fl[.]goumak[.]cc

Analysis of fl.goumak.cc shows a newly registered internet resource that is actively being used for generic phishing. The domain was created on 12 June 2026 and is registered through Dominet (HK) Limited, a registrar based in Hong Kong. DNS resolution points to the IPv4 address 188.114.96.3; no additional IP aliases or CDN front‑ends were observed. The hosting environment for that address has not been publicly linked to a known benign service, and no SSL/TLS certificate details were supplied, leaving the transport security posture unverified.

Malware and URL reputation services have flagged the domain: VirusTotal reports 12 of 91 security vendors flagging it as malicious, indicating a moderate consensus of compromise. The domain is listed on one external security blocklist and is actively blocked by the PhishDestroy sinkhole, confirming that at least one anti‑phishing network has taken mitigation action. No Safe Browsing, Open Threat Exchange, or other reputation feeds were referenced in the available intelligence, and no page title or content snapshot has been released, so the visual or functional characteristics of the site remain unknown.

Given the registration age, the affiliation with a Hong‑Kong registrar, and the detection footprint, defenders should treat fl.goumak.cc as a high‑confidence phishing indicator. Recommended actions include adding the domain and its resolved IP address to outbound and inbound firewall deny lists, updating DNS filtering policies to block resolution, and monitoring network traffic for any attempted connections to 188.114.96.3. Incident response teams should also correlate internal logs for any authentication attempts that reference the domain, and threat‑intel platforms should be updated with the observed detection count and blocklist presence to improve collective detection capability.