home

goodbe.co

Artyom Kasyanov

Domain Information

The domain goodbe.co registered by Artyom Kasyanov was initially registered in February of 2015 through 1&1 INTERNET AG. Currently this domain has been known to host various forms of malware. The hosted servers are located in Carrollton, Texas within the United States which resides on the WEBSITEWELCOME.COM network.
Registrar:
1&1 INTERNET SE

Server location:
Texas, United States (US)

Create date:
Sunday, February 8, 2015

Expires date:
Tuesday, February 7, 2017

Updated date:
Monday, February 8, 2016

ASN:
AS20013 CYRUSONE - CyrusOne LLC,US

Whois:
3 goodbe.co records

Scanner detections:
Malware distribution  (62% detected)

Scan engine
Details
Detections

Reason Heuristics
Trojan.Downloader (M), Threat.Win.Reputation.IMP
81.82%

AVG
BitCoinMiner.D, Generic36
48.48%

Dr.Web
Trojan.Coinbit.43, Trojan.Siggen6.55013
30.30%

Zillya! Antivirus
Tool.BitCoinMiner.Win64.3, Adware.OutBrowse.Win32.80053
27.27%

McAfee
RDN/Generic PUP.x!cmq, Artemis!DE9B2D0EBCC4, Artemis!12B5CC4CBFEF, Artemis!F9F4499E75C1, Trojan.Artemis!B90EFC7D539A, Artemis!44E34C9E377F
18.18%

IKARUS anti.virus
not-a-virus:RiskTool.BitCoinMiner, Trojan.Win32.BitMin, Trojan.Win64.CoinMiner, Backdoor.Win32.Wencho
15.15%

Malwarebytes
Riskware.BitcoinMiner, Trojan.FakeMS, Trojan.Dropper, Trojan.Dropper.Script
15.15%

K7 AntiVirus
Trojan , Unwanted-Program
12.12%

G Data
Win64.Riskware.BitCoinMiner, Trojan.Generic.15115885, Trojan.Generic.14905647
12.12%

ESET NOD32
Win64/BitCoinMiner.U potentially unsafe (variant), Win64/CoinMiner (variant)
9.09%

avast!
Win64:Rootkit-gen [Rtk], Win32:Miner-B [PUP], Win64:Malware-gen
9.09%

Kaspersky
not-a-virus:RiskTool.Win64.BitCoinMiner, Trojan.Win32.BitMin, UDS:DangerousObject.Multi.Generic
9.09%

MicroWorld eScan
Trojan.Generic.11649192, Trojan.Generic.15115885, Trojan.Generic.14905647
9.09%

nProtect
Trojan.Generic.11649192, Trojan.Generic.15115885, Trojan.Generic.14905647
9.09%

Bitdefender
Trojan.Generic.11649192, Trojan.Generic.15115885, Trojan.Generic.14905647
9.09%

The domain goodbe.co has been seen to resolve to the following IP address.

192.185.16.209
January 5, 2016

File downloads found at URLs served by goodbe.co.

1 / 68      (Malware)
http://goodbe.co/taskmgr.exe  (7456f3863504736d14fd1910b5dfeed0)

2 / 68      (inconclusive)
http://goodbe.co/csrss.exe  (00aa440f85f8b71da6e8e2cefccc5e7b)

0 / 68
http://goodbe.co/pthreadVC2.dll  (4a502706d149c2f5854131a7758a90e2)

0 / 68
http://goodbe.co/msvcr120.dll  (034ccadc1c073e4216e9466b720f9849)

0 / 68
http://goodbe.co/cudart64_75.dll  (de9e99a2d2c008795f8f9dd8f995d3b4)

0 / 68
http://goodbe.co/msvcp120.dll  (46060c35f697281bc5e7337aee3722b1)

0 / 68
http://goodbe.co/nvidia.exe  (34dafe96200609d0517a398a18832def)

0 / 68
http://goodbe.co/amd.exe  (68f914cfc40089b962ed0e787526bd43)

0 / 68
http://goodbe.co/libcurl.dll  (514df457d8a2a2f8ee6aa31e254b3a43)

0 / 68
http://goodbe.co/libmicrohttpd-dll.dll  (07bee07e0bc94731f84cc754138fa940)

0 / 68
http://goodbe.co/OpenCL.dll  (d143c8d82d8b0ccc0b9cda536596d808)

0 / 68
http://goodbe.co/Windows Defender.exe  (a80a92fe03b75f282cfecf55e486382d)

0 / 68
http://goodbe.co/libeay32.dll  (d0a818dc5d401c5b0057bffd6ae8d4b7)

0 / 68
http://goodbe.co/libcurl-4.dll  (559bf5bbff38c649dd09a6ef98443a7b)

0 / 68
http://goodbe.co/libwinpthread-1.dll  (b390b89fd07a0dd03c07cc20da62fbb9)

URL:
http://goodbe.co/

Title:
“Gooqler”

Web server:
nginx/1.8.1

bongacams24.com

callfor.info

gooqler.com

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.