fl[.]goumvce[.]cc

Analysis of fl.goumvce.cc shows an elevated‑risk generic phishing infrastructure that is currently active. The domain was registered on June 12, 2026 through Dominet (HK) Limited, a registrar frequently observed in malicious campaigns. DNS resolution points to the IPv4 address 172.67.197.230, an address associated with a large content‑delivery network that often hosts abuse‑related sites.

The domain appears on a single external blocklist and is specifically listed by PhishDestroy, confirming that at least one anti‑phishing service has taken mitigation action. VirusTotal reports that 13 of 91 scanning engines flag the domain, indicating a non‑trivial detection consensus across multiple security vendors. No additional intelligence such as page title, SSL certificate details, or HTTP response codes is presently available, so the exact payload or credential‑harvesting mechanisms remain unknown.

Defenders should immediately block fl.goumvce.cc at network perimeter devices and update host‑based allowlists to deny traffic to its hosting IP. Continuous monitoring of the IP 172.67.197.230 for new subdomains or related activity is advised, as the underlying CDN may be leveraged for further phishing deployments. Given the recent creation date and active detection signals, security teams should treat any inbound connections to this domain as hostile and consider broader threat‑intel sharing with peers to accelerate detection of related campaigns.