fl[.]goumva[.]cc

Analysis conducted on July 29, 2026 identifies fl.goumva.cc as an active phishing domain targeting user credentials. The domain was registered on June 12, 2026 through Dominet (HK) Limited and currently resolves to IP address 172.67.153.207. At the time of assessment, 15 of 91 security vendors on VirusTotal flagged the domain as malicious, and it appears on one public blocklist monitored by PhishDestroy.

No specific brand or service impersonation is confirmed in the available metadata; the exact content of the phishing page remains unanalysed. Infrastructure analysis reveals the use of Cloudflare IP space, a common pattern among phishing operators seeking to obscure hosting origins and evade IP-based blocking. The registrar, Dominet (HK) Limited, has been previously associated with domains involved in fraudulent activity, though no direct attribution to a known threat actor or phishing kit is established.

Defenders are advised to treat this domain as elevated risk and implement blocking at the DNS or network level. Security teams should monitor for connections to 172.67.153.207 and review logs for any user interaction with fl.goumva.cc. Given the domain's recent registration and detection by multiple security vendors, continued monitoring for new detections or changes in infrastructure is recommended.