nd.tdpqnf.com: a server handing out text files tagged Agent Tesla, and what to do if a loader fetched them
nd.tdpqnf.com is a web address that URLhaus lists four times in two days for small .txt files, one tagged AgentTesla, a spyware trojan for Windows, and three tagged rev-base64-loader. A text file like that is not a virus you open by looking at it; it is a later stage that a script already running on a PC fetches and decodes.
If you only saw the name in a log, nothing is proven. If something on your PC may have fetched these files, treat the PC as watched: change your passwords from another device, then scan and clean or reset Windows.
Facts checked October 11, 2026. Removal steps tested on Windows 11 (26H2) and checked against Microsoft's and the browser makers' current documentation.
Automatic
Get a free scan and check if your PC is infected.
Fortect finds malware, unwanted programs and the Windows damage they leave behind, and repairs it in one pass.
If a script, loader or program that downloads text files from nd.tdpqnf.com keeps coming back after uninstalling, a scan can find what reinstalls it.
Do it yourself · free Remove nd.tdpqnf.com (Agent Tesla, rev-base64-loader text files) yourself 5 steps, about 15 minutes, no software needed.
Start the steps
Nd.tdpqnf.com (Agent Tesla, rev-base64-loader text files): summary
| Type | A malware server: URLhaus lists four .txt files, one tagged AgentTesla (a spyware trojan for Windows) and three rev-base64-loader |
|---|---|
| Risk | High if a script on your PC fetched its files: keystrokes, saved logins, screen and camera may be seen or taken. Low if you only saw the name |
| Symptoms | Often none. Unknown scheduled tasks, Run key or Startup entries, and accounts you did not touch are the signs in the sources |
| How to get rid of it | Change passwords from another device, run Microsoft Defender Offline, remove the startup entries, and reset Windows if you are not sure |
| Our check (11 October 2026) | One plain request from our server: a normal template web page, status 200. That clears nothing; the danger rating comes from URLhaus |
| Running since / first seen | Domain registered 20 June 2026; first files reported 7 October 2026 |
| Removal | Scan the PC with security software to find and remove the malware and anything installed with it. Fortect scans Windows for malware and repairs the system files and settings it damaged. Remove it nowTo use the full-featured product, you have to purchase a license for Fortect. The scan is free. |
Show 9 more facts
| Platform | Windows. Nothing we read says Mac or phones are affected |
|---|---|
| Detection names | No Microsoft detection name is known for the files on this server, because we did not open them |
| Name | Nd.tdpqnf.com |
| Domain registered | 20 June 2026 |
| Evidence | 4 write-ups by security sites; details still limited |
| First seen | 7 October 2026 |
| Distribution | Typically fake installers, cracked programs, e-mail attachments, fake "verify you are human" pages and ads for popular apps |
| Damage | Installs other malware, often several programs at once |
| Facts checked | 11 October 2026 |
Facts checked on 11 October 2026 against the URLhaus data for nd.tdpqnf.com held in our database (the abuse.ch site itself was not fetched), RDAP, one plain request from our server, and pages by MITRE ATT&CK, Cyble, Microsoft and the FTC. We did not download the files and we infected no PC; the removal steps follow Microsoft and FTC pages and were not tried on a live infection.
What nd.tdpqnf.com is, and what we know about it
nd.tdpqnf.com is not a program on your PC. It is a web address that the abuse.ch project URLhaus lists as a place where malware was served, as small text files. We found no public write-up of this one address, so what follows is what URLhaus shows, what our server saw, and what security sources have published about the malware family it is tagged with.
- 1
What URLhaus lists
Four file addresses on nd.tdpqnf.com, all on plain http, in three folders called fps, file and sma, each a short random name ending in .txt. Three were added on 7 October 2026 within three seconds of each other, and one on 8 October 2026. Three of the four are marked online in our copy of the data and one is marked offline. All carry the threat label malware_download and the reporter is abuse_ch.
- 2
What the tags mean
AgentTesla is the name of a spyware trojan for Windows; only the newest file, /fps/oocjafe.txt, carries it. That file also has the tags ascii, Encoded and opendir. The tag rev-base64-loader is on that file and on the two /file/ entries. Our reading of it is a loader whose text is written backwards and then encoded in base64, but URLhaus does not define the tag and we did not open the files. The /sma/ entry has no tags.
- 3
What we could not confirm
We did not download any of the files, so we cannot tell you what is inside them, which build of Agent Tesla they lead to or where it sends its data. URLhaus shows tags, not proof. We also do not know which attachment, link or program makes a victim's PC ask for these files. That first step is not visible from the server side.
- 4
What this means for you
If you only saw the name in a firewall log, a blocked request or a warning, you are not infected by that alone. The risk is for a PC where something already ran and went to fetch one of these files. A normal visitor has no reason to ask for them.
- Kind of threat
- A server that hands out .txt loader files; one is tagged AgentTesla, a spyware trojan for Windows, and three rev-base64-loader
- Where the files are
- hxxp://nd[.]tdpqnf[.]com/fps/oocjafe.txt, /file/mccppcS.txt, /file/jpeSoaI.txt and /sma/mnpckbo.txt: plain http, no secure connection
- Domain registered
- 20 June 2026 through IONOS SE, status client transfer prohibited (RDAP, read 7 October 2026). The registered domain is tdpqnf.com; nd is a subdomain of it
- URLhaus entries
- 4 file addresses, added 7 and 8 October 2026; 3 online and 1 offline in our copy of the data
- Delivery trick
- Loader code kept in plain text files so the download looks harmless. The entry step on the victim's PC is not known
- Platform
- Windows. MITRE describes Agent Tesla as a .NET trojan for Windows. Nothing we read says these files affect Mac, iPhone or Android
What nd.tdpqnf.com (Agent Tesla, rev-base64-loader text files) does on an infected PC
What we checked on 11 October 2026, and what we could not
Our check was one plain request to nd.tdpqnf.com from our server, with no browser and no clicks. It answered with an ordinary web page. That clears nothing: the reported files sit in other folders, and a server that hands out malware can show a harmless front page to anyone who does not ask for the right file.
Our server request, 11 October 2026
- The home page answered with a normal pageThe server replied with status 200, named itself Apache and gave the page title Leadership Event HTML5 Bootstrap v5 Template. That is the name of a stock web page template. It looks like a placeholder site. We do not know whether the page was put there to look innocent or was already on the server; we only know it is not what URLhaus lists.
- Why that is not a clean resultThe files are in the folders fps, file and sma, not on the home page. A quiet front door proves nothing about them, and malware servers often show a template to visitors who do not ask for a specific file.
- Redirects and notification requestNone seen in this one request. The request had no browser, so pop-ups, scripts and anything that needs a click were not tested.
- URLhaus listingFour file addresses reported on 7 and 8 October 2026; one tagged AgentTesla, three tagged rev-base64-loader; three online in our copy of the data.
- Downloads and the files themselvesWe did not download any file and did not open the folder listings. We cannot tell you what the files contain.
Dangerous: treat it as a malware server Our test was one request and it proves nothing either way. The danger rating comes from the URLhaus reports and their tags, not from our visit. Do not request files from this address and do not run anything that does.
What happened to nd.tdpqnf.com, from registration to our check
The domain is under four months old and every report is from the last five days. The dates come from RDAP and from the URLhaus data we hold; the times are UTC.
20 June 2026
The domain is registered
RDAP shows tdpqnf.com registered on 20 June 2026 through IONOS SE, with the status client transfer prohibited. That status only stops the domain being moved to another registrar. It says nothing about who runs the server.
7 October 2026
Three file addresses are reported
At about 18:04 UTC abuse.ch adds /sma/mnpckbo.txt, /file/jpeSoaI.txt and /file/mccppcS.txt, one second apart. The two /file/ entries are tagged rev-base64-loader and online. The /sma/ entry has no tags and is already marked offline in our copy.
8 October 2026
A fourth file, tagged AgentTesla
At about 09:11 UTC abuse.ch adds /fps/oocjafe.txt with the tags AgentTesla, ascii, Encoded, opendir and rev-base64-loader. It is marked online. The opendir tag says a folder could be browsed openly.
All four URLhaus entries for nd.tdpqnf.com in our data on 11 October 2026. Three folders, one naming pattern. 11 October 2026
Our request
Our server asks for the home page and gets a normal page titled Leadership Event HTML5 Bootstrap v5 Template, status 200. Three of the four reported files are still marked online in the data we hold.
What the pattern suggests, and what it does not: three folders with different names and a new file one day later look like an operator who keeps preparing files, not a single leftover. That is our reading of the dates, not something any report says.
How a text file can lead to a spyware trojan
A text file cannot hurt you by sitting on a server or by being opened in a viewer. It works only when a script that is already running reads it and turns it into a program. We did not see the files on nd.tdpqnf.com; this is how published Agent Tesla analyses describe similar chains.
- 1
A first script is already running
MITRE says the main way Agent Tesla is delivered is phishing email. Cyble describes a campaign where a compiled help file (CHM) runs a PowerShell command that downloads a script named nm.txt from a server. So a file with the ending .txt can be a script that a command fetches and runs, not a note.
- 2
The text is a script, not a document
In the Cyble case the downloaded script is a string that was encoded in base64 and compressed, and decoding it exposes a second base64 layer that holds a loader library, which in turn unpacks Agent Tesla. The reversed layer in our tag name is our reading: the tag rev-base64-loader suggests text written backwards and then base64 encoded, a way to keep plain scanners from reading it.
- 3
The decoded part is a program
The last layer is a Windows .NET program. Because the file on the server is only text, a filter that blocks program file types sees nothing unusual. The decoding happens on the PC, in memory, which is why files on disk may look clean.
- 4
The trojan runs and calls out
From then on Agent Tesla works as MITRE describes: it logs keys, takes screenshots, collects saved logins and sends them out. The next section lists what the sources say it does.
Cyble's chain is one campaign among many and may differ from the one behind this server. We use it to show how the pattern works, not to claim that nd.tdpqnf.com is part of it.
What Agent Tesla is
Agent Tesla is a commercial style spyware trojan that criminals have used for years. The facts below come from MITRE ATT&CK, page version 1.3, modified 16 April 2025. Whether the files on this server really lead to Agent Tesla is not confirmed by us; the tag is the report of the person who submitted them.
| Question | What the sources say | Source |
|---|---|---|
| What is it? | A spyware trojan written for the .NET framework, for Windows | MITRE ATT&CK S0331 |
| How old is it? | Observed since at least 2014 | MITRE ATT&CK S0331 |
| How does it arrive? | Primarily by phishing email. Cyble also describes a CHM and PDF route that downloads a script from a server | MITRE; Cyble |
| What does it do? | Logs keystrokes, takes screenshots, records video from the webcam, copies form data and clipboard contents | MITRE ATT&CK S0331 |
| What does it steal? | Credentials from web browsers, FTP clients and saved Wi-Fi profiles, and from configuration files and the Registry | MITRE ATT&CK S0331 |
| How does it send data out? | It encrypts the data with 3DES and can send it over SMTP, FTP or HTTP; it uses HTTP and SMTP to talk to its controller | MITRE ATT&CK S0331 |
| How does it stay? | Registry Run keys, the Startup folder or scheduled tasks | MITRE ATT&CK S0331 |
| Which build is this server's? | Not known. URLhaus gives only the tag AgentTesla on one file; we did not open it | Not available |
What nd.tdpqnf.com (Agent Tesla, rev-base64-loader text files) can steal or download
What Agent Tesla can take from a Windows PC
Agent Tesla is built to collect and send, so the list below is what such a trojan can take rather than a promise of what one build does. Each item is named by MITRE; the exact set depends on the build.
Reported as possible
- Every key you type
- Screenshots of your screen
- Video from your webcam
- Saved browser passwords
- Saved FTP client logins
- Saved Wi-Fi profiles
- Form data you submit
- Whatever is on your clipboard
- Credentials stored in config files and the Registry
| Data | Detail | Source |
|---|---|---|
| Keystrokes and screen | Keylogging, screenshots and webcam video | MITRE |
| Logins | Credentials from browsers, FTP clients and Wi-Fi profiles | MITRE |
| Clipboard and forms | Clipboard contents and form data | MITRE |
| Config files and Registry | Credentials stored there | MITRE |
| Exit route | Encrypted with 3DES and sent by SMTP, FTP or HTTP | MITRE |
What this can cost you
Reading the site or seeing its name costs nothing. The risks below apply to a Windows PC where a loader fetched one of these files and Agent Tesla then ran.
- High
Passwords and accounts
A keylogger records what you type into every site, including the new passwords you set. Changing passwords from the infected PC does not help; whoever receives the log sees the new ones too.
- High
Saved logins in browsers and programs
MITRE lists credentials from browsers, FTP clients and saved Wi-Fi profiles. Every login the PC had stored should be treated as known.
- High
Email and work accounts
Stolen mail logins let the thief reset other accounts and read your messages. In a company, a work login may open far more than your own files.
- Medium
Money and card details
Form data and keystrokes can include card numbers and bank logins typed on the PC. Watch statements for some weeks.
- Medium
Your screen and your camera
MITRE lists screenshots and webcam video, so what is on screen and in front of the camera can be captured.
- Low
Nothing, if you only saw the name
A name in a block list, a log or a warning is not an infection.
What you may notice, and what you may not
Spyware like this is built to be quiet. The signs below come from the sources and from what they imply; none is certain, and many victims notice nothing.
| Sign | What the reports show |
|---|---|
| A startup entry or scheduled task you did not make | MITRE says Agent Tesla adds itself to Registry Run keys or the Startup folder, or uses scheduled tasks |
| A Defender detection with the name Agent Tesla | Look in Protection history. We did not find a Microsoft detection name for the files on this server, so a different name may appear |
| Accounts you did not touch | Logins from new places, password reset emails, messages sent from your accounts. This follows from stolen logins; it is our reading |
| Unknown outgoing mail or connections | MITRE says the trojan can send over SMTP, FTP and HTTP. A program you do not know that talks on these routes is worth a look; our reading, not a quote |
| Webcam light on | MITRE lists webcam video among its functions |
| Nothing at all | Quiet running is the point of a keylogger |
How to check the PC for nd.tdpqnf.com (Agent Tesla, rev-base64-loader text files)
How a person ends up asking for these files
Nobody visits nd.tdpqnf.com on purpose. The request comes from a program, so the real question is how that program got on the PC. We cannot say for this server; the routes below are the ones published sources describe for Agent Tesla.
- 1
A phishing email with an attachment
MITRE names phishing as the primary delivery method. The attachment can be an Office file, an archive, a PDF or a script that looks like a document.
- 2
A help file or PDF that runs a command
Cyble describes a campaign where a CHM help file, delivered with a PDF, ran a PowerShell command that downloaded a text-named script from a server.
- 3
A link that opens a download
A link in a message that leads to a file you are told to open is a common first step for loaders. Whether this server was reached that way is unknown.
Check your PC before you delete anything
Start with the question that matters: did something on this PC contact nd.tdpqnf.com, or did you open an unexpected attachment, help file, script or installer? If you saw the name in a firewall or DNS log, the device that asked is the one to check. If the answer is yes or you are not sure, do the checks below. None of them deletes anything.
While you check, stop using the PC for banking, email, work or crypto. If you can, disconnect it from the network.
- 1
Disconnect first
Turn off Wi-Fi or unplug the network cable. The trojan needs the connection to send what it collects.
- 2
Find which device asked for the address
If you came here from a log, a router page or an alert, note the device and the time. Only that device is in question, not every device on the network.
- 3
Open Protection history
In Windows Security > Virus & threat protection > Protection history, look for a detection called Agent Tesla or anything blocked or quarantined at the time of first contact. Microsoft says the results of an offline scan also appear there.
- 4
Open Task Scheduler
Press Start, type Task Scheduler and open it. Look in Task Scheduler Library for tasks you do not know, with random names, or that run a script or a program from a user folder. MITRE names scheduled tasks as one of the ways Agent Tesla stays. Do not delete yet; write the name and the program it runs.
- 5
Look at Startup apps
Go to Settings > Apps > Startup and look for names you did not install. MITRE names the Startup folder and Registry Run keys; this screen is the simple view of what starts with your sign in.
- 6
Look for unknown processes
Open Task Manager, stay on the Processes tab and sort by network or CPU. Right-click an unknown process and choose Open file location to see where it lives. A process is not proof of anything by itself, and a clean list does not clear the PC.
- 7
Check Defender exclusions
In Windows Security > Virus & threat protection > Manage settings > Exclusions, look for folders you did not add. We found no source saying this campaign adds exclusions, so a clean list does not clear the PC.
- 8
Check your accounts from another device
Look at the sign in activity of your email, bank and exchange accounts. The FTC also says to look in your email for forwarding rules you did not create, because thieves use them to copy your messages. This is quicker than any file check.
- 9
A scan helps, but it does not clear the PC
A scan with Microsoft Defender or another product can find known files. Treat a clean result the way you treat a clean site test: one data point. No vendor publishes a removal procedure for this server's files and we did not infect a PC, so the order of the plan is our judgement from Microsoft and FTC pages, not a tested result.
How to remove nd.tdpqnf.com (Agent Tesla, rev-base64-loader text files)
How to remove nd.tdpqnf.com
A loader's job is to install other malware, so treat the PC as infected with more than one program until the scans are clean.
Step 1: Delete scheduled tasks that bring it back
Open Task Scheduler from the Start menu and click Task Scheduler Library. Select each task you do not recognise and read the Actions tab:
- a task that starts a file in
%AppData%or%Temp% - runs
powershellwith a long encoded line - opens a web address belongs to nd.tdpqnf.com or a similar program
Right-click such a task and choose Delete, and check the subfolders too. Leave tasks from Microsoft, your PC's maker and programs you use. Task Scheduler is the same in Windows 11 and Windows 10.
Windows 11: Task Scheduler Library, the task selected, the Actions tab shows the file it runs. Full procedure with screenshots: Remove what malware leaves behind in Windows
- a task that starts a file in
Step 2: Remove it from startup
Whatever nd.tdpqnf.com installed usually starts with Windows. Open Task Manager with Ctrl + Shift + Esc, go to Startup apps in Windows 11 or the Startup tab in Windows 10, and disable what you do not know, starting with entries that have an empty Publisher column.
Open file location on the right-click menu shows the file, which helps you decide and tells you what to delete later. Disabling is safe: if something you need stops working, switch it back on.
Full procedure with screenshots: Stop apps from opening at startup On uGetFix
Step 3: Delete the folders left behind
What the uninstaller leaves behind is usually in the user folders. Open File Explorer, switch on View > Show > Hidden items (in Windows 10 View > Hidden items), and go through
%LocalAppData%,%AppData%, %ProgramData% and the two Program Files folders.Sort by Date modified and delete folders that appeared together with the problem and belong to no program you use. Folders with random names that hold
.exe,.dll, .js or .ps1 files are the strongest sign.Full procedure with screenshots: Remove what malware leaves behind in Windows
Step 4: Scan the PC, then run the offline scan
Open Windows Security > Virus & threat protection > Scan options, run a Full scan and remove everything it finds. Then select Microsoft Defender Antivirus (offline scan) and click Scan now: the PC restarts and scans before Windows loads, which finds files that hide while Windows runs.
Save your work first, because the offline scan takes about 15 minutes. Both scans are built into Windows 11 and Windows 10, and a second scanner from another vendor is a useful extra opinion.
Windows 11: Windows Security > Virus & threat protection > Scan options. Full procedure with screenshots: Run a Microsoft Defender Offline scan
Step 5: Change passwords from another device and sign out other sessions
Assume that the passwords saved in this PC's browsers, and the accounts that were open in them, are known to the attacker. From a phone or a clean computer, change the e-mail password first, then banking, shopping, social and gaming accounts.
Use each service's option to sign out of all other sessions, because stolen cookies keep a session open even after a password change. Turn on two-step verification on each account. Wait with the infected Windows 11 or Windows 10 PC until the scans are clean.
Full procedure with screenshots: Turn on two-step verification / secure a hacked account
If you use a Mac, an iPhone or an Android phone
The tags and every source we read describe a Windows threat. We found nothing that says the files on nd.tdpqnf.com affect anything else.
| Your device | What we know | What to do |
|---|---|---|
| Mac | MITRE describes Agent Tesla as a .NET trojan for Windows. The loaders in the reports use Windows scripts | Nothing to remove for this threat. Do not follow the Windows steps on a Mac |
| iPhone or iPad | No source we read describes Agent Tesla on iOS | Nothing to remove. If you typed a password on a suspicious page, change it |
| Android | No source we read mentions it | Nothing to remove for this threat; change passwords if you entered any |
After removal: passwords, accounts and prevention
After a clean PC: protect what was taken
The PC is one half. The other half is everything you typed or stored on it while the trojan was there. The order matters: another device first, then the PC.
- 1
Change passwords from a clean device
The FTC says to change the password to a long one, around 12 to 15 characters or a passphrase. Start with email, because it resets everything else, then bank, work, cloud storage and crypto. Anything typed on the PC while it was watched is already known.
- 2
Sign out other sessions and turn on two step sign in
The FTC says to sign out of the account on all devices so anyone else logged in is kicked out, and to turn on two factor authentication if it is offered, so a password alone does not let anyone in. Check the recovery email and phone number are yours.
- 3
Run Microsoft Defender Offline
Microsoft says to open Windows Security > Virus & threat protection > Scan options, choose Microsoft Defender Offline scan and select Scan now. Save your work first: Windows signs you out and restarts, and the scan takes about 15 minutes. It runs outside the normal Windows, so malware has a harder time hiding. Results are under Protection history. If BitLocker is on, Microsoft says to suspend it first or the restart may ask for the recovery key. If the scan does not start, Microsoft notes Windows Recovery Environment must be enabled;
reagentc /infoshows its status. - 4
Remove what the check found, with care
If Task Scheduler or Startup apps showed an entry that you can tie to the malware, switch it off or delete it. If you cannot tell, do not guess: the safe answer is the reset below.
- 5
If you are not sure, reset Windows
Microsoft's recovery page puts the reset at Settings > System > Recovery > Reset this PC. Keep my files removes apps and settings but keeps personal files; Remove everything removes files, apps and settings. For a PC whose logins were stolen, the full wipe is the answer that does not depend on finding every piece. Microsoft calls the reset the most disruptive option and says to back up first, and to have the BitLocker recovery key ready if BitLocker is on.
- 6
Restore only documents by hand
Copy back documents and photos, not programs, and not a full system image from after the first contact. Install apps from their makers' own sites.
- 7
Rebuild logins in a password manager
Do not let the browser save passwords again on a PC that was watched. Use a password manager and an authenticator app or security key for two step sign in.
- 8
Watch your money and your accounts
Check card statements and mail rules for a few weeks. The FTC says to report stolen personal information at IdentityTheft.gov, which gives a personalized recovery plan.
- 9
Tell the people you message
If your accounts were used to send links, tell your contacts not to open them.
Keep a PC out of this kind of chain
The text file is the late part of the chain. Every analysis we read starts earlier, with a message or a file a person opened.
Do
- Treat an unexpected attachment, help file or script, even one in a PDF, as an attack and close it. MITRE names phishing as the main route.
- Keep Windows and Microsoft Defender updated; the offline scan uses the latest definitions.
- Show file endings in File Explorer so a script posing as a document is visible.
- Get programs from their makers' own sites or from the Microsoft Store.
- Use a password manager and two step sign in, so one stolen password is not enough.
- If you run a network, ask your DNS or firewall log which device asked for this name and look at that device first.
Don't
- Do not open attachments from senders you do not expect, even when the file looks like an invoice or an order.
- Do not run cracked programs or bundles from sites that promise free versions of paid software.
- Do not trust a file only because its ending is .txt; a script can be stored that way.
- Do not change your passwords on the PC you suspect.
- Do not rely on a quiet scan to say that you are safe.
Questions about nd.tdpqnf.com (Agent Tesla, rev-base64-loader text files)
What is nd.tdpqnf.com?
It is a web address that URLhaus, the malware tracking project run by abuse.ch, lists for four .txt files in the folders fps, file and sma. One is tagged AgentTesla and three rev-base64-loader.
They were reported on 7 and 8 October 2026. It is not a program on your PC and not a website anyone is meant to visit. We did not download the files, so what they contain is not confirmed by us.
Is nd.tdpqnf.com safe to open?
No. Do not request files from it, and do not run anything that does.
Our own plain request to the home page returned an ordinary template page, which proves nothing: the reported files are in other folders, and a server that hands out malware often shows a harmless front page. The rating comes from the URLhaus reports and their tags, not from our visit.
Is nd.tdpqnf.com a virus?
The address itself is a server, not a virus. URLhaus lists files on it as malware downloads, and one is tagged AgentTesla, a spyware trojan for Windows. A .txt file does nothing by itself.
It becomes dangerous only when a script already running on a PC fetches it and decodes it into a program. Seeing the name in a log is not an infection, but it means a device asked for it.
What does rev-base64-loader mean?
URLhaus does not define the tag, so this is our reading. It points to a loader whose text is written backwards and then encoded in base64, which a script reverses and decodes into code.
Published Agent Tesla analyses, such as Cyble's, describe text-named scripts with base64 layers that unpack a loader and then the trojan. We did not open the files, so we cannot confirm what these ones do.
What is Agent Tesla?
Agent Tesla is a spyware trojan written for the .NET framework, observed since at least 2014, according to MITRE ATT&CK.
It logs keystrokes, takes screenshots, records webcam video, copies clipboard contents and steals credentials from browsers, FTP clients and Wi-Fi profiles. It encrypts the data and sends it by SMTP, FTP or HTTP. Phishing email is its main delivery route.
I saw nd.tdpqnf.com in my firewall or DNS log. Am I infected?
Not necessarily, and the name alone proves nothing. It does mean that a device on your network asked for it, and a person does not usually do that by hand. Find which device it was, disconnect it, and run the checks on this page:
- Protection history
- Task Scheduler
- Startup apps
- a Microsoft Defender Offline scan
Do the account changes from another device, not from the suspect PC.
How do I remove Agent Tesla from Windows?
Change your passwords from another device first. Then run a Microsoft Defender Offline scan (Windows Security, Virus and threat protection, Scan options), check Task Scheduler and Startup apps for entries you did not make, and remove the ones you can tie to the malware.
If you are not sure, reset Windows with Remove everything and restore only documents. We followed Microsoft's pages for this and did not test the steps on an infected PC.
Does nd.tdpqnf.com affect Mac, iPhone or Android?
We found nothing that says so. MITRE describes Agent Tesla as a .NET trojan for Windows and the loaders in the reports use Windows scripts. On a Mac, iPhone or Android phone there is nothing to remove for this threat; if you typed a password on a suspicious page, change it and turn on two step sign in.
Will resetting Windows remove it, and are my accounts safe afterwards?
A reset with Remove everything removes files, apps and settings, which is the answer that does not depend on finding every piece. It does not undo what was already taken.
Passwords and saved logins that the trojan saw stay exposed until you change them from another device and turn on two step sign in. Restore documents by hand, not a full system image.
Will Fortect remove nd.tdpqnf.com?
Fortect scans Windows for malware and unwanted programs and repairs the system files and settings they change, and its free scan shows what it finds on your PC before you decide anything.
For nd.tdpqnf.com, follow the plan above as well: the browser steps take back permissions and settings that no scanner treats as a threat, and uninstalling the program that brought it removes the source.
Run Microsoft Defender's full scan and, if anything was found, its offline scan as a second opinion. If the symptoms are gone after the plan and both scans are clean, there is nothing more to do.
Sources
- MITRE ATT&CK: Agent Tesla, S0331 (modified 16 April 2025) (read October 11, 2026)
- Cyble: AgentTesla spreads through CHM and PDF files in recent attacks (read October 11, 2026)
- Microsoft Learn: Microsoft Defender Offline scan in Windows (updated 25 August 2026) (read October 11, 2026)
- Microsoft Support: Recovery options in Windows (Reset this PC) (read October 11, 2026)
- FTC: Email or social media hacked? Here's what to do (read October 11, 2026)