massgravel.net: a look-alike of the Windows activation tool site, reported for PowerShell malware, and what to do if you ran its command

What massgravel.net is, and what we know about it

massgravel.net is not a program on your PC. It is a web address that the abuse.ch project URLhaus lists as a place where malware was served, under the tag fakemas. That tag points at a fake copy of the MAS activation tool site. We found no public write-up of this one address, so what follows is what URLhaus shows, what our own request returned, and what the real MAS project and other sources say about fake MAS sites in general.

1. 1

   What URLhaus lists

   Four addresses on massgravel.net: the home page, a path called /get, and two zip files called Update.zip and Updatef.zip. Three were added on 18 September 2026 between 05:04:30 and 05:04:35 UTC and the home page on 21 September 2026 at 07:07 UTC. All four carry the threat label malware_download, all four are marked offline, and the reporter is a user named ave9858.

2. 2

   What the tags mean

   fakemas is a name chosen by the reporter for a fake MAS site. powershell and ps1 say the file served is a PowerShell script. ua-ps most likely means the server answered with the script only when the request looked like it came from PowerShell, and with something else to a normal browser; that is our reading, not a statement from the reporter. The two zip files carry only the tag fakemas.

3. 3

   What we could not confirm

   We did not download anything, so we cannot tell you what the script or the zip files did, which malware family they belong to or where it reported to. URLhaus shows tags, not a proof. We also cannot say whether this address belongs to the same campaign that other researchers described for a different look-alike domain.

4. 4

   What this means for you

   If you only saw the name in a log, a blocked request or a warning, you are not infected by that alone. The risk is for a Windows PC where a person pasted a command into PowerShell that contained this address instead of the real one.

Kind of threat

A look-alike of the MAS activation tool site; URLhaus tags it fakemas, powershell, ps1 and ua-ps

Where the files were

hxxps://massgravel[.]net/ (home page), /get, /Update.zip and /Updatef.zip

Domain registered

30 August 2026, registrar NICENIC International Group Co., Limited; status includes client hold, client delete prohibited and client transfer prohibited (RDAP, read 18 October 2026)

URLhaus entries

4 addresses, added 18 September (3) and 21 September 2026 (1); all offline when we read our copy of the data

Delivery trick

Copying the real MAS command and changing one part of the address, so the command runs the attacker's script

Platform

Windows. MAS is a Windows and Office tool and the files are PowerShell. Nothing we read says Mac, iPhone or Android are affected

What we checked on 18 October 2026, and what we could not

Our server asked for the address once and the name did not resolve: the error was getaddrinfo ENOTFOUND. That means no server could be reached by that name at that moment. It clears nothing, because a domain can be switched off and switched on again, and because the files may already have been copied to other addresses.

What happened to massgravel.net, from registration to our check

The domain is under two months old at the first report. The dates come from RDAP and from the URLhaus data we hold; the times are UTC.

1. 30 August 2026

   The domain is registered

   RDAP shows massgravel.net registered on 30 August 2026 through NICENIC International Group Co., Limited. Nothing in the record says who registered it.

2. 18 September 2026

   Three addresses are reported within five seconds

   At 05:04:30 UTC the path /get is added with the tags fakemas, powershell, ps1 and ua-ps. At 05:04:32 UTC Updatef.zip follows and at 05:04:35 UTC Update.zip, both tagged fakemas. Three entries in five seconds suggests the reporter submitted them together after finding the set.

3. 21 September 2026

   The home page is reported

   At 07:07 UTC the address https://massgravel.net/ itself is added with the same four tags as /get. That means the front page returned a PowerShell script, not a web page, to a request that looked like PowerShell.

4. 18 October 2026

   Our check: the name does not resolve

   All four URLhaus entries show as offline, and our own request fails at the name lookup. The registry status client hold is consistent with this. We cannot say what happened between 21 September and today.

   

What the pattern suggests, and what it does not: a new domain, reports within three weeks and then silence looks like a short-lived address that was used and dropped. That is our reading of the dates, not something any report says, and it does not mean the people behind it stopped.

What MAS is, and why a fake site copies it

The real project is called Microsoft Activation Scripts, MAS for short, and publishes under the name massgrave. massgravel.net, with an extra letter l, is not it. The real project says so itself: its page warns that third parties may spread malware under the MAS name by changing the web address in the PowerShell command.

How a command with a changed address becomes malware on your PC

A command of the form download this address and run it is trust in one name. If the name is one letter wrong, the PC trusts the wrong owner and runs whatever that owner sends. We did not see the script on this address; the chain below is the general pattern the MAS project describes, with the facts we do have about this address marked.

1. 1

   A person gets a command with an address in it

   The place is usually a forum post, a video description, a chat message or a search result that promises a free Windows or Office activation. The command looks like the real one. Only the address differs, and a missing or extra letter is easy to miss in a long line.

2. 2

   The PC downloads text and runs it

   Such a command does not install a program you can see. It fetches text from the address and hands it straight to PowerShell, which runs it with the rights of the signed in user. If that user is an administrator, the script can change almost anything. Nothing is shown for you to approve.

3. 3

   The server may answer differently to PowerShell

   The tag ua-ps suggests this server's reply depended on who asked. A browser visit could then show a harmless page while PowerShell receives the script. This is one reason a quiet browser test never clears an address.

4. 4

   The script can fetch more

   The two zip files on the list, Update.zip and Updatef.zip, fit a second stage: the script downloads an archive, unpacks it and starts something inside. That is our reading from the names and the order of the reports. We did not see their contents.

5. 5

   What stays behind

   Unknown for this address. In the other fake MAS case that sources describe, the result was a loader that installed miners and a remote access trojan. Do not assume the same here, and do not assume it is milder either.

What this can cost you

Seeing the name costs nothing. The list below applies to a Windows PC that really ran a script from this address. We do not know what that script did, so the levels describe what is possible after any unknown PowerShell script has run with your rights, not what we proved.

• High

  Passwords and accounts

  A script run as you can read what your browser saves and what you type. If the unknown payload includes a stealer or a keylogger, every login on the PC is at risk. Changing passwords from the same PC does not help.

• High

  Someone else using your PC

  A second stage fetched as a zip may include a remote access program. That gives a stranger a seat at the PC. We do not know whether that happened here.

• High

  Crypto and banking

  If a wallet file or a seed phrase was on the PC, assume it can be copied. Crypto sent from a stolen wallet cannot be reversed.

• Medium

  A slow PC and a hot fan

  In the other fake MAS case that sources describe, the loader installed cryptominers. Miners use the processor and the graphics card, so a PC that suddenly runs hot and slow is a sign to check.

• Medium

  Security tools turned down

  Scripts that run as administrator can try to change Defender settings. We found no source saying this one did; we list it because it is a common first move, and because it is quick to check.

• Low

  Nothing, if you only saw the name

  A name in a block list, a log or a warning is not an infection.

Who can meet massgravel.net, and who cannot

Most people never meet this address. It matters to a narrow group, and it is better to say which than to frighten everyone.

What you may notice, and what you may not

We do not know what the files did, so there is no list of signs that belongs to this address. The signs below are the ones that fit any hidden payload started by a PowerShell script; none is certain, and many victims notice nothing.

Start with the question that matters: did you run a PowerShell command that contained massgravel.net, or one whose address you did not check letter by letter? Look in your PowerShell history or the page you copied it from. If you only saw the name in a log, find the device that asked. If the answer is yes or you are not sure, do the checks below. None of them deletes anything.

While you check, stop using the PC for banking, email, work or crypto, and disconnect it from the network if you can.

1. 1

   Disconnect first

   Turn off Wi-Fi or unplug the network cable. Many payloads need the connection to send data out or receive orders.

2. 2

   Find the command you ran

   Look at the post or message you copied it from, and compare the address with the real one on massgrave.dev, which names get.activated.win. If the address in your command is anything else, you ran something from a stranger.

3. 3

   Open Task Scheduler

   Press Start, type Task Scheduler and open it. Look in Task Scheduler Library for tasks you do not know, with random names, or that run PowerShell or a program from a user folder. Do not delete yet; write down the name and what it runs.

4. 4

   Look at Startup apps

   Open Settings > Apps > Startup and look for names you did not install. Entries here start with your Windows sign in.

5. 5

   Look at running processes

   Open Task Manager (Ctrl+Shift+Esc) and sort the Processes tab by CPU, then by Memory. Look for powershell.exe you did not start, unknown names, or a process that uses a lot of processor while you do nothing. Right-click a name and choose Open file location to see where it lives.

6. 6

   Open Protection history

   In Windows Security > Virus & threat protection > Protection history, look for anything blocked or quarantined around the time you ran the command.

7. 7

   Check Defender exclusions

   In Windows Security > Virus & threat protection > Manage settings > Exclusions, look for folders or processes you did not add. We found no source that says this address added exclusions, so an empty list does not clear the PC.

8. 8

   Check your accounts from another device

   Look at the sign in activity of your email, bank and exchange accounts, and at crypto balances. This is quicker than any file check.

9. 9

   A scan helps, but it does not clear the PC

   A scan with Microsoft Defender or another product can find known files. Treat a clean result like a clean site test: one data point. We did not infect a PC with files from this address, so the order of the plan is our judgement, not a tested result.

If you use a Mac, an iPhone or an Android phone

The tool being copied is a Windows and Office activator and the reported files are PowerShell. We found nothing that says massgravel.net affects anything else.