ct[.]goump[.]cc

Analysis of ct.goump.cc shows a newly registered domain created on June 12, 2026 and operated through the registrar Dominet (HK) Limited. The domain resolves to the IPv4 address 188.114.97.3, an IP that is currently associated with at least one active blocklist entry. PhishDestroy has explicitly blocked ct.goump.cc, confirming that the infrastructure is recognized as malicious.

VirusTotal scans report that 15 out of 91 security vendors flag the domain, reinforcing the suspicion of malicious activity. The threat is classified as generic phishing, and the risk level has been set to elevated while the operational status remains active. The limited visibility into the web service means that no page title, SSL certificate details, or HTTP response codes are presently available in the intelligence feed, leaving the exact payload or credential‑harvesting mechanism unverified.

Nevertheless, the convergence of registrar information, IP association, blocklist presence, and multi‑vendor detection provides a strong indicator that ct.goump.cc is being used to lure victims into disclosing credentials or personal data. Defensive actions should include immediate blocking of the domain at network and endpoint layers, tagging of the associated IP address 188.114.97.3 for sinkholing or quarantine, and the inclusion of the domain in internal threat‑intel feeds. Continuous monitoring for any new resolution changes or additional vendor detections is advised, as well as periodic re‑query of VirusTotal and other reputation services to capture evolving detection rates.