fl[.]goumas[.]cc

Analysis of fl.goumas.cc indicates that the domain was registered on June 12, 2026 through NameSilo, LLC and is currently resolving to the IP address 172.67.159.34. The domain appears on a single security blocklist and is actively blocked by PhishDestroy, confirming that defensive feeds consider it malicious. Google Safe Browsing has classified the site as a social engineering threat, which aligns with the generic phishing designation in the supplied intelligence. VirusTotal scans show that 13 of 91 security vendors have flagged the domain, providing additional corroboration of its malicious nature.

The presence of multiple independent detections suggests a coordinated effort rather than a one‑off misconfiguration. The infrastructure is hosted on a shared address that is commonly used by other abusive domains, which may increase the risk of collateral impact for organizations that allow outbound connections to the host. At present, no public page title or SSL certificate details have been released, and the content of the landing page has not been analyzed, leaving the exact phishing lure undefined.

Defenders should prioritize adding fl.goumas.cc and its resolving IP 172.67.159.34 to deny‑list rules across DNS filtering, proxy, and endpoint protection solutions. Continuous monitoring of the IP for new associations and periodic re‑scans with VirusTotal or similar services are recommended to capture any changes in detection status. Given the high risk rating and active status, organizations handling credential‑sensitive traffic should treat any communication with this domain as hostile and block it at the perimeter.