ct[.]goumn[.]click

Analysis of ct.goumn.click indicates an active generic phishing infrastructure. The domain was registered through GMO Internet, Inc. d/b/a Onamae.com and its creation date is 12 June 2026. Threat intelligence sources have placed the domain on a single security blocklist and it is explicitly blocked by the PhishDestroy filtering service. VirusTotal scans show that 10 out of 91 security vendors flagged the domain as malicious, confirming a consensus of detection across multiple engines.

The risk rating assigned is elevated, reflecting the combination of recent creation, confirmed malicious detections, and active blocking by a dedicated anti‑phishing product. No additional technical artefacts such as IP address, hosting ASN, SSL certificate details, HTTP response codes, or page title have been released publicly, leaving those aspects of the infrastructure unverified. Consequently, defenders cannot yet correlate the domain to a specific hosting provider or infer the underlying command‑and‑control topology. The lack of further metadata also means that any content‑based signatures or heuristic rules must rely on the observed detection patterns rather than on observable page characteristics.

Given the current evidence, security teams should treat ct.goumn.click as a confirmed malicious resource. Immediate actions include adding the domain to network‑level deny lists, ensuring that web proxies and DNS filtering solutions block any resolution or HTTP request to the host, and confirming that endpoint protection products are updated to reflect the 10 vendor detections reported by VirusTotal. Continuous monitoring for new indicators—such as resolved IP addresses, TLS fingerprints, or observed payloads—will be necessary to expand detection coverage as the threat actor’s infrastructure evolves.