ct[.]goumo[.]cc

This domain, ct.goumo.cc, was registered on June 12, 2026, through Dominet (HK) Limited and is currently active as a generic phishing site. Infrastructure analysis reveals it resolves to the IP address 188.114.96.3, which is associated with Cloudflare services, a common pattern observed in phishing campaigns to obscure hosting origins and evade takedowns. As of July 29, 2026, the domain is flagged by 14 of 91 security vendors on VirusTotal and appears on one security blocklist, indicating elevated risk.

The detection by PhishDestroy further corroborates its classification as malicious. The specific content or targeted brand of the phishing site is not yet confirmed, as no page title, brand target, or scam type details are available in the current intelligence. Defenders should treat this domain as a potential credential-harvesting portal or fraudulent login page until further analysis is conducted.

The registrar, Dominet (HK) Limited, has been previously linked to other phishing domains, though no direct attribution to a specific threat actor or campaign is established at this time. Recommended actions include blocking the domain and its resolving IP at the network perimeter, monitoring for connections to 188.114.96.3, and submitting additional samples to threat intelligence platforms to refine detection coverage. Given the domain’s recent registration and active status, defenders should prioritize this domain for further investigation, particularly if internal logs indicate user interaction with it.