Popular Switch Serial Checker Website damota.me infected with infostealer malware

Maq47 · May 23, 2026

When you access damota.me's Switch serial checker via certain browsers (I use Firefox), it downloads a file that hijacks the user profile and sets hacked domains to open silently upon loading the browser. For me, the program that sets it was stored at C;\Users\<myname>\AppData\Roaming\Mozilla\Extensions\damota.exe. It's target box in Properties gave its nature away. I noticed it when it appeared in recently installed programs yesterday evening. I highly recommend NOT using this site for the foreseeable future. I have reported the site to Google as well.

Lostbhoy · May 23, 2026

Just use this....

Hacking Thread 'Switch Informations by serial number - READ THE FIRST POST before asking questions'

Aug 17, 2017

TL;DR. Compare your serial here to know if your Switch is patched or not:

Serials beginning with XAW1:
Serials between XAW10000000000 - XAW10065000000 are safe to buy
Serials between XAW10066000000 - XAW10120000000 are possibly patched
Serials above XAW10120000000 are definitely patched

Serials beginning with XAW4:
Serials between XAW40000000000 - XAW40011000000 are safe to buy
Serials between XAW40011000000 - XAW40012000000 are possibly patched
Serials above XAW40012000000 are definitely patched

Serials...

Hayato213 · 2026-07-06T18:44:14+0100

Seem false, the path point to extension, I just tried it nothing happens.

Maq47 · 2026-07-07T03:19:02+0100

Hayato213 said:
Seem false, the path point to extension, I just tried it nothing happens.

So you also have the shortcut? So I'm not going crazy? Yes, it points to the extensions folder, but it also silently opens a connection to a random-looking website. Silently, as in, it doesn't open a tab or anything. This web page takes a 'logs' folder that actually contains a copy of all of your cookies, passwords, literally everything in your browser. It puts it in a folder in Chrome if it is installed, otherwise it writes to a renamed .zip file contained in C:\Users\YourName\AppData\Local\Temp\. I was able to find it there as well on my system, so it's probably redundancy from the virus and it tries to write it everywhere it can. The problem is, the virus didn't come from damota itself. It came from an ad-affiliated link to damota from Google. So there's nothing that can be done in that department, since not everyone gets it recommended to them due to targeted advertising these days.

Hayato213 · 2026-07-07T03:54:49+0100

Maq47 said:
So you also have the shortcut? So I'm not going crazy? Yes, it points to the extensions folder, but it also silently opens a connection to a random-looking website. Silently, as in, it doesn't open a tab or anything. This web page takes a 'logs' folder that actually contains a copy of all of your cookies, passwords, literally everything in your browser. It puts it in a folder in Chrome if it is installed, otherwise it writes to a renamed .zip file contained in C:\Users\YourName\AppData\Local\Temp\. I was able to find it there as well on my system, so it's probably redundancy from the virus and it tries to write it everywhere it can. The problem is, the virus didn't come from damota itself. It came from an ad-affiliated link to damota from Google. So there's nothing that can be done in that department, since not everyone gets it recommended to them due to targeted advertising these days.

Nothing on my end

Popular Switch Serial Checker Website damota.me infected with infostealer malware

#1 Anaxa Fan

HEY YOU GUYS!

Hacking Thread 'Switch Informations by serial number - READ THE FIRST POST before asking questions'

Newcomer

#1 Anaxa Fan

Newcomer

Popular threads in this forum