goumvcl[.]cc

The domain goumvcl.cc was registered through Dominet (HK) Limited on June 12, 2026. Within weeks of creation it appeared on a security blocklist and is currently blocked by the PhishDestroy feed, indicating active use in a credential‑harvesting campaign. VirusTotal reports that 16 of 91 scanned security vendors flag the domain as malicious, providing independent corroboration of its malicious intent. The elevated risk rating reflects the combination of a recent registration, a known registrar associated with malicious infrastructure, and multiple vendor detections.

Analysis of publicly available infrastructure shows no additional data such as IP address, hosting provider, SSL certificate details, or page title; these elements have not yet been disclosed. Consequently, the full technical footprint of the site remains partially unknown, and investigators should treat the lack of visible hosting information as a potential indicator of fast‑flux or proxy use. Defenders are advised to block goumvcl.cc at perimeter defenses, update URL filtering and DNS sinkhole lists, and monitor outbound traffic for connections to the domain.

Email security gateways should flag any messages containing links to goumvcl.cc and enforce strict authentication controls to mitigate credential theft. Continuous re‑scanning of the domain on VirusTotal and other sandbox services is recommended to capture any evolution in payload or hosting. Organizations that rely on threat‑intel feeds should ensure that PhishDestroy and similar blocklists are ingested to capture this indicator promptly.