fl[.]goumvcm[.]cc

Analysis of fl.goumvcm.cc indicates an active phishing domain registered on June 12, 2026, through Dominet (HK) Limited. The domain resolves to IP address 172.67.166.252, which is associated with Cloudflare infrastructure, a common tactic to obscure hosting origins and evade IP-based blocking. As of July 29, 2026, the domain appears on one security blocklist and is flagged by PhishDestroy. VirusTotal detection data shows 14 of 91 security vendors marking the domain as malicious, though the specific nature of the threat—such as targeted brand or phishing kit—remains unconfirmed due to lack of page content analysis.

Infrastructure review reveals no additional context regarding the hosting provider’s autonomous system or geolocation beyond the Cloudflare proxy. The domain’s registration details do not include identifiable brand references, and no page title or scam classification (e.g., banking, social media, shipping) is available in current intelligence. The elevated risk classification stems from the combination of recent registration, Cloudflare obfuscation, and cross-vendor detections, though the exact payload or lure type is not yet determined.

Defenders should treat this domain as a potential credential-harvesting or malware-distribution vector. Recommended actions include blocking the domain at DNS and proxy levels, monitoring for connections to 172.67.166.252, and reviewing logs for user interactions with fl.goumvcm.cc. Further analysis of HTTP headers, SSL certificates, or captured page content may clarify the targeted brand or attack methodology, but no such data is currently available.