DMARC-Filter: OpenDMARC Filter v1.4.2 sourceware.org B17BD3858D28
MIME-Version: 1.0
References: <LO3P123MB334069FD42052E97C5917179811FA@LO3P123MB3340.GBRP123.PROD.OUTLOOK.COM>
 <5bbc924c-27ad-be4d-b49c-4a1ce8b6ba9c@bfs.de>
In-Reply-To: <5bbc924c-27ad-be4d-b49c-4a1ce8b6ba9c@bfs.de>
Date: Tue, 22 Aug 2023 11:28:56 -0600
Message-ID: <CANV9t=SuB44pkW8z3xqngpFTo3PqFGpAH1-UyV6n17uAD-=+yw@mail.gmail.com>
Subject: Re: Virus Total scan
To: cygwin@cygwin.com
UI-OutboundReport: notjunk:1;M01:P0:yuBs1f8LVXU=;ETCK4LmsKRhnHmsCXFTcCJC+6ER
 Q069tkgvCAvgz2ILt4HIEosPyuhGVBGS4I7tWxj3tlf+3OAqslLAJe5hEd6uaWWoqmVOJEhb9
 HI2GBvHbbgOfIlZh6V2dbB8PLgjPm0a30rCHVrc5XulrP0pyXz/5igzrfWSkvZbk/EkGEGGYX
 pmeREPfhpZyzxxnI6PHdjrVDnxxBwYJV+v4BTQuv/O/7w2TOhkPQ2Y52IwqpEz+W4dyjU9Z83
 WhNsVtoqfC76csFWbxoq8X2RkRnFQHioFVEpMz6rKT9w8CgCsmaNQ49KBmL8vEPu48eNYLPZ/
 Os/i8nOO2xUrZM5pRHCn9ScnJTJg/e/kdAYUHZHyXq2DkotUUugxazbccElZxH6LNQzIisUMq
 o45ensu1kITdWPpNk8ZXQsf5CGNv00xhYRmj8w1cfMCgu4w/oTZrlszq6U5+SJ4U4tWZXbANC
 WSeJmpMgh9aobRYmUEYD8gRKnmIV5GknzDJafm9Fns2/SkUGxz3ZnNqD5BhMxOyvezSBcsQim
 3r4qQedIigLXi/Ske5osRhsDAKyTYv6W8C6LTgTAf83Z4spGHfqbpW436T6pVEi1n/Jeq2zQc
 oTmZN6O10mjN3MA8Oc1v80OJkpZf3hxhS9mBM4+VSqGweMj4ijxm3ct9EYafmBjyuOPNjQb3Z
 3aZKEF9itrWOjjqmR06lIIbgSy57DdZJtUcK4xrydbMI8Wu2Yyek3FNJeuKMmUbY7tO34ZSvg
 xGUo9F+UaBbQuqCtlJRaSW75dVCI0Qjhi6O3SFDVF/+r9Trsz8jCTVbcgRs8b50gObFm1vsiY
 S2lBhcX27MuJZfErmqQIw39nUiXmGIqudK3KSnu6z3Wek7QRE+xsCmDj4OnYVk2b926tuF7Rt
 qKbUBsD9Sdh93UfOuVopqChdZsVTu/vekbrfv50z1jCQMrs58Jo4z+OsX73D8diin6ofRYY7f
 gR3lJFiUANhGWfsHXfUFQxFbs8M=
From: Bill Stewart via Cygwin <cygwin@cygwin.com>
Reply-To: Bill Stewart <bstewart@iname.com>
Content-Type: text/plain; charset="utf-8"
Sender: "Cygwin" <cygwin-bounces+archive-cygwin=delorie.com@cygwin.com>
Content-Transfer-Encoding: 8bit

On Tue, Aug 22, 2023 at 9:00 AM Thomas Schweikle wrote:

It is the address of one of the distribution servers. Since this is not
> "one server", but a cluster of servers, your "suspicious" server shows
> only one thing: those "suspicious" flags are suspicious by themselves:
>
> this particular server ist down since some time and only reports back a
> broken html page telling "<h2>Our services aren't available right
> now</h2><p>We're working to restore all services as soon as possible.
> Please check back
> soon.</p>06cvkZAAAAAA8FvmXFYIOTZ2TS15AJl0/RFVTMzBFREdFMDkxNwBFZGdl"
>
> If this is enough to get flagged as "suspicious" ...
>

Unfortunately yes, nowadays.

I have run into this same problem also because I wrote an installer for an
open source tool. Said tool makes outgoing TCP connections to servers
configured as relays. One of the IP addresses used by one of these relays
was (or is) shared with a "dangerous" service. As a result I had to disable
the relay feature in the installer as a default to (hopefully) reduce the
number false positives.

Bill

-- 
Problem reports:      https://cygwin.com/problems.html
FAQ:                  https://cygwin.com/faq/
Documentation:        https://cygwin.com/docs.html
Unsubscribe info:     https://cygwin.com/ml/#unsubscribe-simple