goumvce[.]cc

The domain goumvce.cc was registered on 12 June 2026 through Dominet (HK) Limited, a Hong‑Kong based registrar frequently used by malicious operators. DNS resolution points exclusively to the address 172.67.197.230, an IP belonging to the Cloudflare network, which is commonly leveraged to hide the true origin of phishing infrastructure. As of the report date (29 July 2026) the domain is classified as active and assigned an elevated risk rating. VirusTotal has recorded detections from 16 of 91 scanning engines, indicating that a notable subset of security vendors have identified malicious behavior associated with the host.

The domain also appears on a single external blocklist and is explicitly blocked by the PhishDestroy service, reinforcing the consensus that it is being used for phishing campaigns. No additional public intelligence such as Safe Browsing verdicts, OTX tags, or SSL certificate details have been disclosed, leaving the exact payload or targeted brand undefined. Given the observed indicators, defenders should treat any traffic to goumvce.cc as hostile. Network‑level controls ought to block outbound connections to the IP 172.67.197.230 and to the domain itself.

Email gateways should add the domain to deny lists, and endpoint protection solutions should incorporate the VirusTotal detection signatures. Continuous monitoring of the IP range for new sub‑domains is advised, as the underlying Cloudflare edge may be reused for further malicious sites. Analysts should also watch for any future registration of similar‑looking domains by the same registrar, as the pattern suggests a low‑cost, fast‑flux phishing operation.