URLhaus Database

Every malware URL on URLhaus is associated with a host. A host can be either an domain name or an IP address (in case the malware URL is hosted on an IP address and doesn't use a domain name).

Database Entry

Host: gotovacoil.com
Domain registrar:GoDaddy -
Domain registration date:2005-03-16 21:55:25 UTC
Spamhaus DBL :Not blocked
SURBL :Not blocked
Quad9 :Not blocked
AdGuard :Not blocked
Cloudflare :Not blocked
ProtonDNS :Not blocked
OpenBLD :Blocked
DNS4EU :Not blocked
Control D HaGeZi :Not blocked
Firstseen:2022-03-10 16:15:09 UTC
Total malware sites :70
Online malware sites :0 (0%)
Offline Malware sites :70 (100%)
A record(s) observed :1

IP addresses

The table below shows all IP address observed for this particular host (in case the host is a domain name, all A records will be listed - including all historical ones). Please note that the output is limited to 10 entires.

Firstseen (UTC)IP addressHostnameSBLASNCountryActive?
2022-03-10 16:15:13 72.48.234.249quiknet.quiknt.comNot listedAS7459 GRANDECOM-AS1- USyes

Malware URLs

The table below shows all malware URLs that are associated with this particular host.

Dateadded (UTC)URLStatusTagsReporter
2022-08-20 08:00:06http://gotovacoil.com/singin/Encrypted%20Client...Offlineascii opendir powershell ps rat RemcosRAT ext abuse_ch
2022-08-20 07:59:04http://gotovacoil.com/singin/Protected%20Client...Offlineascii opendir rat RemcosRAT ext vbs abuse_ch
2022-08-20 07:59:04http://gotovacoil.com/singin/attack.txtOfflineascii opendir powershell ps rat RemcosRAT ext abuse_ch
2022-08-06 07:44:05http://gotovacoil.com/zuma/Encrypted%20Client%2...Offlineascii opendir powershell ps rat RemcosRAT ext abuse_ch
2022-08-06 07:44:04http://gotovacoil.com/zuma/Protected%20Client.vbsOfflineascii opendir rat RemcosRAT ext vbs abuse_ch
2022-08-06 07:44:04http://gotovacoil.com/zuma/attack.txtOfflineascii opendir powershell ps rat RemcosRAT ext abuse_ch
2022-08-02 17:37:05http://gotovacoil.com/summ/Encrypted%20Client%2...Offlineascii opendir powershell ps rat RemcosRAT ext abuse_ch
2022-08-02 17:36:04http://gotovacoil.com/summ/Protected%20Client.vbsOfflineascii opendir rat RemcosRAT ext vbs abuse_ch
2022-08-02 17:36:03http://gotovacoil.com/summ/attack.txtOfflineascii opendir rat RemcosRAT ext abuse_ch
2022-08-01 13:55:05http://gotovacoil.com/goes/Encrypted%20Client%2...Offline AndreGironda
2022-08-01 13:53:04http://gotovacoil.com/goes/attack.txtOfflineps1 AndreGironda
2022-08-01 13:44:05http://gotovacoil.com/goes/Protected%20Client.vbsOfflinevbs AndreGironda
2022-07-15 16:31:32http://gotovacoil.com/jsworld/attack.txtOfflineps1 AndreGironda
2022-07-13 18:05:04http://gotovacoil.com/jsworld/Protected%20Clien...Offline AndreGironda
2022-07-13 08:30:18http://gotovacoil.com/dick/Encrypted%20Client%2...Offlineopendir rat RemcosRAT ext abuse_ch
2022-07-13 03:26:23http://gotovacoil.com/dick/attack.txtOfflineopendir rat RemcosRAT ext abuse_ch
2022-07-12 08:44:05http://gotovacoil.com/dick/Protected%20Client.vbsOfflineascii opendir rat RemcosRAT ext vbs abuse_ch
2022-06-15 06:36:09http://gotovacoil.com/wprltu/attack.txtOfflineremcos ext AndreGironda
2022-06-15 06:35:05http://gotovacoil.com/wprltu/Encrypted%20Client...Offlinedll remcos ext AndreGironda
2022-06-09 00:20:05http://gotovacoil.com/wprltu/Protected%20Client...Offlineremcos ext AndreGironda
2022-05-20 05:34:03http://gotovacoil.com/cname/Protected%20Client.vbsOfflineascii opendir powershell ps RemcosRAT ext abuse_ch
2022-05-20 05:33:05http://gotovacoil.com/cname/attack.txtOfflineascii opendir powershell ps abuse_ch
2022-05-20 05:33:05http://gotovacoil.com/cname/Encrypted%20Client%...Offlineascii js opendir abuse_ch
2022-05-12 07:10:05http://gotovacoil.com/macro/Encrypted%20Client%...Offlineascii opendir rat RemcosRAT ext abuse_ch
2022-05-12 07:09:04http://gotovacoil.com/macro/attack.txtOfflineascii opendir powershell ps rat RemcosRAT ext abuse_ch
2022-05-12 07:09:04http://gotovacoil.com/macro/Protected%20Client.vbsOfflineascii opendir rat RemcosRAT ext vbs abuse_ch
2022-04-28 06:18:04http://gotovacoil.com/bin/ACH%20payment%20copy.xlsOfflineopendir RemcosRAT ext xls abuse_ch
2022-04-28 06:18:04http://gotovacoil.com/cpmove/attack.txtOfflineascii opendir powershell ps abuse_ch
2022-04-28 06:18:03http://gotovacoil.com/wprz/attack.txtOfflineascii opendir powershell ps abuse_ch
2022-04-28 06:18:03http://gotovacoil.com/wprz/bitzne/attack.txtOfflineascii opendir powershell ps abuse_ch
2022-04-28 06:18:03http://gotovacoil.com/bitadmin/attack.txtOfflineascii opendir powershell ps abuse_ch
2022-04-28 06:18:03http://gotovacoil.com/well/attack.txtOfflineascii opendir powershell ps abuse_ch
2022-04-28 06:17:08http://gotovacoil.com/wprz/bitzne/Encrypted%20C...Offlineascii opendir powershell ps abuse_ch
2022-04-28 06:17:07http://gotovacoil.com/bitadmin/Encrypted%20Clie...Offlineascii opendir powershell ps abuse_ch
2022-04-28 06:17:07http://gotovacoil.com/wprz/Encrypted%20Client%2...Offlineascii opendir powershell ps abuse_ch
2022-04-28 06:17:07http://gotovacoil.com/newadmin/Encrypted%20Clie...Offlineascii opendir powershell ps abuse_ch
2022-04-28 06:17:07http://gotovacoil.com/bin/alhm.jpgOfflineascii opendir powershell ps abuse_ch
2022-04-28 06:17:05http://gotovacoil.com/cpmove/Encrypted%20Client...Offlineascii opendir powershell ps abuse_ch
2022-04-28 06:17:05http://gotovacoil.com/folder/Encrypted%20Client...Offlineascii opendir powershell ps abuse_ch
2022-04-28 06:17:05http://gotovacoil.com/well/Encrypted%20Client%2...Offlineascii opendir powershell ps abuse_ch
2022-04-28 06:17:05http://gotovacoil.com/bin/Encrypted.jpgOfflineascii opendir powershell ps abuse_ch
2022-04-28 06:16:04http://gotovacoil.com/wprz/bitzne/Client.vbsOfflineascii opendir vbs abuse_ch
2022-04-28 06:15:06http://gotovacoil.com/newadmin/Protected%20Clie...Offlineascii opendir vbs abuse_ch
2022-04-28 06:15:05http://gotovacoil.com/well/Protected%20Client.vbsOfflineascii opendir vbs abuse_ch
2022-04-28 06:15:04http://gotovacoil.com/cpmove/Protected%20Client...Offlineascii opendir vbs abuse_ch
2022-04-28 06:15:04http://gotovacoil.com/admin/Protected%20Client.vbsOfflineascii opendir vbs abuse_ch
2022-04-28 06:15:04http://gotovacoil.com/bin/Protected.vbsOfflineascii opendir vbs abuse_ch
2022-04-28 06:15:04http://gotovacoil.com/folder/Protected%20Client...Offlineascii opendir vbs abuse_ch
2022-04-28 06:15:04http://gotovacoil.com/bin/Protected%20Client.vbsOfflineascii opendir vbs abuse_ch
2022-04-28 06:14:05http://gotovacoil.com/quiknt/Encrypted%20Client...Offlineascii opendir powershell ps rat RemcosRAT ext abuse_ch
2022-04-28 06:13:03http://gotovacoil.com/quiknt/attack.txtOfflineascii opendir powershell ps rat RemcosRAT ext abuse_ch
2022-04-28 06:12:04http://gotovacoil.com/quiknt/Protected%20Client...Offlineascii opendir rat RemcosRAT ext vbs abuse_ch
2022-04-13 16:25:05http://gotovacoil.com/setting/Encrypted%20Clien...Offlineps1 remcos ext AndreGironda
2022-04-13 16:24:06http://gotovacoil.com/setting/Protected%20Clien...Offlineps1 remcos ext vbs AndreGironda
2022-04-13 16:24:04http://gotovacoil.com/setting/attack.txtOfflineps1 remcos ext vbs AndreGironda
2022-04-13 10:15:47http://gotovacoil.com/wpml/Encrypted%20Client%2...Offlineascii opendir powershell ps rat RemcosRAT ext abuse_ch
2022-04-13 10:13:51http://gotovacoil.com/wpml/attack.txtOfflineascii powershell ps rat RemcosRAT ext abuse_ch
2022-04-13 10:13:42http://gotovacoil.com/wpml/mon/Client.vbsOfflineascii rat RemcosRAT ext vbs abuse_ch
2022-04-05 05:27:05http://gotovacoil.com/wrpl/attack.txtOfflinerat RemcosRAT ext abuse_ch
2022-04-05 05:27:04http://gotovacoil.com/wrpl/mac/Client.vbsOfflinerat RemcosRAT ext abuse_ch
2022-04-05 05:26:06http://gotovacoil.com/wrpl/Encrypted%20Client%2...Offlinerat RemcosRAT ext abuse_ch
2022-03-29 04:37:06http://gotovacoil.com/newfolder/Protected%20Cli...Offlineremcos ext vbs AndreGironda
2022-03-22 15:20:05http://gotovacoil.com/admins/Encrypted%20Client...Offlineps1 AndreGironda
2022-03-22 15:18:13http://gotovacoil.com/admins/attack.txtOfflinevbs AndreGironda
2022-03-17 22:34:09http://gotovacoil.com/admin/attack.txtOfflineremcos ext AndreGironda
2022-03-17 22:34:07http://gotovacoil.com/admin/Encrypted%20Client%...Offlineremcos ext AndreGironda
2022-03-10 16:15:17http://gotovacoil.com/created/Encrypted%20Clien...Offlineps1 AndreGironda
2022-03-10 16:15:13http://gotovacoil.com/created/Protected%20Clien...Offlinevbs AndreGironda

The table below shows recent payloads delivery by this host.

Firstseen (UTC)SHA256 hashFile typeBazaarSignature
2023-05-28 18:27:14da75e6da0c818499ee32bafd43c52ef615d95d2cf8c85885d044d78d5e5b76e8txt  
2022-09-07 11:09:4542905a0cbc4e8e77bb6f703142f449a702b38d858f56b01d5cd64fe696206e99txt  
2022-09-06 21:54:32fa1e7fa93d0f7494330d5968a9aa791c2671bd49ae7e4f4ba7b3fbc52599da6atxt  
2022-08-20 07:59:04727e09176fdc28b14adde369b89edfad4fd90ddbd7d301066d2c9a7fb670d9f7unknown  
2022-08-06 07:44:04055e6423f966d61439f2dd045a128cc531b44056b2facd114a0800fae39ba71funknown  
2022-08-02 17:36:04c35cc41e2aabb79172374fea20e23d41264fe4093d5166a75f8d658ba47655faunknown  
2022-08-01 13:44:04bb2079716ccbe3bb521d6d4998aff1aa7dbcfee88db580e252fbf473519ee7ecunknown  
2022-07-30 00:41:56eb054e91d30ad8de2cefcc39e73a7c6ca76c40b85d6910a926f93d8f785a8cfcunknown  
2022-07-15 14:59:31c55d8535fa8e8751ad005d988e494ea6f079525c90c4591dd9cd315ec885f714unknown  
2022-07-13 18:05:0493dc72a3f34fa5384fcdc1fb5e202ee48a7ac7c205224d7cce6371848a7e323eunknown  
2022-07-12 08:44:05523c873dd79648a0fa9be0ff69c200c8b8afe9b752c14ed717d019f7948c34c5unknown  
2022-07-11 16:14:35849218a9ca1c423e0c4fbfcae497a3ae95c8e03384b24e1f0873b6dee1c137dbunknown  
2022-06-09 00:20:05a39bdc4de25acc1fa913afc3a10c30ee853ada00a749e5d131fa8f29b9b08098unknown  
2022-06-07 18:47:26cd91be841a3eab3615b8b2a0661ac9e2adf1ec0a0b5b30e3fc1de9823715efc2unknown  
2022-06-07 14:34:21ddb096b521ff75d59f43aa545c662d1107d6960160f522274ad9acbc033ac20cunknown  
2022-06-06 13:26:466b9c4ecd3973a45ec06c2e9d33c7052ff5a7d1e7dbe371c390243d4e78dfba4eunknown  
2022-06-06 13:02:129dd5fee56b0da2a41fa3216fecff4ea7bc4108ff0029f4c8efe8ca7dc9521b4funknown  
2022-06-01 15:04:27ee70ef392cf72e7483246b7328b198321a171487f323f3d34f9ff86302de0932unknown  
2022-05-31 13:11:0615c4cddfd241cf4eaa63cd60c25bb28c2ae53b5282c68e5028cdbdd077416e16unknown  
2022-05-30 15:14:38ce2f19195279a907df41131b970733b5b41b9b6dce45ab4befc35d23121b53ddunknown  
2022-05-27 09:58:26a82d6e81fe5debc425d08777c0924bfb13716473ed92ee129289cd5f57d787b7unknown  
2022-05-20 05:34:03ea72201040a1802f8c3d65d656a257b21495d474390d921eace73eb29c2173a6unknownRemcosRAT
2022-05-18 13:47:41fafa5444cbd97dbdf2b9277bfa65fb6f88b207edbe0f649b07e871fade80b1c8unknown  
2022-05-12 07:09:04e20f106396d524a678f78d836a815b22c9955b662525a696d26fd2944e12cfa0unknown  
2022-05-02 20:50:30e88ee5e75169e819506d4f4db23191373fdd8a1e09ab9e0d29cef5a911e9ca2dunknown RemcosRAT
2022-04-28 06:18:04f2027e57addce1b3749967082d9a6ebbccbc335652c6c9246d2bf14aad42f00bxls RemcosRAT
2022-04-28 06:16:0450cd6a24e61a7c4782a9b3cd000d5a42e0ead0e92248a0d7cb03bb50b717d240unknown  
2022-04-28 06:15:052dca59fd8d72332b1040af729fe0904a58f325db9543c787f0706fca0f21bb10unknown  
2022-04-28 06:15:048f97b68b8bd0118b38fc84106cbc6fc13352a1d482877301689624d6b66ed11dunknown  
2022-04-28 06:15:04916ac547bc424f40140adf0b18c177f856dc1522430b5b7470c08334866aa5bdunknown  
2022-04-28 06:12:04fa13d22e77990005fb6d9b137f52d346a480a99f70ad26218234aadb0dc418fcunknown  
2022-04-14 15:51:275ff6fb5df6a5c8035e6c56cc1eb8f556f20daaefbe059b7109752d0fad5aea1cunknown  
2022-04-13 16:24:06f9d77863a4da4d9cb51a38b1bb22de7362f2b5272cdd66ddd9fe971ecfaf53a2unknown  
2022-04-13 10:13:42364632716cb2e2757b5ae5665118c0deb6b83869c2f09035c591b88734519a39unknownRemcosRAT
2022-04-05 05:27:04ab5218bb169297b62946f813a5dd8449a828f9093649206b9b8339923a8918adunknown RemcosRAT