fl[.]goumvcz[.]cc

fl.goumvcz.cc was registered on 12 June 2026 through Dominet (HK) Limited. The domain resolves to the IPv4 address 188.114.97.3, an address that is currently listed on a public security blocklist and is actively blocked by the PhishDestroy service. VirusTotal has recorded detections from 13 of 91 scanning engines, indicating that a subset of security products consider the domain malicious. The presence on a blocklist and the multi‑engine detections suggest that the domain is being used for malicious campaigns, although the specific payload or targeted brand has not been publicly disclosed.

The limited age of the domain—less than two months at the time of this report—combined with the rapid appearance on a blocklist aligns with typical patterns observed for newly created phishing infrastructure. The hosting provider for the IP address is not directly identified in the supplied data, and no SSL certificate details, HTTP response codes, or page title information have been released, leaving the surface‑web characteristics of the site unknown. Consequently, analysts cannot confirm the exact content served, the credential‑harvesting technique employed, or any secondary command‑and‑control infrastructure that might be associated. Defenders should prioritize adding 188.114.97.3 to network‑level deny lists and ensure that any DNS resolvers employed by the organization block fl.goumvcz.cc.

Email security gateways should be updated to flag messages containing links to this domain, and endpoint protection solutions should be instructed to treat detections from the 13 reporting vendors as high confidence indicators of compromise. Continuous monitoring of VirusTotal and other reputation services for changes in detection counts is recommended, as additional detections may reveal the underlying phishing kit or targeted brand. Organizations that observe any authentication attempts to fl.goumvcz.