The scan of winscp.net on 20 Aug 2026 reached no verdict either way (score -12). Too little was captured to judge it, which is an unknown rather than a pass.

What malware is associated with winscp.net?

1 analysed samples communicate with this URL, including HUILoader.

How was winscp.net checked?

A static pass resolved DNS, captured TLS and headers and followed the redirect chain, and where the fast tier allows, a headless browser rendered the page and recorded every request. Egress is SSRF-locked. Signatures that matched only page text are weighted far below one that matched a served file, because a page documenting malware matches the same rules.

winscp.net - URL scan, 20 Aug 2026

MalwareAnalyzer by Cyble scanned winscp.net and returned a unknown verdict (score -12). The page resolved to 88.198.21.111 on Hetzner Online AG in DE. The domain was registered 7860 days ago through Cloudflare, Inc.. 17 domains and 1 IP were contacted, over 12 HTTP requests. 1 malware sample communicates with this URL (HUILoader). This is a point-in-time observation from 20 Aug 2026; the page may have changed since.

Scan result

Verdict: unknown (score -12) · Confidence 15%
Scanned URL: https://winscp.net/eng/docs/executables
Domain: winscp.net · IP: 88.198.21.111 · AS24940 · DE
Server: nginx
Page title: Executables winscp.exe and winscp.com :: WinSCP
HTTP status: 200 · text/html; charset=utf-8
Registrar: Cloudflare, Inc. · domain age 7860 days · created 2005-02-10
TLS issuer: C=US, O=DigiCert Inc, OU=www.digicert.com, CN=RapidSSL TLS RSA CA G1 · valid to Nov 1 23: · subject CN=winscp.net
HTTP requests captured: 12
Scan tier: fast · observed 2026-08-20 10:18:34 UTC

Malware communicating with this URL (1)

These samples were observed contacting or being served from winscp.net. Each links to its full analysis.

HUILoader - referenced · f1c35da6c40b6a59a7c90af257b06f72 · first seen 2026-08-20

Antivirus & YARA (0 of 47 engines)

No engine flagged this page's content.

Why this verdict

Valid TLS, no impersonation or off-origin credential post

Detected technologies

Nginx
PHP
Google Analytics
jQuery
Bootstrap

Contacted infrastructure

88.198.21.111 - AS24940 Hetzner Online AG (Germany)

Observed indicators

winscp.net
winscp-static-746341.c.cdn77.org
purl.org
www.googletagmanager.com
connect.facebook.net
platform.twitter.com
pagead2.googlesyndication.com
sourceforge.net
www.facebook.com
x.com
github.com
teamforge.net
www.dokuwiki.org
www.phpbb.com
mastodon.social
bsky.app
www.linkedin.com
88.198.21.111
https://winscp.net/eng/docs/executables
https://winscp-static-746341.c.cdn77.org/assets/css/bootstrap-modified.css?v=143

Other scans of winscp.net (1)

This host has been scanned before. Each scan is a separate observation, so a verdict here does not carry over to the others.

20 Aug 2026 - unknown · https://winscp.net/eng/index.php

Questions about winscp.net

Is winscp.net safe?: The scan of winscp.net on 20 Aug 2026 reached no verdict either way (score -12). Too little was captured to judge it, which is an unknown rather than a pass.
What malware is associated with winscp.net?: 1 analysed samples communicate with this URL, including HUILoader.
How was winscp.net checked?: A static pass resolved DNS, captured TLS and headers and followed the redirect chain, and where the fast tier allows, a headless browser rendered the page and recorded every request. Egress is SSRF-locked. Signatures that matched only page text are weighted far below one that matched a served file, because a page documenting malware matches the same rules.

Scanned at the fast tier - see how URL scanning works.

Scan another URL · Latest analyzed threats · All scans of winscp.net

Scanned on MalwareAnalyzer by Cyble · Open interactive scan