goumvco[.]cc

goumvco.cc was registered on June 12, 2026 through Dominet (HK) Limited. The domain currently resolves to the IPv4 address 172.67.185.109. VirusTotal reports that 16 of 91 scanned security vendors flag the domain, indicating a moderate level of detection across the community. The domain appears on a single public blocklist and is specifically listed by the PhishDestroy service, confirming its classification as a malicious phishing resource. The campaign is labeled as generic phishing and assigned an elevated risk rating.

The domain remains active as of the report date, July 29, 2026. Analysis of the available telemetry suggests that the threat actor leveraged a recently created domain to host a phishing payload, relying on fast‑flux hosting or CDN services to obscure the underlying infrastructure. The limited blocklist presence may reflect a short operational window, but the multi‑vendor detections demonstrate that multiple security products have identified malicious activity associated with the host. No additional intelligence such as SSL certificate details, HTTP response codes, or page title is currently available. Defenders should prioritize immediate containment measures.

Adding goumvco.cc to outbound URL filtering rules, DNS sinkhole configurations, and endpoint web‑proxy block lists will prevent user access. Network security devices should also block traffic to 172.67.185.109, while monitoring for any subsequent resolution changes. Continuous re‑query of VirusTotal and other reputation services is advised to capture evolving detection counts. Organizations employing email security gateways should update phishing signatures to include the domain and its associated indicators of compromise. Ongoing threat‑intel sharing with peers will aid in tracking potential expansion of the campaign.