fl[.]goumvcr[.]cc

fl.goumvcr.cc is a newly registered domain observed in a generic phishing campaign. The domain was created on 12 June 2026 and is registered through Dominet (HK) Limited. DNS resolution returns the IPv6 address 2606:4700:3033::6815:48e3, which belongs to a Cloudflare network. The domain currently appears on one public security blocklist and is listed as blocked by the PhishDestroy service.

VirusTotal analysis shows that 13 of 91 scanning engines flagged the domain as malicious, indicating a moderate level of consensus among detection vendors. No additional public intelligence such as Safe Browsing verdicts, OTX references, or SSL certificate details have been published for this host. The page title and any specific brand impersonation have not been disclosed, leaving the exact lure and credential‑stealing technique uncertain. Given the registration age of less than two months, the association with a reputable CDN, and the presence of detections across multiple vendors, the infrastructure is consistent with opportunistic phishing operators that leverage fast‑flux or high‑availability hosting services to increase uptime.

Defenders should add the IPv6 address and the domain name to DNS‑based deny lists, enforce web‑filtering rules that block known phishing URLs, and monitor outbound connections to the address for anomalous credential exfiltration. Continuous re‑scanning with VirusTotal and periodic checks of blocklist status are recommended to capture any evolution in the threat profile. Organizations that employ email security gateways should ensure that messages containing links to fl.goumvcr.cc are quarantined or rejected until further verification.