goumu[.]cc

Analysis of goumu.cc confirms an active credential-theft phishing operation. The domain was registered on June 12, 2026, through Dominet (HK) Limited, a registrar frequently associated with high-risk domains. Infrastructure analysis reveals the site resolves to IP address 188.114.97.3, which has been linked to multiple phishing campaigns in recent months. As of July 29, 2026, the domain appears on one security blocklist and is actively blocked by PhishDestroy.

VirusTotal scans indicate that 15 of 91 security vendors flag goumu.cc as malicious, reinforcing its classification as a phishing threat. The domain's registration age—just over six weeks—aligns with typical phishing lifecycle patterns, where domains are rapidly deployed and discarded. No specific brand impersonation or phishing kit details are currently available in the observable data, though the generic phishing classification suggests it may target login credentials for common services.

Defenders should treat this domain as high-risk and implement immediate blocking at the DNS or proxy level. Further investigation into the hosting IP (188.114.97.3) may reveal additional related domains or infrastructure shared with other phishing operations. Given the elevated risk level and active status, organizations are advised to monitor for any attempts to access goumu.cc from internal networks and correlate with endpoint detection logs for potential credential exposure.