fl[.]goumag[.]cc

The domain fl.goumag.cc was registered on June 12, 2026 through Dominet (HK) Limited. It is presently active and has been assigned an elevated risk level for generic phishing. The domain is listed on a single security blocklist and is actively blocked by the PhishDestroy feed, indicating that at least one reputable anti‑phishing service has taken mitigation action. VirusTotal analysis shows that 14 of 91 security vendors have flagged the domain, providing a detection ratio of roughly 15 %.

This multi‑vendor corroboration suggests that the domain is being used for malicious credential‑harvesting or related phishing techniques, although the exact payload or target brand has not been disclosed in the available intelligence. Publicly observable infrastructure details such as hosting IP address, autonomous system number, country of operation, SSL certificate attributes, HTTP response codes, or page title are not present in the current dataset, leaving a gap in the technical footprint that could be used for precise sink‑hole or takedown actions. The lack of additional blocklist listings beyond the single entry also implies that the domain may be newly deployed or that broader community detection has not yet converged.

Defenders should immediately add fl.goumag.cc to URL filtering and DNS sink‑hole policies, monitor outbound traffic for connections to the domain, and consider proactive threat‑intel sharing with external partners. Continuous re‑evaluation of the domain’s detection status on VirusTotal and other reputation services is recommended, as additional vendor detections may appear as the campaign matures. Organizations that employ web‑proxy or secure web‑gateway solutions should ensure that the domain is denied at the perimeter to mitigate credential theft attempts.