qpwot.cfd: a server handing out scripts that lead to the MassLogger and VIP Keylogger stealers, and what to do if one ran

What qpwot.cfd is, and what we know about it

qpwot.cfd is not a program on your PC. It is a web address that URLhaus, the malware tracking project of abuse.ch, lists seven times on 6 October 2026 for script files: three JavaScript files and four PowerShell files named secured_stub.ps1. The PowerShell files are tagged MassLogger and VIPKeylogger, two Windows programs that record what you type and steal saved passwords. We found no public write-up of this one address, so this guide says what URLhaus shows, what our own request returned, and what vendors have published about the two families.

1. 1

   What URLhaus lists

   Seven file addresses on qpwot.cfd, all over https, all added by the reporter abuse_ch between 07:03 and 07:14 UTC on 6 October 2026, and all with the threat label malware_download. Three end in .js and sit in folders called plug, plug2 and wealt/wealt1. Four are called secured_stub.ps1 and sit in folders called mrprince, wealt, pprriinnnce and ppprincee6. When we read the data, three were marked online and four offline.

2. 2

   What the tags mean

   js and ps1 are the file types: JavaScript, which Windows can run with its built in script host, and PowerShell. opendir means the folder could be listed by anyone who asked the server, which is how the files were found together. ascii means the file is plain text. MassLogger and VIPKeylogger are names of the malware the PowerShell stubs are linked to; three stubs carry MassLogger, two carry VIPKeylogger, and one carries both.

3. 3

   What we could not confirm

   We did not download any of the files, so we cannot say what each one does, which build of which keylogger it leads to, or where stolen data would be sent. URLhaus tags are the reporter's labels, not our proof. We also do not know how a victim's PC is told to fetch these files; that first step is not visible from the server side.

4. 4

   What this means for you

   If you only saw the name in a firewall log, a DNS block list or a browser warning, that alone does not mean your PC is infected. The risk is for a Windows PC where a script was opened and went on to fetch a file from this address. Nobody is meant to visit these files in a browser.

Kind of threat

A server that hands out JavaScript and PowerShell files tagged MassLogger and VIPKeylogger, keyloggers and password stealers for Windows

Example paths

hxxps://qpwot[.]cfd/pprriinnnce/secured_stub.ps1 and hxxps://qpwot[.]cfd/plug/ (a .js file)

Reports

7 in URLhaus, all on 6 October 2026; 3 online, 4 offline when we read them

Registered

1 October 2026 at 01:35 UTC through Spaceship, Inc., five days before the first report

Front page

A plain request on 6 October 2026 got HTTP 200 through Cloudflare with the title Application placeholder

Platform

Windows. Every source we read describes Windows scripts and Windows programs

What we checked on 6 October 2026, and what we could not

We sent one plain request to https://qpwot.cfd/ from our server on 6 October 2026. It was not a browser, it ran no scripts and clicked nothing. The server answered with HTTP status 200, through Cloudflare, with a page titled Application placeholder. That clears nothing: it only tells us the front door of the server is open.

What happened to qpwot.cfd, from registration to our check

Everything happened within one week. The dates come from RDAP and from the URLhaus data we hold; times are UTC.

1. 1 October 2026

   The domain is registered

   RDAP shows qpwot.cfd registered at 01:35 UTC through Spaceship, Inc., with the transfer locks that registries set by default. The name is five random looking letters under .cfd, a cheap generic ending. We draw no conclusion about the owner from that alone.

2. 6 October 2026, 07:03 to 07:05

   The first three files are reported

   abuse_ch adds a .js file in plug2, a secured_stub.ps1 in ppprincee6 tagged MassLogger and VIPKeylogger, and a secured_stub.ps1 in pprriinnnce tagged MassLogger. The pprriinnnce file is still online when we read the data.

3. 6 October 2026, 07:07 to 07:14

   Four more files follow

   A .js file in wealt/wealt1, a stub in wealt tagged VIPKeylogger, a .js file in plug and a stub in mrprince tagged MassLogger. The two .js files in wealt/wealt1 and plug stay online; the wealt and mrprince stubs are marked offline.

   

4. 6 October 2026

   Our check

   Our plain request to the front page gets HTTP 200 through Cloudflare and a page titled Application placeholder. We did not request any of the listed file paths.

What the pattern suggests, and what it does not: folders with similar names (prince spelled three ways, plug and plug2, wealt and wealt1) and the same stub file name in each look like one operator preparing several copies of the same chain, perhaps one per campaign or customer. That is our reading of the paths, not something any report says.

How a script on a server becomes a keylogger on a PC

A .js or .ps1 file on a server does nothing to you until something on your PC runs it. We did not see the chain for qpwot.cfd. The steps below are how Splunk (13 May 2026) and Seqrite describe VIP Keylogger chains, and how Cisco Talos and ANY.RUN describe MassLogger.

1. 1

   A business email with an attachment

   Splunk says the lures pose as bank payment notices, purchase orders and shipping updates. Seqrite describes an email from a fake buyer with an attachment called Order Inquiry, a rich text file posing as a Word document. Cisco Talos describes MassLogger arriving in RAR archives that hide a compiled help file.

2. 2

   A script is opened

   In Splunk's case the first file is a VBS, JavaScript or batch script. Opening it is enough: Windows runs .js and .vbs files with its own script host. The .js files listed on qpwot.cfd fit this step, but we did not open them.

3. 3

   A PowerShell stage is fetched

   Splunk found the script decoding a PowerShell stager and storing it in a user environment variable named INTERNAL_DB_CACHE so that little is written to disk. Seqrite found a second script that starts PowerShell. The secured_stub.ps1 files on qpwot.cfd are named like such a stage.

4. 4

   The keylogger is decoded in memory

   Both Splunk and Seqrite describe PNG or other picture files that carry encoded data. Seqrite shows the PowerShell code reading text between the markers BASE64_START and BASE64_END, reversing it, decoding it and loading it straight into memory without saving a program file.

5. 5

   It hides inside a real Windows program

   Splunk names aspnet_compiler.exe as the program the keylogger is injected into; Seqrite names dxdiag.exe. In Task Manager the stealer then runs under a trusted name. Splunk says the chain makes itself start again at logon through the UserInitMprLogonScript registry value.

MassLogger and VIP Keylogger: what each one is

The tags name two families. Both are .NET programs for Windows sold to many different criminals, so the same name can show up in unrelated campaigns.

Why both names on one file: a tag reflects what the reporter or an automatic rule recognised. Analysis sites often label related .NET stealers with more than one family name. We do not know which of the two the stubs on qpwot.cfd finally deliver, and it changes little for you: both record keys and take saved logins.

What these keyloggers can take from a Windows PC

The list below is what the families are reported to do. Each item is named by at least one source; one build may not do all of it.

What this can cost you

Seeing the name costs nothing. The risks below apply to a Windows PC where one of these scripts ran.

• High

  Email and every account it resets

  A stolen email password lets a stranger reset the passwords of almost everything else. Keyloggers also catch the new passwords you type on the same PC.

• High

  Logged in sessions

  Splunk lists browser cookies among the stolen data. A stolen session cookie can let someone into an account without the password, until you sign out everywhere.

• High

  Money

  Saved card details and banking logins are on the list, and the clipboard swap can send a crypto payment to the wrong wallet. Crypto sent cannot be pulled back.

• Medium

  Work and business mail

  The lures pose as orders and invoices, so work PCs are the usual target. A stolen work mailbox is often used for the next round of fake invoices to your customers.

• Medium

  Other PCs and USB sticks

  Infoblox says MassLogger can copy itself into files on connected USB drives. A stick used on the PC is worth scanning before you use it elsewhere.

• Low

  Nothing, if you only saw the name

  A name in a block list or a log is not an infection.

What you may notice, and what you may not

These stealers are built to be quiet. Most victims notice the stolen accounts before they notice anything on the PC.

Which name will your scanner show?

Microsoft's name for qpwot.cfd is no Microsoft detection name is known.

Defender sorts threats by category first, so the word before the colon tells you what kind of program was found, even if the family name means nothing to you.

Do not search for a removal tool by the detection name alone; fake "removal tools" use the same keywords. How the naming works is explained in our guide to antivirus detection names.

How a PC ends up asking for these files

Nobody types qpwot.cfd into a browser. The request comes from a script, so the real question is how that script reached the PC. We cannot say for this server; these are the routes the vendors found for the same families.

1. 1

   An email about an order, payment or delivery

   Splunk names bank payment notices, purchase orders and logistics updates; Seqrite shows an Order Inquiry from a fake buyer; Infoblox shows an arrival notice that even links to a real shipping company's site to look genuine.

2. 2

   An attachment that is really a script

   A file that looks like a document but ends in .js, .vbs, .bat, .wsf or .hta. Windows hides known file endings by default, so Invoice.pdf.js can look like Invoice.pdf.

3. 3

   An archive or a help file

   Cisco Talos describes RAR archives split into parts and renamed to slip past filters, with a .chm help file inside that runs JavaScript.

4. 4

   A rich text file posing as Word

   Seqrite's chain begins with an RTF file saved with a .doc ending that fetches the first script when it is opened.

Check your PC before you delete anything

Start with the question that matters: did you open an unexpected attachment, script or archive, or did a log show this PC contacting qpwot.cfd? If yes or not sure, do these checks. None of them deletes anything.

While you check, stop typing passwords on the PC. The FTC's first step for suspected malware is to stop logging in to accounts from the device.

1. 1

   Disconnect first

   Turn off Wi-Fi or unplug the cable. A keylogger sends what it collects over the internet; without a connection it cannot.

2. 2

   Find which device asked

   If the name came from a router, DNS filter or firewall log, note the device and the time. Only that device is in question.

3. 3

   Open Protection history

   In Windows Security > Virus & threat protection > Protection history, look for anything blocked or quarantined around the time you opened the attachment. Microsoft names these families with labels such as Trojan:MSIL/MassLogger.MA!MTB and Trojan:MSIL/SnakeKeylogger!MSR; a name with MassLogger, SnakeKeylogger or VIPKeylogger in it is a strong sign.

4. 4

   Look for the files you opened

   In Downloads and in your email program's temporary folder, look for .js, .vbs, .bat, .ps1, .rtf or .chm files from the same time. In File Explorer turn on View > Show > File name extensions so the real endings show.

5. 5

   Look at what starts with Windows

   Open Task Scheduler and look in Task Scheduler Library for tasks you do not know that run a script, PowerShell or wscript. Then open Settings > Apps > Startup. Write down what you find; do not delete yet.

6. 6

   Look at the environment values Splunk names

   Press Win + R, type regedit, and open HKEY_CURRENT_USER\Environment. A value called UserInitMprLogonScript or INTERNAL_DB_CACHE, or a very long value, is a strong sign. Do not edit the registry unless you are sure; note it and move to the scan.

7. 7

   Look in Task Manager

   Open Task Manager and look for aspnet_compiler.exe, dxdiag.exe or powershell.exe running when you did not start them. They are real Windows programs, so this is a hint, not proof.

If you use a Mac, an iPhone or an Android phone

Every source we read describes Windows scripts and Windows programs. We found nothing that says the files on qpwot.cfd affect other systems.