nj[.]goumvca[.]cc

Analysis of nj.goumvca.cc, first observed 2025-09-27, shows the domain is actively used for generic phishing. The domain resolves to 188.114.97.3, hosted by an infrastructure registered through Dominet (HK) Limited. Fifteen of ninety‑one antivirus and URL scanners on VirusTotal have flagged the domain, indicating a moderate level of consensus among security vendors that the site is malicious. It appears on at least one public blocklist and is listed by the PhishDestroy sink‑hole as a confirmed phishing source.

No additional public reputation services, such as Safe Browsing or OTX, were referenced in the supplied intelligence, and no SSL certificate details or HTTP response codes have been disclosed, limiting visibility into transport‑layer security. The lack of page‑title information prevents confirmation of the targeted brand or the exact credential‑capture technique employed. Defenders should therefore treat the domain as hostile: block DNS resolution for nj.goumvca.cc at perimeter firewalls, add the associated IP address 188.114.97.3 to deny lists, and monitor network traffic for outbound connections to that address. Because the registrar is located in Hong Kong, rapid takedown requests may be less effective; proactive traffic filtering is recommended.

Continuous monitoring of VirusTotal and other sandbox feeds for new analysis reports is advised, as additional detection signatures may emerge. Organizations should also update email security gateways to reject messages containing URLs that resolve to the listed IP or domain, and consider employing URL rewriting or sandboxing for any user‑initiated clicks. Threat intelligence teams should enrich this indicator with future WHOIS updates, SSL certificate transparency logs, and any observed payload samples to improve detection rules.