hponline.run.place: a server listed for script files tagged VIPKeylogger, and what to do if a PC ran them

What hponline.run.place is, and what we know about it

hponline.run.place is not a program on your PC. It is a web address that the abuse.ch project URLhaus lists as a place where malware was served. We found no public write-up of this one address, so what follows is what URLhaus shows, what we could and could not test ourselves, and what security vendors have published about the malware family the entries are tagged with.

1. 1

   What URLhaus lists

   Three file addresses on hponline.run.place. Two are a .js file with a long random looking name (6Derwj and so on, 37 characters) that sits in a folder called caty, once directly and once inside a second folder called ccaattss. The third is a PowerShell file called Crypted.ps1 in ccaattss. All three were added on 24 September 2026, two at 06:31 UTC and one at 06:32 UTC, all carry the threat label malware_download and the reporter is abuse_ch.

2. 2

   What the tags mean

   js and ps1 are the file types, JavaScript and PowerShell. ascii says the file is plain text, so it is a script, not a compiled program. opendir means the folder could be listed by anyone who asked the server. VIPKeylogger is the name of the malware family the reporter linked the files to. A tag is a claim by a reporter, not a proof.

3. 3

   What we could not confirm

   We did not download any of the files, so we cannot tell you what is inside them. We also do not know how a PC is made to ask for them. That first step is not visible from the server side.

4. 4

   What this means for you

   If you saw the name in a firewall log, a blocked request or a warning, you are not infected by that alone. The risk is for a PC where something already ran and went to fetch one of these scripts. A normal visitor has no reason to ask for a file called Crypted.ps1.

Kind of threat

A server that hands out script files (.js and .ps1) tagged VIPKeylogger, a keylogger and information stealer for Windows

Where the files are

hxxps://hponline[.]run[.]place/caty/ and hxxps://hponline[.]run[.]place/ccaattss/ (file names are random; we do not print them in full)

Parent domain registered

run.place was registered on 18 June 2022 through Netdorm, Inc. dba DnsExit.com; status client transfer prohibited (RDAP, read 17 October 2026). hponline is a name in front of it, and the RDAP record does not say who controls that name

URLhaus entries

3 file addresses, all added on 24 September 2026; all 3 marked offline in the data we hold on 17 October 2026

Delivery

Script files fetched by something already running on the PC. The step before that is not known

Platform

Windows. Splunk describes VIPKeylogger as a .NET stealer. Nothing we read says Mac, iPhone or Android are affected

What we checked on 17 October 2026, and what we could not

Our server did not open hponline.run.place. The check tool refused the request because the name now resolves to a private or local address. That clears nothing, and it is a result in itself that we cannot read with certainty.

What happened to hponline.run.place, from registration to our check

The reports are all from two minutes on one morning, more than three weeks before our check. The dates come from RDAP and from the URLhaus data we hold; the times are UTC.

1. 18 June 2022

   The parent domain run.place is registered

   RDAP shows run.place registered on 18 June 2022 through Netdorm, Inc. dba DnsExit.com, with the status client transfer prohibited. That is the whole domain, not just the hponline name. It is more than four years old, so a young domain is not the warning sign here.

2. 24 September 2026, 06:31 UTC

   Two files are reported

   abuse.ch adds Crypted.ps1 in the folder ccaattss, and a .js file in ccaattss/caty. Both are tagged ascii, opendir and VIPKeylogger; the PowerShell file also carries the tags powershell and ps1.

3. 24 September 2026, 06:32 UTC

   A third file, the same script in another place

   The same .js file name is reported again, one folder higher, in /caty/. A second copy of one file in a second folder suggests a server where the operator moved or copied files. That is our reading of the paths, not something a report says.

   

4. 17 October 2026

   All three are offline, and our check makes no request

   The data we hold marks all three entries offline. The check tool did not contact the name because it points to a private address. We have no later report. We do not know whether the operator stopped, moved to another name, or only changed the records.

What the pattern suggests, and what it does not: a short burst of reports followed by silence is common for this kind of server, which is often used for a few days and then dropped. It does not tell you that copies already delivered are harmless, and it does not tell you the same operator is gone.

How script files like these lead to a keylogger

A script file cannot harm you by being listed, and not by sitting on a server. It works when something on the PC downloads it and runs it. We did not see the files, so the picture below is the usual shape of the chain, matched with what the tags tell us.

1. 1

   A first file is opened on the PC

   Forcepoint, which analysed VIPKeylogger, reports that it spreads through phishing emails with archive or Microsoft 365 style attachments. Opening the lure starts the chain. We do not know whether this server belongs to such a campaign.

2. 2

   It asks the server for a script

   The names in the URLhaus rows (a random 37 character .js name and Crypted.ps1) are what a loader would ask for. The word Crypted in a file name usually means the next stage is wrapped or scrambled so that it is not recognised on sight. That is our reading of the name.

3. 3

   The script starts the real program

   A PowerShell or JavaScript file is plain text, so it passes many filters that block programs. Forcepoint describes the stealer payload as hidden inside a bitmap image kept in the program's resources and loaded into memory. Whether these scripts do that is not known.

4. 4

   The keylogger runs and sends data out

   Forcepoint lists keystrokes, clipboard content, screenshots, browser history, cookies and mail configuration, sent out through channels that include Telegram. From then on a person elsewhere receives what you type.

The useful defences are earlier (do not run the first file) and later (notice the keylogger and change what it saw). A listed address on a log tells you a chain may have started, not how far it went.

What VIPKeylogger is

VIPKeylogger is a Windows information stealer written for the .NET platform. Two vendors describe it, and they agree on the main points; neither describes this server.

What a keylogger like this can take from a Windows PC

The list below is what the sources say the family collects. No single report proves that every item was taken from every victim, and for the files on this server we know nothing more than the tag.

What this can cost you

Reading the name or seeing it in a log costs nothing. The risks below apply to a Windows PC where a script from this server ran and the keylogger started.

• High

  Passwords and accounts

  A keylogger records what you type into every site. Changing a password on the infected PC does not help, because the new one is recorded too.

• High

  Logged in sessions

  Cookies and screenshots can show a thief an account you are already signed in to. Signing out of all devices after the clean up closes that.

• High

  Crypto and banking

  Wallet addresses copied to the clipboard and passwords typed for an exchange are exposed. Crypto sent from a stolen wallet cannot be reversed.

• Medium

  Work and email

  Mail settings and typed logins for work systems can lead to the next break in, for example a forwarding rule or a fake invoice sent from your address.

• Medium

  More malware on the same PC

  A script loader can fetch several programs. A keylogger found on a PC is a reason to look for others.

• Low

  Nothing, if you only saw the name

  A name in a block list, a log or a warning is not an infection.

What you may notice, and what you may not

Keyloggers are built to be quiet. The signs below come from the reports and from what they imply; none is certain, and most victims notice nothing.

How a person ends up asking for these files

Nobody visits hponline.run.place on purpose. The request comes from a program, so the real question is how that program got on the PC. We cannot say for this server; the route below is the one the vendor found for the family.

1. 1

   An email attachment

   Forcepoint describes phishing emails with archive files or attachments dressed up as Microsoft 365 documents. Opening one is what starts the chain.

2. 2

   A file that looks like an invoice or an order

   The names are made to look like business paperwork. We have no sample from this server, so we cannot name the lure. If you opened an attachment you did not expect, start with the checks below.

3. 3

   A staging or test server, or a hacked site

   A server with a folder that anyone can list (the opendir tag) may be a careless operator, a test machine or a hacked host. We do not know which one this is, and we do not claim that the owner of the parent domain did anything wrong.

Check your PC before you delete anything

Start with the question that matters: did something on this PC contact hponline.run.place, or did you open an unexpected attachment, script or installer around the end of September 2026? If you saw the name in a firewall or DNS log, the device that asked is the one to check. If the answer is yes or you are not sure, do the checks below. None of them deletes anything.

While you check, stop using the PC for banking, email, work or crypto, and disconnect it from the network if you can.

1. 1

   Disconnect first

   Turn off Wi-Fi or unplug the network cable. A keylogger needs the connection to send what it recorded.

2. 2

   Find which device asked for the address

   If you came here from a log, a router page or an alert, note the device and the time. Only that device is in question, not every device on the network.

3. 3

   Open Protection history

   In Windows Security > Virus & threat protection > Protection history, look for anything blocked, quarantined or allowed around the time of first contact.

4. 4

   Look at Startup apps

   Open Settings > Apps > Startup. Look for names you did not install, especially ones with random letters. Write the name down; do not delete yet.

5. 5

   Look in Task Scheduler

   Press Start, type Task Scheduler and open it. In Task Scheduler Library look for tasks you do not know that run a script or a program from a user folder. A task is one common way for a script loader to start again after a restart; we did not find a source that says so for this server, so a clean list does not clear the PC.

6. 6

   Look at running processes

   Open Task Manager and, on the Processes tab, look for a program you do not know that uses network or CPU, or for powershell.exe or wscript.exe running with no reason. Right-click a process and choose Open file location to see where it lives. A process in AppData with a random name is the case to take seriously.

7. 7

   Check Defender exclusions

   In Windows Security > Virus & threat protection > Manage settings > Exclusions, look for folders you did not add. Malware sometimes asks for exclusions so it is not scanned. A clean list does not clear the PC.

8. 8

   Check your accounts from another device

   Look at the sign in activity of your email, bank and exchange accounts, and at crypto balances. This is quicker than any file check.

9. 9

   A scan helps, but it does not clear the PC

   A scan with Microsoft Defender or another product can find known files. Treat a clean result like a clean site test: one data point. We did not infect a PC, so the order of the plan is our judgement from Microsoft's pages, not a tested result.

If you own the site or the domain

The address may belong to someone who did not mean to host malware: a hacked site, a staging server or a name that someone else controls under a shared domain. The reports cannot tell these cases apart, and we do not claim that any owner did anything wrong. Names under a shared domain have been misused before: SC Media reported in 2014 that Microsoft took control of 23 free No-IP domains to stop njRAT malware. We did not confirm that run.place offers free names.

1. 1

   Look in the folders named in the reports

   The reports name the folders caty and ccaattss. If you run a server with the name hponline, look for those folders and for files you did not put there, and keep a copy of them offline for analysis before you delete anything.

2. 2

   Close the open folder listing

   The opendir tag means the folder could be browsed. Turn off directory listing in the web server settings so a visitor cannot list files.

3. 3

   Change every login that touches the server

   Change the hosting, control panel, FTP, database and admin logins from a clean device, then update the site software. If you cannot tell how files got there, restore from a backup made before 24 September 2026 and re-check it.

4. 4

   Check the DNS records

   Our check was refused because the name resolves to a private address. Look at your records to confirm each one is yours. A name that points somewhere you did not set, or that is a leftover test entry, should be removed. The domain registry record shows run.place registered through DnsExit.com; ask that provider for help if the name is not under your control.

If you use a Mac, an iPhone or an Android phone

The tags and every source we read describe a Windows threat. We found nothing that says the files on hponline.run.place affect anything else.