fl[.]goumv[.]cc

The domain fl.goumv.cc was registered through Dominet (HK) Limited and first appeared on the DNS on June 12, 2026. Within a short period it has been added to a public security blocklist and is actively blocked by the PhishDestroy service. VirusTotal analysis shows that 15 out of 91 security vendors have flagged the domain as malicious, indicating a moderate level of consensus among detection engines.

The domain is classified as a generic phishing infrastructure and is currently listed as active with an elevated risk rating. No additional telemetry on hosting IP address, SSL certificate details, HTTP response codes, or page title has been released in the available intelligence, so those attributes remain unverified at this time. Defenders should prioritize adding fl.goumv.cc to network and endpoint deny lists, enforce DNS sink‑hole rules for the domain, and monitor for any related C2 traffic patterns.

Continuous re‑scanning of the domain on multi‑engine platforms such as VirusTotal is advised to capture any changes in detection status. Organizations that employ email filtering should ensure that URLs pointing to this domain are quarantined, and users should be educated to avoid clicking unsolicited links that resolve to fl.goumv.cc. Ongoing collection of hosting and certificate data will improve attribution and mitigation efforts as the campaign evolves.