Is raw.githubusercontent.com safe?

Page Content

The URL serves a direct binary download of ScreenConnect.ClientSetup.exe from a GitHub repository. The file name suggests remote access software, but the malicious detection indicates this is a trojan or backdoor disguised as legitimate software.

Infrastructure

The file is hosted on IP 185.199.111.133 with a low abuse score of 7/100. The connection uses valid SSL from Let's Encrypt. The domain raw.githubusercontent.com is legitimate GitHub infrastructure that threat actors frequently abuse for malware distribution because it allows direct file downloads without additional processing.

Domain History

The domain githubusercontent.com has been registered since February 2014 and is owned by GitHub, Inc. The 12.5-year age reflects legitimate infrastructure, not a newly created malicious domain. The subdomain raw.githubusercontent.com serves raw file content from public repositories.

Web Reputation

Three independent threat intelligence sources document this abuse pattern. Talos Intelligence flagged the subdomain for malicious activity. Malwarebytes warned about fake software targeting creators and gamers through GitHub downloads. Cofense confirmed threat actors use githubusercontent.com links to distribute malware and remote access trojans.

What this means for you

Do not download or execute this file. The combination of antivirus detections and documented abuse patterns indicates this is malware distribution, not legitimate software.