chocolatey.org
104.18.21.76AS13335 · USthe page states an executable (https://community.chocolatey.org/install.ps1) and the file it delivered was analysed and came back clean; the only context signal is one an honest download page produces (delivers a script, not an installer ("install.ps1")).
- Delivered filesuspicious
- Browser Analysisclean
- Content Inspectionclean
- Threat Intelligenceclean
- Network & Hostingclean
- Related Infrastructureclean
- Domain Intelligenceunknown
- TLS Fingerprintunknown
Looks safe
AutomatedIts form submits what you type to a different website than the one you are on. Our automated checks did not find known threat signals on this site at the time of the scan.
What to do
No action needed. Stay alert as usual — a clean result reflects this scan only, and sites can change after they are checked.
A clean result means no known threat signals were found in this scan — it is not an absolute guarantee, and a site can change after it is checked.
Findings
Strongest firstWe analysed the file this page delivered — it is Suspicious.
Success
SHA-256 44e045ed5350758616d664c5af631e7f2cd10165f5bf2bd82cbf3a0bb8f63462
The page hands the visitor a program to run rather than a document to read. We fetched the file it delivers and the file analyser returned Clean, and every signal that counted here is one an honest download page produces — so this is recorded as what the page does, not as a reason to distrust it.
Analyst noteContext, not an accusation: the executable-delivery suspicion was withdrawn on an explicit Clean file verdict (never on "not Malicious", never on Unknown). If you are re-checking this page, verify the delivered file's publisher and signature — and note that a lure's payload can be validly signed too, which is why the withdrawal also requires that no signal accuses the host or a brand.
File
Stored by the engineWhat you download may be live malware. Open it only in an isolated environment, and do not double-click it.
The ZIP is encrypted. Password:infected
Inside the ZIP the file carries a name the engine generated, not the one the page used.
Delivered fileCleaninstall.ps1
SHA-25644e045ed5350758616d664c5af631e7f2cd10165f5bf2bd82cbf3a0bb8f63462
Fromhxxps://community[.]chocolatey[.]org/install[.]ps1
Infrastructure
- IP
- 104.18.21.76CLOUDFLARENET - Cloudflare, Inc., US · AS13335US
- TLS
- CN=WE1, O=Google Trust Services, C=US · expires Oct 26, 2026
WHOIS
- Registrar
- GoDaddy.com, LLC
- Created
- May 20, 2011
- Expires
- May 20, 2027
- Nameservers
- hope.ns.cloudflare.comowen.ns.cloudflare.com
Hashes & fingerprints
Page capture
LiveTitle “Chocolatey Software | Installing Chocolatey”
Engines
8 · time to verdictPage
- HTTP
- 200 · Completed
- Title
- Chocolatey Software | Installing Chocolatey
- Load
- 1.57 s · 34 requests