the others.
- 23 Aug 2026 - unknown
- 23 Aug 2026 - unknown
- 23 Aug 2026 - unknown
- 23 Aug 2026 - unknown
- 22 Aug 2026 - unknown
- 22 Aug 2026 - unknown
- 20 Aug 2026 - unknown
- 19 Aug 2026 - unknown
- 17 Aug 2026 - unknown
- 16 Aug 2026 - unknown
Questions about upx.github.io
- Is upx.github.io safe?
- The scan of upx.github.io on 24 Aug 2026 reached no verdict either way (score -6). Too little was captured to judge it, which is an unknown rather than a pass.
- What malware is associated with upx.github.io?
- 86 analysed samples communicate with this URL, including Mirai, Midie.
- How was upx.github.io checked?
- A static pass resolved DNS, captured TLS and headers and followed the redirect chain, and where the fast tier allows, a headless browser rendered the page and recorded every request. Egress is SSRF-locked. Signatures that matched only page text are weighted far below one that matched a served file, because a page documenting malware matches the same rules.
Scanned at the fast tier - see how URL scanning works.
Scan another URL · Latest analyzed threats · All scans of upx.github.io
Scanned on MalwareAnalyzer by Cyble · Open interactive scan