fl[.]goumvcl[.]cc

fl.goumvcl.cc was registered on 12 June 2026 through Dominet (HK) Limited, a registrar known for rapid domain provisioning. Within weeks of its creation the domain appeared on a public phishing blocklist and was subsequently blocked by the PhishDestroy filtering service. VirusTotal has processed the domain and 15 of 91 participating security vendors have returned a malicious classification, indicating that multiple independent scanners have identified phishing‑related artifacts associated with the host. The current risk rating is elevated and the domain is listed as active in threat‑intel feeds, matching the generic phishing category assigned by the reporting system.

Analysis confirms that the domain’s presence on a blocklist and its detection by a subset of VirusTotal scanners constitute actionable evidence for defensive teams. However, no public information is available regarding the underlying hosting infrastructure, IP address, SSL certificate details, or the exact page content; the page title and any brand‑specific impersonation have not been disclosed in the available intelligence. Consequently, the full scope of the phishing campaign – such as target audience, credential‑stealing mechanisms, or payload delivery – remains uncertain.

Defenders should prioritize adding fl.goumvcl.cc to URL filtering rules, ensure that outbound traffic to the domain is denied, and monitor network logs for any attempted connections. Given the recent creation date, the domain may be used in short‑lived campaigns; continuous re‑evaluation of blocklist status and periodic rescans with VirusTotal are recommended to capture any changes in detection coverage. Organizations employing email security gateways should also update phishing signatures to include this indicator of compromise.