fl[.]goumad[.]cc

fl.goumad.cc was registered through NameSilo, LLC on 12 June 2026 and began resolving to the address 104.21.71.34 shortly thereafter. The hosting IP belongs to a Cloudflare network used by multiple unrelated sites, which complicates attribution but does not mitigate the observed malicious activity. The domain appears on a single security blocklist and has been actively blocked by the PhishDestroy feed, indicating that at least one operational phishing detector has identified traffic associated with the domain. VirusTotal reports that 11 of 91 scanning engines have flagged the domain as malicious, a ratio that exceeds typical background noise for newly created domains and aligns with the elevated risk rating assigned by the database.

The current risk level is listed as elevated and the domain status is active, suggesting that malicious infrastructure is still reachable. The available evidence does not include a page title, SSL certificate details, HTTP response codes, or any brand‑specific lures, so the precise phishing vector cannot be confirmed at this time. Analysts should therefore treat the domain as a generic phishing platform and assume that any URLs hosted on the same IP may be used to deliver credential‑stealing pages, malicious downloads, or redirect victims to further compromised infrastructure. Defenders are advised to add 104.21.71.34 to inbound and outbound network deny lists, enforce URL filtering for the fully qualified domain name fl.goumad.cc, and monitor DNS query logs for recent resolution attempts.

Because the registrar is NameSilo, LLC, it is worthwhile to flag the registrar in any automated takedown workflow. Continued scanning with sandbox environments and periodic re‑query of VirusTotal are recommended to capture any changes in the detection score. Logging of any user‑initiated connections to the domain should be correlated with authentication failures to identify potential compromise attempts.