trabzonmegareklamllc.shop: a web address that handed out PowerShell and JavaScript files tied to VIPKeylogger, and what to do on Windows

What trabzonmegareklamllc.shop is, and what we know about it

trabzonmegareklamllc.shop is not a program on your PC. It is a web address that the abuse.ch project URLhaus lists as a place where malware files were served. We found no public write up of this one address, so what follows is what URLhaus shows, what our own server saw, and what security vendors have published about the malware family it is tagged with.

1. 1

   What URLhaus lists

   Three file addresses, all on https and all added on 22 September 2026: one JavaScript file in a folder called nzeze (hdyTf6DerwjXowqgNm73vRvhow23Cb.js), one PowerShell file in the same folder (Crypted.ps1) and one PowerShell file in a second folder called masfrnd (Crypted.ps1). The threat label is malware_download and the reporter is abuse_ch. All three are marked offline in the data we hold.

2. 2

   What the tags mean

   VIPKeylogger is the name of a keylogger and information stealer. It is on the .js file and on the Crypted.ps1 in the masfrnd folder. The Crypted.ps1 in the nzeze folder carries only the file type tags. ps1 and powershell mean a PowerShell script, js means JavaScript, and ascii means the file is plain readable text, not a compiled program. opendir means the folder could be listed by anyone who asked the server.

3. 3

   What we could not confirm

   We did not download any of the files, so we cannot tell you what is inside them, which build of the keylogger they carry or where it sends what it takes. URLhaus shows the tags, not a proof. We also do not know which email, document or program makes a victim's PC ask for these files. That first step is not visible from the server side.

4. 4

   What this means for you

   If you only saw the name in a firewall log, a blocked request or a security warning, you are not infected by that alone. The risk is for a PC where something already ran and went to fetch one of these files. Nobody is meant to browse to these paths by hand.

Kind of threat

A server that handed out script files (PowerShell and JavaScript); two of three are tagged VIPKeylogger, a keylogger and stealer for Windows

Where the files were

hxxps://trabzonmegareklamllc[.]shop/nzeze/ and hxxps://trabzonmegareklamllc[.]shop/masfrnd/, files Crypted.ps1 and one .js file with a long random name

Domain registered

Not known. Our registration lookup returned no record for the name (read 17 October 2026)

URLhaus entries

3 file addresses, all added on 22 September 2026 between 17:20:14 and 17:20:19 UTC; all 3 offline in our copy of the data

Delivery trick

Readable script files that a first script fetches and runs. The entry step on the victim's PC is not known

Platform

Windows. PowerShell and JavaScript loaders of this kind are run by Windows scripting. Nothing we read says these files affect Mac, iPhone or Android

What we checked on 17 October 2026, and what we could not

Our check was a plain request from our server to the address, once. It did not get as far as a page: the name did not resolve (error ENOTFOUND). There is no screenshot of the site, because there was nothing to show. That clears nothing.

What happened to trabzonmegareklamllc.shop, from the reports to our check

The timeline is short because the data is short. Everything below comes from the URLhaus rows we hold and from our own request; times are UTC.

1. 22 September 2026, 17:20:14 UTC

   Two Crypted.ps1 files are reported

   abuse.ch adds https://trabzonmegareklamllc.shop/nzeze/Crypted.ps1 and https://trabzonmegareklamllc.shop/masfrnd/Crypted.ps1. Both carry the tags ascii, opendir, powershell and ps1. The one in the masfrnd folder also carries VIPKeylogger.

2. 22 September 2026, 17:20:19 UTC

   A JavaScript file is reported

   Five seconds later abuse.ch adds a .js file in the nzeze folder with a random 30 character name. Its tags are ascii, js, opendir and VIPKeylogger. The three reports were therefore made in one batch, which fits one person listing an open folder.

3. Between 22 September and 17 October 2026

   All three files are marked offline

   In the data we hold all three entries show the status offline. We do not know on which day each file went away or whether the whole server was taken down.

4. 17 October 2026

   Our request does not connect

   A plain request from our server to the address ends with ENOTFOUND, a failed name lookup. No page, no file and no certificate was seen.

What the pattern suggests, and what it does not: a folder that could be listed by anyone and holds a file called Crypted.ps1 looks like a staging place used by one operator for a short time. That is our reading of the tags and dates, not something a report says. We also do not know whether the domain was bought for this purpose or whether an existing site was misused; its name reads like a company name, and a name alone does not tell us whether the owner is involved.

How a PowerShell and JavaScript loader leads to a keylogger

A script file like Crypted.ps1 cannot hurt you by sitting on a server. It works only when something already running on a PC fetches it and starts it. We did not see the files on this server; this is how Splunk and Seqrite describe VIPKeylogger loaders and how MITRE describes PowerShell abuse.

1. 1

   A first program or script is already running

   Seqrite describes an email with an RTF attachment that fetches a VBScript, which starts PowerShell. Splunk describes three kinds of loader for VIP Keylogger: .vbs, .js and .bat files. In both write ups a small first file exists only to fetch the next piece.

2. 2

   It fetches the next file from a server

   That is the part where a web address like this one comes in. A file such as Crypted.ps1 or a long random named .js file is downloaded, often as plain text. MITRE notes that PowerShell can be used to download and run executables from the internet, on disk or in memory without touching the disk.

3. 3

   The script unpacks what is hidden in it

   Splunk describes heavy obfuscation and several stages. In one stage the script decodes and decrypts the next stage with base64 and AES, then decrypts two executables. Both Splunk and Seqrite also describe a stager hidden inside an image file, so the next piece may arrive as a picture.

4. 4

   The keylogger is started inside a trusted process

   Splunk says the keylogger is injected into a genuine .NET process, aspnet_compiler.exe, so that it blends in with normal system activity. Seqrite says the malware also tries to switch off Windows Defender and other protection. In Task Manager the process then carries a trusted name.

5. 5

   It records and sends data out

   From then on the program watches what you type and what is stored in your browsers and mail programs. The next sections list what the sources say it takes.

We could not match these descriptions to the exact files on trabzonmegareklamllc.shop. The names Crypted.ps1 and the .js file fit the pattern of a script loader, and URLhaus ties two of them to VIPKeylogger, but how the scripts are built inside is not known to us.

What VIPKeylogger is

VIPKeylogger, also written VIP Keylogger, is a Windows information stealer. The sources we read describe it as a descendant of Snake Keylogger. The table says what each one states and what stays unknown.

What a keylogger and stealer can take from a Windows PC

The list below is what this kind of program is built to collect. No single report lists everything, and the person behind it chooses what to use.

What this can cost you

Reading about the site or seeing its name costs nothing. The risks below apply to a Windows PC where a loader fetched one of these files and the keylogger then ran.

• High

  Passwords and accounts

  A keylogger records what you type, including the new passwords you set afterwards. Changing passwords from the infected PC does not help; the person who receives the data sees the new ones too.

• High

  Mail and logins saved in the browser

  If your mail is taken, the thief can reset the password of almost every other account you own. Treat every login saved in a browser on that PC as known.

• Medium

  Bank and payment sites

  What you type on a banking page can be recorded. Watch statements and set alerts for the weeks after.

• Medium

  Protection switched off

  Seqrite says the malware tries to disable Windows Defender. A PC with weakened protection can pick up other malware, so one infection may become two.

• Low

  Nothing, if you only saw the name

  A name in a block list, a log or a warning is not an infection. The files are marked offline in our data.

What you may notice, and what you may not

Keyloggers are built to be quiet. The signs below follow from the sources and from what the loaders do; none is certain, and many victims notice nothing.

How a person ends up asking for these files

Nobody visits trabzonmegareklamllc.shop on purpose. The request comes from a program, so the real question is how that program got on the PC. We cannot say for this server; the routes below are the ones vendors found for the same family.

1. 1

   An email attachment that starts a script

   Seqrite describes an RTF file that retrieves a VBScript, which launches PowerShell, which downloads an image holding the loader. Opening such a document and allowing what it asks for is what starts it.

2. 2

   A script file you were sent or downloaded

   Splunk names .vbs, .js and .bat files as loader types. Windows opens a .js or .vbs file with its script host when you double click it, so a file named like an invoice or an order but ending in .js is an attack.

3. 3

   A scan or a log shows the name

   If you came here because a tool or router showed the name, the device that asked for it is the one to check. Only that device is in question, not every device on your network.

Check your PC before you delete anything

Start with the question that matters: did something on this PC contact trabzonmegareklamllc.shop, or did you open an unexpected attachment, script or installer around the end of September 2026 or later? If yes or if you are not sure, do the checks below. None of them deletes anything.

While you check, stop using the PC for banking, email, work or crypto, and disconnect it from the network if you can.

1. 1

   Disconnect first

   Turn off Wi-Fi or unplug the network cable. A keylogger needs the connection to send what it records.

2. 2

   Find which device asked for the address

   If you came here from a log, a router page or an alert, note the device and the time. Check that device first.

3. 3

   Open Protection history

   In Windows Security > Virus & threat protection > Protection history, look for anything blocked, quarantined or remediated around the time of the first contact. Microsoft says the results of an offline scan also appear there.

4. 4

   Check that Defender is still on

   In Windows Security > Virus & threat protection > Manage settings, confirm that real time protection is on, and look under Exclusions for folders you did not add. Seqrite says the malware tries to disable Defender. We found no source that says this specific server's files add exclusions, so a clean list does not clear the PC.

5. 5

   Look at what starts with Windows

   Open Settings > Apps > Startup and switch off what you do not recognise. Also open Task Scheduler and look in the Task Scheduler Library for tasks you did not make that run a script or a program from a user or temporary folder. Do not delete yet; write the name and what it runs.

6. 6

   Look at running processes

   Open Task Manager and look for aspnet_compiler.exe or other .NET tools running with no reason, or any process with steady network use. Splunk names aspnet_compiler.exe as the host for the keylogger. It is a real Windows program, so its presence is not proof and its absence does not clear the PC.

7. 7

   Search for the script files

   In File Explorer search your user folder for files named Crypted.ps1 and for .js, .vbs or .bat files that you did not make, especially in Downloads, Temp and AppData. Do not double click them. A hit tells you where to look; a miss clears nothing, because the loaders can run in memory.

8. 8

   Check your accounts from another device

   Look at the sign in activity of your email, bank and exchange accounts. This is quicker than any file check.

9. 9

   A scan helps, but it does not clear the PC

   A scan with Microsoft Defender or another product can find known files. Treat a clean result like a clean site test: one data point. No vendor publishes a removal procedure for this server's files and we did not infect a PC, so the order of the plan is our judgement from Microsoft's pages, not a tested result.

If you own a site and found this address or your own name in the reports

An address can be listed because the owner is the attacker, because the site was hacked, or because a folder was added to a legitimate server without the owner knowing. URLhaus shows the file addresses, not who put them there. We do not know which case this is, and we do not say the owner is involved.

1. 1

   Look at the folders named in the reports

   The reported folders are nzeze and masfrnd. If you run a site on this name, check whether these folders exist on your hosting and whether you created them. A folder you do not know, holding Crypted.ps1 or a .js file with a long random name, is a sign someone else has write access.

2. 2

   Do not just delete and move on

   Take a copy of the files for evidence first if you can, then remove them. Deleting the files does not close the door that was used to put them there.

3. 3

   Close the door

   Change the passwords of the hosting panel, FTP or SFTP, database and site admin accounts from a clean device. Update the site software and its plugins and remove the ones you do not use. Check for admin accounts you did not create.

4. 4

   Ask for a review when it is clean

   Once the site is clean you can ask the reporting services to review it. Keep a written note of what you found and when, in case your host or customers ask.

If you use a Mac, an iPhone or an Android phone

The tags and the sources we read describe a Windows threat. We found nothing that says the files on this address affect anything else.