goumvcd[.]cc

The domain goumvcd.cc was registered on 12 June 2026 through Dominet (HK) Limited and began resolving to the IP address 172.67.164.251 shortly thereafter. Within weeks the domain appeared on a security blocklist and was subsequently added to the PhishDestroy blocklist, indicating that at least one protective service has identified malicious use. VirusTotal scans show that 15 of 91 antivirus and URL‑reputation engines currently flag the domain as malicious, providing independent confirmation of its threat status.

The hosting IP belongs to a large content‑delivery network, which is typical for fast‑flux or cloud‑based phishing infrastructure, but no further attribution to a specific autonomous system or country was disclosed. No public information on SSL certificate details, HTTP response codes, or page title has been released, and no Open Threat Exchange (OTX) or Google Safe Browsing entries were referenced in the available intelligence. As a result, the precise phishing campaign vector—such as targeted brand, credential‑stealing page, or lure technique—remains unknown.

Defenders should treat goumvcd.cc as a high‑confidence indicator of compromise: the domain should be added to network deny lists, DNS filtering policies, and endpoint URL‑blocking rules. Continuous monitoring of traffic to the associated IP is advised, and any observed connections should be logged for forensic correlation. Organizations using threat‑intel feeds should ensure that the domain is propagated to all security controls, and incident response teams should be prepared to investigate any credential submissions that may have been captured through this infrastructure.