niggersmp.net: a Minecraft cheat client site whose .jar downloads URLhaus tags SilentNet, and what to do if you ran one

What niggersmp.net is, and what we know about it

niggersmp.net is not a program on your computer. It is a web address that the abuse.ch project URLhaus lists as a place where malware was served: four Java archive files in a folder called downloads. The domain name contains a racial slur; we print it only because the reports name it. We found no public write-up of this address, so this page rests on URLhaus, our own plain request and vendor research on Minecraft malware.

1. 1

   What URLhaus lists

   Four file addresses on niggersmp.net, all in the folder /downloads/ and all ending in .jar: Radium_Client.jar, krypton.jar, 4E_Client.jar and Zyphers_Rig_Mod.jar. All four were added at the same moment, 16:40 UTC on 10 October 2026, by one reporter with the handle wok. All four are marked online, all carry the threat label malware_download, and all carry one tag: SilentNet.

2. 2

   What the names suggest

   The file names look like Minecraft cheat clients and mods, and the home page of the site calls itself a place for free Minecraft cheat clients and mods. That fits the lure that researchers describe for Minecraft malware: a cheat or a mod that players want, offered for free. It is our reading of the names, not something the reports say.

3. 3

   What the tag means

   SilentNet is a name used on the abuse.ch malware sample site MalwareBazaar for Java malware aimed at Minecraft. One MalwareBazaar entry we read is a fake build of a known Minecraft client on a lookalike site, labelled SilentNet, and it describes stealing the Minecraft session and starting again as a hidden process. That entry is a different file from the four here. We did not download these four, so we cannot say what is inside them.

4. 4

   What this means for you

   If you only saw the name in a log, a blocked request or a warning, you are not infected by that alone. The risk is for a person who downloaded one of these .jar files and ran it, usually by double clicking it or by dropping it into the Minecraft mods folder.

Kind of threat

A website offering Minecraft cheat clients; four of its .jar downloads are reported as malware tagged SilentNet

Where the files are

hxxps://niggersmp[.]net/downloads/ with the names Radium_Client.jar, krypton.jar, 4E_Client.jar and Zyphers_Rig_Mod.jar

Domain registered

5 April 2026 through NameCheap, Inc.; status client transfer prohibited (RDAP, read 10 October 2026). The domain is about six months old

URLhaus entries

4 file addresses, all added 10 October 2026 at 16:40 UTC by the reporter wok; all 4 online in our copy of the data

File type

.jar, a Java archive. It runs wherever Java is installed, and Minecraft: Java Edition installs its own Java

Platform

Any computer that runs Java and Minecraft: Java Edition (Windows, Mac, Linux). Nothing we read says iPhone, Android or the console editions are affected

What we checked on 11 October 2026, and what we could not

Our check was one plain request to the home page from our server, without a browser and without clicks. It does not show what a visitor with a real browser, another country or a second visit would be shown. A quiet answer clears nothing.

What happened to niggersmp.net, from registration to our check

The domain is young and the reports are a day old. The dates come from RDAP and from the URLhaus data we hold; the times are UTC.

1. 5 April 2026

   The domain is registered

   RDAP shows niggersmp.net registered on 5 April 2026 through NameCheap, Inc., with the status client transfer prohibited. That status is a common lock against moving a domain away and says nothing about the content.

2. 10 October 2026, 16:40 UTC

   Four .jar files are reported

   The reporter wok adds Radium_Client.jar, krypton.jar, 4E_Client.jar and Zyphers_Rig_Mod.jar in one batch. Each is labelled malware_download and tagged SilentNet. All are online at the time of listing.

3. 11 October 2026

   Our request

   A plain request to the home page returns status 200 through Cloudflare, with the title Cheat Clients, Free Minecraft Cheat Clients and Mods. All four reported files are still marked online in our data.

   

What the pattern suggests, and what it does not: four different client names added in one batch on a domain six months old looks like a site built to offer many cheat downloads, with several of them carrying the same malware family. That is our reading of the dates and names. No report says who runs the site or whether the owner knows what the files contain.

How a .jar cheat client can steal from a player

A .jar file is a program. Unlike a picture or a document, it is made to run, and a Minecraft client or mod runs with the same rights as you. We did not open the files on niggersmp.net; this is how Check Point Research describes a Minecraft cheat malware campaign it studied in 2025, and how the MalwareBazaar entry describes a SilentNet sample.

1. 1

   The lure is a free cheat

   Check Point Research (18 June 2025) describes fake cheat and macro tools for Minecraft, called Oringo and Taunahi, shared through the Stargazers Ghost Network, a service that runs many fake accounts on GitHub to make malware look popular. Players look for free clients, find a page that offers one and download it.

2. 2

   The first stage is Java

   In that campaign the first stage downloader and the second stage stealer were written in Java and needed Minecraft to be installed. That matches a .jar file that a player runs on purpose. Check Point reports a third stage written in .NET with wider stealing functions.

3. 3

   The client may still work

   A common trick is to hide the malicious part inside something that behaves like the promised client, so the player sees a menu and thinks all is well. We do not know whether the files on this site do this.

4. 4

   The Minecraft session and more are taken

   The MalwareBazaar entry we read, a fake build of a known client labelled SilentNet, describes stealing the Minecraft session and starting again as a hidden process. Check Point's campaign also went for other stored logins. A stolen session lets someone act as the player's account.

5. 5

   The data goes to the attacker

   The stolen data is sent to a server the attacker controls. We do not know where the four files here would send it, because we did not run them.

A caution on names: SilentNet is a label used by researchers and by the sample site, not a product name from a large vendor, and we did not find a full vendor analysis of it. Where we say what SilentNet does, we mean what one listed sample is described as doing, not a proven description of these four files.

What we can and cannot say about the SilentNet tag

The tag is the only technical fact URLhaus gives for these four files. It is worth being exact about what it supports.

What Minecraft stealer malware can take

The list below is what the sources say Minecraft-targeting stealers go for. It is not a list of what these four files do; for that we have no evidence.

What this can cost you

Reading the site or seeing its name costs nothing. The risks below apply to a computer where one of these .jar files was run.

• High

  Your Microsoft and Minecraft account

  A stolen session can let someone use the account without the password. Changing the password from the same computer does not help while the stealer is still running.

• High

  Other logins on the same computer

  If the file goes beyond the game, as the campaign Check Point describes does, browser passwords and other stored logins are at risk, including Discord and email. Email matters most, because it resets everything else.

• Medium

  Crypto wallets

  If a wallet or seed phrase was ever on the computer, assume it may be known. Crypto sent away cannot be called back.

• Medium

  More malware

  A first stage can fetch more. If the PC is shared, other family members' accounts are in question too.

• Medium

  Children and shared PCs

  Cheat clients attract young players. A child who ran a file on a family computer can expose the parents' logins as well.

• Low

  Nothing, if you only saw the name

  A name in a log, a block list or a warning is not an infection.

What you may notice, and what you may not

Stealers try to be quiet. The signs below come from the sources and from what they imply. None is certain and many victims notice nothing.

How a person ends up with one of these files

Unlike a loader fetching a picture, this is a download a person chooses. That is why the realistic routes are about trust: a link in a video, a chat or a search result that promises something free for the game.

1. 1

   A search for a free cheat client

   The site calls itself a place for free Minecraft cheat clients and mods, so a player who searches for a free client can land on it. Search results are one of the routes the Minecraft malware reports describe.

2. 2

   A link shared in a video, server or chat

   Cheat links spread in video descriptions, game chats and Discord servers. We have no evidence of how links to this site are shared; this is a route that is known for the type.

3. 3

   A file renamed to look like a real mod

   Some malware uses the name of a well known mod or library, so the file looks routine in the mods folder. Check where a mod came from, not just its name.

4. 4

   The Minecraft launcher is not the source

   A file only reaches the game if you put it there. The official launcher does not fetch cheat clients from sites like this, so a client from a download page is something a person installed by hand.

Check your computer before you delete anything

Start with the question that matters: did you or someone on this computer download a .jar from niggersmp.net, or run a free cheat client from anywhere? If you saw the name in a firewall or DNS log, find the device that asked. If the answer is yes or you are not sure, do the checks below. None of them deletes anything.

While you check, stop using the computer for banking, email, school, work or crypto. If you can, disconnect it from the network.

1. 1

   Disconnect first

   Turn off Wi-Fi or unplug the cable. A stealer that is already running needs the connection to send data.

2. 2

   Find the file

   Open the Downloads folder and the Minecraft mods folder and look for Radium_Client.jar, krypton.jar, 4E_Client.jar or Zyphers_Rig_Mod.jar, or any client you got from a site rather than from its makers. Note the names and the date; do not run anything. Do not delete yet if you want to give the file to a security vendor.

3. 3

   Open Protection history

   In Windows Security > Virus & threat protection, choose Scan options and then Protection history. Look for any detection or block at the time you downloaded or ran the file. Microsoft says the results of an offline scan appear in the same place.

4. 4

   Look at running programs

   Open Task Manager and look for java.exe or javaw.exe when Minecraft is closed, and for programs you do not know with a lot of network use. A Java process is normal while the game runs and is not proof of anything when it does.

5. 5

   Look at Startup apps

   Open Settings > Apps > Startup and look for entries you did not make. A program that starts again after a restart is one way a hidden process stays.

6. 6

   Check your accounts from another device

   Look at the sign in activity of your Microsoft account, email, Discord and any crypto exchange, and at wallet balances. This is quicker than any file check, and it must be done from a device that never ran the file.

7. 7

   A scan helps, but it does not clear the computer

   A scan with Microsoft Defender or another product can find known files. A clean result is one data point, like a clean site test. We did not infect a computer, so the order of this plan is our judgement from Microsoft's pages, not a tested result.

If you use a Mac, Linux, a phone or a console

A .jar file is not tied to Windows. Whether these four files only work on Windows is not known. Our sources describe Java malware that needs Minecraft: Java Edition and a computer that runs Java.