ikovrsps.com: a server handing out Java game files and an EXE tagged stealer and CoinMiner, and what to do if you ran them

What ikovrsps.com is, and what we know about it

ikovrsps.com is not a program on your PC. It is a web address that the abuse.ch project URLhaus lists as a place where malware was served. The three files are named like parts of a game download, and the tags mention runelite, which is the name of a well known add on client for the game Old School RuneScape. We found no public write up of this address, so this page uses what URLhaus shows, what our server saw, and vendor reports on similar Java stealers.

1. 1

   What URLhaus lists

   Three file addresses on ikovrsps.com: /Ikov.jar, /Mina.jar and /gamefiles/image.exe. Ikov.jar was added on 6 October 2026 at about 16:19 UTC, Mina.jar and image.exe on 7 October at about 04:41 UTC. All three carry the threat label malware_download and the same reporter, rc4. When we read our copy of the data, only image.exe was marked online; the two jar files were marked offline.

2. 2

   What the tags mean

   stealer means the file is said to steal data such as passwords. CoinMiner (on the two jar files) means it is said to use your processor to mine cryptocurrency for someone else. runelite names the game client the files imitate or hide behind. runelure is a tag we cannot explain: we found no vendor page that defines it, so we do not claim to know whether it is a family name or a label the reporter made up.

3. 3

   What we could not confirm

   We did not download any of the three files, so we cannot tell you what they do, what they connect to, or which Microsoft detection name they carry. URLhaus shows tags, not proof. We also do not know how a victim is sent to this address; the first step is not visible from the server side.

4. 4

   What this means for you

   If you only saw the name in a firewall log, a blocked request or a warning, you are not infected by that alone. The risk is for a Windows PC where someone downloaded and ran Ikov.jar, Mina.jar or image.exe, or where a program fetched them. Our reading of the file names is that they target players of a game server called Ikov; that is a guess from the names, not a finding.

Kind of threat

A server that hands out two Java archives and one Windows program, tagged stealer; the two jar files are also tagged CoinMiner

Where the files are

hxxps://ikovrsps[.]com/Ikov.jar, hxxps://ikovrsps[.]com/Mina.jar and hxxps://ikovrsps[.]com/gamefiles/image.exe

Domain registered

22 January 2026, registrar Ultahost, Inc., status active (RDAP, read 7 October 2026)

URLhaus entries

3 file addresses, added 6 and 7 October 2026; 1 online (image.exe) and 2 offline in our copy of the data

Delivery

Not known. Game files that people download by hand or through a launcher are the likely route, which is our reading of the names

Platform

Windows for image.exe. A .jar file runs on any system with Java, so Mac and Linux users who ran a jar are also in question; the stealer part that the tags describe has only been documented for Windows

What we checked on 11 October 2026, and what we could not

We made one plain request to https://ikovrsps.com/ from our server, with no browser and no clicks. The server answered with a redirect to a different address. That clears nothing: a plain request is exactly what a cloaking server can answer differently from a real visitor.

What happened to ikovrsps.com, from registration to our check

The domain is under nine months old and every report is from the last week. The dates come from RDAP and from the URLhaus data we hold; times are UTC.

1. 22 January 2026

   The domain is registered

   RDAP shows ikovrsps.com registered on 22 January 2026 through Ultahost, Inc. The record was active when we read it on 7 October 2026.

2. 6 October 2026

   Ikov.jar is reported

   At about 16:19 UTC abuse.ch contributor rc4 adds https://ikovrsps.com/Ikov.jar with the tags CoinMiner, runelite, runelure and stealer. The file is marked offline in our copy.

3. 7 October 2026

   Mina.jar and image.exe are reported

   At about 04:41 UTC the same reporter adds Mina.jar (tags CoinMiner, runelite, runelure, stealer, offline) and gamefiles/image.exe (tags runelite, runelure, stealer, online). Two entries within two seconds suggest the files were found together.

   

4. 11 October 2026

   Our plain request

   The home page answers with a 307 redirect to a different host. We do not know whether the files are still served.

What the pattern suggests, and what it does not: a domain that waits nine months and then serves three files within a day looks like a server prepared for a campaign. That is our reading of the dates; no report says it.

How a Java game file can carry a stealer

We did not open Ikov.jar or Mina.jar. Security vendors have, however, published detailed analyses of Java archives that hide stealers behind game mods, and the mechanism is the same kind. Read the points below as how such files work in general, not as proof of what these two do.

1. 1

   A person installs a file that looks like part of a game

   Check Point Research (18 June 2025) describes fake Minecraft mods and cheat tools on GitHub. The Java archive in that campaign did nothing when run with java -jar; it only ran when it sat in the Minecraft mods folder and the game started. That is why a casual scan or a sandbox without the game can see nothing.

2. 2

   The first stage checks where it runs

   Check Point says the downloader compared system properties with a list of virtualization keywords and ran tasklist to look for analysis and network tools, and quit if it found them. A researcher's test machine therefore often sees a harmless file.

3. 3

   It fetches the next stage

   In Check Point's case the address of the second stage was stored in a Base64 paste on Pastebin and loaded into memory. Bitdefender (published 8 June 2023, updated 21 May 2025) describes a staged Java chain called Fractureiser with a first stage that creates persistence and a later stage that downloads and updates the final payload.

4. 4

   It spreads and stays

   Bitdefender found that the malware tried to infect other Java archives on the PC, including ones that are not game mods, and stripped their signature files afterwards. In one variant it installed a Windows service. Any program that runs Java could therefore be carrying it.

5. 5

   It sends your data out

   Check Point lists Minecraft and Discord tokens, Telegram data, browser logins, wallet data and a screenshot, sent in a zip to a Discord webhook. Intego (29 May 2026) describes a newer polymorphic Java loader whose Windows payload sends Discord tokens and account fields to a Discord webhook.

A cryptocurrency miner, as the CoinMiner tag says, is a different goal: it uses your processor and graphics card, and the first sign is usually a hot, slow PC. Whether Ikov.jar and Mina.jar carry a miner, a stealer or both, we cannot say; URLhaus gives only the tags.

What a stealer of this kind can take from a Windows PC

The list below is what the sources say comparable Java based stealers take. It is not a list of what these three files take, because we did not open them. Each item is named by at least one source.

What this can cost you

Reading the site or seeing its name costs nothing. The risks below apply to a PC where one of the three files was run.

• High

  Game, Discord and email accounts

  A stolen token lets someone use an account without the password, and it can survive a password change until the session is signed out. Game accounts with valuable items are a common target.

• High

  Crypto and banking logins

  Wallet data and saved browser logins are on the lists above. Crypto sent out cannot be recalled, and a clipboard swapper can redirect a payment you make later.

• Medium

  A slow, hot PC from mining

  The CoinMiner tag points to a miner. It wears out fans, raises the power bill and makes the PC unusable for games.

• Medium

  More infected files

  Bitdefender found that the malware it studied infected other Java archives. Files you copy to friends can carry it on.

• Low

  Nothing, if you only saw the name

  A name in a block list, a log or a warning is not an infection.

What you may notice, and what you may not

Stealers are built to be quiet. The signs below come from the sources and from the CoinMiner tag; none is certain, and many victims notice nothing.

How a person ends up with these files

Nobody needs to visit ikovrsps.com for any other reason than to download the files. We cannot say how people are led there. The routes below are the ones vendors found for similar Java game malware.

1. 1

   A fake or modified game client

   The tag runelite and the folder name gamefiles suggest a client download. The OSRS Wiki says the official RuneLite site is runelite.net and that on 2 March 2022 Jagex and RuneLite added a link to it on the game homepage, particularly to prevent phishing by fake RuneLite websites. Anything else offering a client is not that.

2. 2

   Mods and cheat tools from a repository or chat

   Check Point found fake mods with fake stars on GitHub. Stars and forks do not show a file is safe.

3. 3

   Files shared inside a gaming community

   Intego notes that a jar can be passed through shared folders, chat apps and gaming communities. A file sent by a friend whose account was taken over is a common start.

4. 4

   A private server's own download

   A private game server needs its players to install a client. That makes a download page believable. We did not see this server's page and do not say that the server itself is a fraud; we say that the files URLhaus lists are tagged as malware.

Check your PC before you delete anything

Start with the question that matters: did you or anyone on this PC download or run Ikov.jar, Mina.jar or image.exe, or a game client from a server called Ikov? If you saw the name in a router or DNS log, the device that asked is the one to check. If the answer is yes or you are not sure, do the checks below. None of them deletes anything.

While you check, stop using the PC for banking, email, work or crypto, and disconnect it from the network if you can.

1. 1

   Find the files

   Open File Explorer > Downloads and look for Ikov.jar, Mina.jar and image.exe, and for the game folder you installed. Note names and dates; do not open them.

2. 2

   Look at Installed apps

   Open Settings > Apps > Installed apps and sort by install date. Look for a game client, launcher or Java tool you did not install on purpose.

3. 3

   Look at Startup apps

   Open Settings > Apps > Startup. A name you do not know, or a Java launcher that starts with Windows, is worth writing down. Do not delete yet.

4. 4

   Check Task Manager

   Press Ctrl+Shift+Esc, open Processes and sort by CPU. Look for javaw.exe or a program you do not know using a lot of processor while you do nothing. Bitdefender also names a Windows service called NekoService for one build; look in Services only as a hint, since this server's files may differ.

5. 5

   Open Protection history

   In Windows Security > Virus & threat protection > Protection history, look for anything blocked or quarantined around the time of the download. Microsoft says offline scan results appear there too.

6. 6

   Check your accounts from another device

   Look at sign in activity for email, Discord, your game account, bank and exchange accounts, and at crypto balances. This is quicker than any file check.

7. 7

   A scan helps, but it does not clear the PC

   A scan can find known files. Check Point says the Java downloader it studied had no detections when published, and Java loaders are often overlooked. Treat a clean result as one data point. The plan below is our judgement from Microsoft's pages and the vendor write ups, not a tested removal.

If you use a Mac, an iPhone or an Android phone

The file image.exe is a Windows program. The two .jar files are Java archives, which can run on any system with Java installed.