URLhaus Database

Every malware URL on URLhaus is associated with a host. A host can be either an domain name or an IP address (in case the malware URL is hosted on an IP address and doesn't use a domain name).

Database Entry

Host:	qpwot.cfd
Domain registrar:	Spaceship
Domain registration date:	2026-10-01 01:35:15 UTC
Abuse complaint sent to registrar:	Yes (2026-10-06 07:30:24 UTC to abuse{at}spaceship[dot]com)
Spamhaus DBL :	Botnet C&C domain
SURBL :	Not blocked
Quad9 :	Status unknown
AdGuard :	Blocked
Cloudflare :	Blocked
ProtonDNS :	Status unknown
OpenBLD :	Blocked
DNS4EU :	Not blocked
Control D HaGeZi :	Not blocked
Firstseen:	2026-10-06 07:03:33 UTC
Total malware sites :	7
Online malware sites :	0 (0%)
Offline Malware sites :	7 (100%)
A record(s) observed :	8

IP addresses

The table below shows all IP address observed for this particular host (in case the host is a domain name, all A records will be listed - including all historical ones). Please note that the output is limited to 10 entires.

Malware URLs

• URLs
• Payloads

The table below shows all malware URLs that are associated with this particular host.

Dateadded (UTC)	URL	Status	Tags	Reporter
2026-10-06 07:14:46	https://qpwot.cfd/mrprince/secured_stub.ps1	Offline	ascii MassLogger opendir powershell ps1	abuse_ch
2026-10-06 07:11:44	https://qpwot.cfd/plug/sIG57dcQX5asQNJ6u7CE3d.js	Offline	ascii js opendir	abuse_ch
2026-10-06 07:10:15	https://qpwot.cfd/wealt/secured_stub.ps1	Offline	ascii opendir powershell ps1 VIPKeylogger	abuse_ch
2026-10-06 07:07:24	https://qpwot.cfd/wealt/wealt1/5asQNsIG57dcQXJ6...	Offline	ascii js opendir	abuse_ch
2026-10-06 07:05:18	https://qpwot.cfd/pprriinnnce/secured_stub.ps1	Offline	ascii MassLogger opendir powershell ps1	abuse_ch
2026-10-06 07:03:58	https://qpwot.cfd/ppprincee6/secured_stub.ps1	Offline	ascii MassLogger opendir powershell ps1 VIPKeylogger	abuse_ch
2026-10-06 07:03:40	https://qpwot.cfd/plug2/73fG57dcQX5asQNJ6u7C8ge...	Offline	ascii js opendir	abuse_ch

The table below shows recent payloads delivery by this host.

Firstseen (UTC)	SHA256 hash	File type	Bazaar	Signature
2026-10-06 07:14:44	66f503b12d359e33d474b62f9c2d63ed662912e297ebfe5e999d2cc6e9e3ea3a	ps1		MassLogger
2026-10-06 07:11:43	1c342babaa15a1a2bffebf991f52ae02876e102e2ea5c6b29d23a8e0cacace7e	js
2026-10-06 07:10:14	0681966167924bfe319294a2344b67e5585d8ffc830e12ea3402938d673faba2	ps1		VIPKeylogger
2026-10-06 07:07:23	94b9901d76ae5ff13bb2ff1cee905b2f902248a7e29191fee86b2711b483eac2	js
2026-10-06 07:05:17	47de71ab776c75778e8ed1c9cf891479ee080029a736c2c1e3df5fdf4537bac2	ps1		MassLogger
2026-10-06 07:03:57	bfd379d8db16263ff5529e483ebe4ca7fbf8051b89999e627147deab4f7559fa	ps1		MassLogger
2026-10-06 07:03:39	1c342babaa15a1a2bffebf991f52ae02876e102e2ea5c6b29d23a8e0cacace7e	js