pa[.]goume[.]click

This domain is classified as an elevated-risk credential phishing site operating under the subdomain pa.goume.click. Analysis indicates the infrastructure is designed to harvest authentication credentials through cloned login portals, likely targeting corporate or financial service users. The domain exhibits characteristics consistent with large-scale phishing campaigns, including rapid deployment and evasion techniques. Infrastructure analysis reveals the domain was registered on September 29, 2025, through GMO Internet, Inc. d/b/a Onamae.com. VirusTotal detection metrics show 14 out of 95 security vendors flagging the domain as malicious, with behavioral analysis confirming credential theft patterns. The domain appears on one security blocklist and was proactively taken offline after detection. No associated IP addresses or hosting providers have been confirmed in public threat feeds for this specific subdomain. Mitigation requires immediate blocking of pa.goume.click at DNS and web proxy layers. Network administrators should implement retrospective log analysis to identify any prior connections to the domain, particularly from endpoints exhibiting anomalous authentication attempts. Security teams are advised to monitor for secondary domains using the goume.click parent domain, as phishing operators frequently rotate subdomains. End-user training should emphasize verification of login portal URLs, especially for services mimicked by this campaign. Credential rotation is recommended for any accounts potentially exposed to this domain.