ct[.]goumy[.]cc

The domain ct.goumy.cc was created on 12 June 2026 and registered through Dominet (HK) Limited, a registrar that frequently appears in malicious‑infrastructure analyses. Threat intelligence records show the domain is listed on a single security blocklist and is actively blocked by the PhishDestroy feed, indicating that at least one reputable source has identified it as abusive. VirusTotal scans report that eleven of ninety‑one antivirus engines flagged the domain, providing concrete vendor‑level detection that corroborates the blocklist observation.

The domain is classified as a generic phishing threat with an elevated risk rating and is currently marked as active. No additional public indicators such as Safe Browsing entries, Open Threat Exchange (OTX) tags, hosting IP addresses, autonomous system numbers, SSL certificate details, HTTP status codes, trust‑score metrics, page titles, or evidence links have been published, leaving the underlying infrastructure largely undocumented. This lack of granular data creates uncertainty around the exact hosting environment and the specific credential‑harvesting mechanisms employed.

Defenders should therefore treat ct.goumy.cc as a high‑confidence phishing indicator: add the domain to DNS and web‑filtering block lists, monitor outbound connections for attempts to resolve or contact the domain, and quarantine any internal accounts that may have interacted with it. Ongoing telemetry collection is recommended so that future analyses can enrich the profile with IP, SSL, and content‑based evidence as they become available.