ct[.]goumt[.]cc

On 29 July 2026, ct.goumt.cc was observed as an active malicious infrastructure supporting a generic phishing campaign. The domain was registered on 12 June 2026 through Dominet (HK) Limited, a registrar frequently associated with transient malicious sites. VirusTotal analysis shows that 14 of 91 scanning engines flagged the domain, indicating a moderate level of detection across the security community.

The domain is listed on one public security blocklist and is actively blocked by the PhishDestroy sinkhole, confirming that defensive feeds are already targeting it. The elevated risk rating reflects the combination of recent creation, active status, and multiple vendor detections. While the specific hosting IP address, TLS certificate details, and page content have not been disclosed, the presence on blocklists and vendor detections provides sufficient confidence to treat the domain as a confirmed phishing vector.

Defenders should update URL filtering policies to block ct.goumt.cc, incorporate the domain into intrusion detection signatures, and monitor for any related C2 infrastructure that may share the same registrar or creation window. Continuous re‑evaluation is advised as additional telemetry becomes available.