fl[.]goumvct[.]cc

Analysis of fl.goumvct.cc shows that the domain was registered on June 12, 2026 through Dominet (HK) Limited. The domain resolves to the IP address 104.21.87.7, which is currently listed on a single external security blocklist. PhishDestroy has already blocked the domain, and VirusTotal reports that 12 of 91 scanned scanners flag the host as malicious, reinforcing the perception of an active threat. The risk rating assigned is elevated and the operational status is active, indicating that the infrastructure is likely being used for malicious campaigns at present.

No public SSL certificate details, HTTP response codes, or page title information have been published, so the exact content delivered to victims remains unknown. The limited visibility of the hosting environment suggests a simple attack infrastructure focused on delivering credential‑stealing pages rather than a multi‑stage payload. Defenders should immediately add fl.goumvct.cc to DNS‑based deny lists and firewall rules, and consider blocking outbound traffic to the resolved IP 104.21.87.7. Continuous monitoring of the IP for new domain resolutions is advised, as the registrar, Dominet (HK) Limited, has been associated with other abusive registrations.

Organizations should also enable Safe Browsing or similar web‑filtering services that incorporate the existing blocklist entry, ensuring that end‑user browsers receive warnings before any navigation attempts. Because the site’s page title and content have not been publicly disclosed, threat‑intel teams should prioritize a manual request for a sandbox capture or a controlled fetch to verify the exact phishing lure, which will aid in creating signatures for intrusion‑prevention systems. Until further forensic detail is obtained, the recommended mitigation steps are to block the domain, monitor the associated IP, and keep the detection feeds updated.