fl[.]goumaf[.]cc

Analysis of fl.goumaf.cc indicates an active generic phishing infrastructure observed in mid‑2026. The domain was registered on 12 June 2026 through NameSilo, LLC and resolves to the IPv4 address 188.114.96.3. VirusTotal records show that 12 of 91 security vendors have flagged the domain, demonstrating a moderate detection consensus. The domain is currently listed on one public security blocklist and has been explicitly blocked by the PhishDestroy mitigation service.

No additional public reputation sources such as Google Safe Browsing, OTX, or SSL/TLS observations are available in the shared intelligence, and page‑level metadata such as title or HTTP response codes have not been disclosed. The limited exposure suggests that the threat actor is using a newly created domain to host phishing content, likely leveraging the short registration window to evade legacy blocklists. Defenders should immediately add fl.goumaf.cc and its resolving IP 188.114.96.3 to outbound and inbound deny lists across firewalls, proxy servers, and DNS filtering solutions. Continuous monitoring of DNS query logs for the domain and of traffic to the associated IP is recommended to detect any latent activity.

Organizations employing email security gateways should ensure that URLs pointing to this domain are quarantined or rewritten. Given the active block status by PhishDestroy, integrating that feed into existing security orchestration workflows will provide rapid remediation. Because the site’s internal structure and payload have not been publicly dissected, threat‑intel teams should consider sandboxing any retrieved content for deeper behavioral analysis while maintaining strict isolation. Ongoing collection of additional indicators, such as TLS certificates, HTTP headers, and page content, will improve attribution and enable more precise detection rules.