fl[.]goumvch[.]cc

Analysis of the domain fl.goumvch.cc, registered on June 12, 2026, through Dominet (HK) Limited, indicates active phishing infrastructure as of July 29, 2026. The domain currently resolves to the IP address 172.67.197.248 and has been flagged by 15 of 91 security vendors on VirusTotal, though the specific detection categories remain unconfirmed. It appears on at least one security blocklist and is actively blocked by PhishDestroy, suggesting ongoing malicious use targeting credentials or sensitive information. Infrastructure review shows the domain was created approximately six weeks prior to this report, a timeframe consistent with short-lived phishing campaigns.

The use of a Hong Kong-based registrar may align with patterns observed in domains seeking to evade takedowns or jurisdictional scrutiny. No SSL certificate details, HTTP response codes, or page titles are available at this time, limiting assessment of the exact phishing lure or targeted brand. The absence of additional context—such as associated ASN, hosting provider, or scam kit—prevents further attribution. Defenders are advised to treat this domain as high-risk for credential harvesting or account compromise.

Network-level blocking of 172.67.197.248 and fl.goumvch.cc is recommended for endpoints and email gateways. Organizations should monitor for connections to this infrastructure, particularly from users who may have interacted with unsolicited login prompts or password-reset requests. Given the domain’s recent creation and active blocklist status, continued monitoring for related subdomains or IP shifts is warranted.