gofile.io
Classification: Whitelisted
gofile.io is a whitelisted (trusted) hostname listed by Alexa, Cisco Umbrella, Tranco. 1,649 sightings from 4 threat sources, last seen 2026-10-17.
Current activity
- Offline — no longer resolving. Last online 2026-10-17 15:55:52.
MITRE ATT&CK associations
Malware families: NANOCORE (S0336) CHAOS (S0220) DARKCOMET (S0334) HAVOC (S1229) WANNACRY (S0366) ASYNCRAT (S1087) NJRAT (S0385)
Blacklist sightings
| Description | Source | First seen | Last seen | Labels | MITRE ATT&CK |
|---|---|---|---|---|---|
| Xworm | Triage | 2026-02-06 12:19:04 | 2026-10-17 15:43:13 | malicious-activity | |
| Phishing | Phishtank | 2026-05-05 12:01:18 | 2026-10-16 06:12:17 | compromised malicious-activity phishing | |
| Discordrat | Triage | 2026-02-22 21:13:14 | 2026-10-15 20:01:43 | malicious-activity | |
| Ratonrat | Triage | 2026-03-15 19:30:32 | 2026-10-13 16:26:00 | malicious-activity | |
| Salatstealer | Triage | 2026-02-08 11:00:22 | 2026-10-12 17:44:27 | malicious-activity | |
| Xenorat | Triage | 2026-03-12 14:33:31 | 2026-10-11 20:59:05 | malicious-activity | |
| Donutloader | Triage | 2026-02-22 20:22:33 | 2026-10-11 18:43:14 | malicious-activity | |
| Suspicious URL | Triage | 2026-04-26 02:18:33 | 2026-10-09 09:52:45 | malicious-activity | |
| Asyncrat | Triage | 2026-02-22 19:40:58 | 2026-10-07 10:40:56 | malicious-activity | S1087 AsyncRAT |
| Havoc | Triage | 2026-07-25 01:20:33 | 2026-10-05 18:46:26 | malicious-activity | S1229 Havoc |
| Njrat | Triage | 2026-02-21 23:22:16 | 2026-10-04 20:10:07 | malicious-activity | S0385 njRAT |
| Neptunerat | Triage | 2026-01-31 22:22:48 | 2026-10-04 13:08:51 | malicious-activity | |
| Xmrig | Triage | 2026-02-10 02:30:05 | 2026-10-03 23:06:41 | malicious-activity | |
| Stormkitty | Triage | 2026-03-07 17:07:43 | 2026-10-03 06:26:04 | malicious-activity | |
| Top Popularity Site | Tranco | 2026-02-27 08:11:10 | 2026-09-23 01:00:17 | benign | |
| Mofksys | Triage | 2026-09-21 12:27:04 | 2026-09-21 12:27:04 | malicious-activity | |
| Quasar | Triage | 2026-02-02 19:30:02 | 2026-09-16 18:55:38 | malicious-activity | |
| Darksiderat | Triage | 2026-04-27 15:26:50 | 2026-09-14 11:04:24 | malicious-activity | |
| Vidar | Triage | 2026-09-04 20:57:17 | 2026-09-04 20:57:17 | malicious-activity | |
| Rapid_stealer | Triage | 2026-08-21 03:50:44 | 2026-08-21 03:50:44 | malicious-activity | |
| Luna_stealer | Triage | 2026-06-01 21:17:19 | 2026-08-20 16:04:37 | malicious-activity | |
| Xred | Triage | 2026-08-13 12:35:40 | 2026-08-13 12:35:40 | malicious-activity | |
| Wannacry | Triage | 2026-02-01 12:12:08 | 2026-08-12 20:14:59 | malicious-activity | S0366 WannaCry |
| Sheetrat | Triage | 2026-02-03 18:03:43 | 2026-07-30 11:31:08 | malicious-activity | |
| Dracula_stealer | Triage | 2026-07-27 15:20:39 | 2026-07-29 11:16:12 | malicious-activity | |
| Overlord | Triage | 2026-07-13 00:11:09 | 2026-07-25 09:23:04 | malicious-activity | |
| Blankgrabber | Triage | 2026-02-12 21:51:08 | 2026-07-13 20:29:01 | malicious-activity | |
| Umbral | Triage | 2026-03-06 22:07:59 | 2026-07-13 02:30:13 | malicious-activity | |
| Lxbaserat | Triage | 2026-07-12 15:56:26 | 2026-07-12 15:56:26 | malicious-activity | |
| Lumma | Triage | 2026-06-21 15:40:16 | 2026-06-21 15:40:16 | malicious-activity | |
| Silentnet | Triage | 2026-06-20 01:49:19 | 2026-06-20 01:49:19 | malicious-activity | |
| Lockbit | Triage | 2026-06-14 14:37:01 | 2026-06-14 14:37:01 | malicious-activity | |
| Darkcomet | Triage | 2026-06-02 15:41:59 | 2026-06-02 15:41:59 | malicious-activity | S0334 DarkComet |
| Defendnot | Triage | 2026-05-21 17:29:52 | 2026-05-21 17:29:52 | malicious-activity | |
| Hijackloader | Triage | 2026-05-02 09:20:29 | 2026-05-02 09:20:29 | malicious-activity | |
| Chaos | Triage | 2026-04-26 19:26:53 | 2026-04-26 19:26:53 | malicious-activity | S0220 Chaos |
| Malicious URL | Triage | 2026-01-30 19:39:01 | 2026-04-21 11:13:37 | malicious-activity | |
| Redline | Triage | 2026-04-16 20:02:20 | 2026-04-16 20:02:20 | malicious-activity | |
| Elite_stealer | Triage | 2026-04-16 13:47:48 | 2026-04-16 13:47:48 | malicious-activity | |
| Shinobu_clipper | Triage | 2026-04-16 13:44:55 | 2026-04-16 13:44:55 | malicious-activity | |
| Hawkeye | Triage | 2026-04-11 07:56:42 | 2026-04-11 07:56:42 | malicious-activity | |
| Customerloader | Triage | 2026-03-16 01:38:46 | 2026-04-06 18:00:26 | malicious-activity | |
| Genesis_stealer | Triage | 2026-03-11 22:27:35 | 2026-03-19 16:36:42 | malicious-activity | |
| Valleyrat_s2 | Triage | 2026-03-19 06:55:51 | 2026-03-19 06:55:51 | malicious-activity | |
| Nanocore | Triage | 2026-03-06 11:55:55 | 2026-03-06 11:55:55 | malicious-activity | S0336 NanoCore |
| Xorium_stealer | Triage | 2026-02-15 22:01:35 | 2026-02-15 22:01:35 | malicious-activity | |
| Spynote | Triage | 2026-02-14 18:10:56 | 2026-02-14 18:10:56 | malicious-activity | |
| Killmbr | Triage | 2026-02-14 00:29:38 | 2026-02-14 00:29:38 | malicious-activity | |
| Metasploit | Triage | 2026-02-12 12:57:28 | 2026-02-12 13:00:31 | malicious-activity | |
| Gozi | Triage | 2026-02-08 04:35:22 | 2026-02-08 04:35:22 | malicious-activity | |
| Sectoprat | Triage | 2026-02-06 17:33:17 | 2026-02-06 17:33:17 | malicious-activity | |
| Mercurialgrabber | Triage | 2026-02-03 06:59:38 | 2026-02-03 06:59:38 | malicious-activity | |
| Blackguard | Triage | 2026-01-30 20:41:49 | 2026-01-30 20:41:49 | malicious-activity | |
| Malware Download | URLhaus Abuse.ch | 2022-04-08 07:16:07 | 2025-07-03 20:05:50 | malicious-activity | |
| Top Popularity Site | Cisco Umbrella | 2022-07-18 21:28:30 | 2025-06-12 00:08:56 | benign | |
| Top 1M Site | Cisco Umbrella | 2022-07-23 03:00:40 | 2025-05-24 09:46:00 | benign | |
| Malicious URL | Hybrid-Analysis | 2023-10-12 11:00:03 | 2023-10-12 11:00:03 | ||
| Alexa Top 1 Million | Alexa | 2020-04-21 00:33:12 | 2022-07-14 00:07:12 | benign | |
| Malware | Hybrid-Analysis | 2021-07-15 17:30:12 | 2021-12-05 23:17:08 | ||
| Malicious site | Hybrid-Analysis | 2021-09-29 06:45:14 | 2021-09-29 06:45:14 | ||
| Malware site | Hybrid-Analysis | 2020-04-03 10:30:09 | 2021-07-05 10:30:24 | ||
| Generic.Malware | Hybrid-Analysis | 2020-05-18 19:00:33 | 2020-05-18 19:00:33 |
Tags
malware_download dropped-by-smokeloader dacic exe none credentialstealer asyncrat credential_access defense_evasion discovery execution persistence privilege_escalation ransomware spyware stealer trojan blackguard growtopia adware pyinstaller neptunerat locky wannacry impact worm macos installer quasar seroxen doll mercurialgrabber sheetrat sheet_refreshedfzhvvepznqotqzla phishing ekmeows pc upx xworm rat redline sectoprat cheat infostealer collection injector themida gozi banker isfb salatstealer xmrig miner agilenet romcom storm_0978 apt exploit cve_2025_8088 metasploit backdoor blankgrabber killmbr bootkit wiper office04 spynote android dropper xorium_stealer google njrat victim motw default donutloader loader discordrat rootkit evasion test sheet_tcwjcmmwqyakvk nanocore keylogger umbral stormkitty steam customerloader downloader genesis_stealer xenorat ratonrat $$$ valleyrat_s2 gh0strat vmprotect hawkeye ily9x elite_stealer shinobu_clipper clipper 3 revoked_codesign 12312e chaos darksiderat hijackloader mods onichan~ sheet_vqugwpofprwivj defendnot hacktool far-x menu leaked resahdebuilder luna_stealer darkcomet guest16 costura packer lockbit silentnet lumma ha2ked lxbaserat group1 c5b531c4879047ff9d66928e8db6ca07 overlord thirdrat havoc dracula_stealer ghostclient hacked suricata xred deneme lime rapid_stealer divai lc vidar 8871af746e869f200c6d738cc0b3bb1d calculator module hiddentear roblox executor scam mofksys backdor1IP addresses resolved by this hostname
- 217.182.142.52 (2020-04-03 10:30:09)
- 213.32.73.239 (2020-04-03 10:30:09)
- 217.182.142.131 (2020-04-03 10:30:09)
- 216.227.187.18 (2026-06-01 13:18:08)
- 94.139.32.3 (2026-09-23 01:00:16)
- 160.202.167.55 (2026-09-23 01:00:16)
Whois information
- AS name
- AS16276 OVH SAS
- Domain
- gofile.io
- TLD
- io
- First indexed
- 2020-04-03 10:30:09
- Last updated
- 2026-10-17 15:55:52