fl[.]goumvcy[.]cc

Infrastructure analysis of fl.goumvcy.cc reveals several indicators of elevated risk associated with phishing threats. The domain is currently active and resolves to IP address 188.114.97.3. It was registered relatively recently, on June 12, 2026, through Dominet (HK) Limited. According to current threat intelligence, security vendor PhishDestroy has blocked the domain, and it appears on at least one major security blocklist, reinforcing concerns regarding malicious activity. Notably, VirusTotal reports that 12 out of 91 security vendors have flagged fl.goumvcy.cc, which is a significant detection ratio and provides concrete evidence that the domain is recognized by multiple threat monitoring engines as a risk vector for phishing.

The available intelligence does not specify the exact content or brands targeted by this domain, nor does it provide further details such as SSL certificate status, HTTP response, or page title. Therefore, defenders cannot yet confirm what specific phishing tactics are being employed or which end users may be targeted. However, the combination of its rapid appearance on threat blocklists, multiple security vendor detections, and recent registration through an overseas registrar strongly suggests that the domain is part of an active phishing campaign.

Defenders should immediately restrict access to fl.goumvcy.cc within the network, monitor for any traffic to or from this domain, and update relevant security controls to block it. Ongoing observation is recommended, as further threat intelligence may provide more insight into specific attack vectors or targets. Given its active status and elevated risk indicators, caution is warranted for any interaction with this domain.