strtportal[.]ghost[.]io

strtportal.ghost.io was first observed on July 12, 2026 and is classified as a high‑risk generic phishing infrastructure. The domain was registered on February 21, 2026 through the Ghost registrar and remains active as of the reporting date. The sole page title returned by HTTP requests is “Site unavailable”, indicating that the content has not been publicly disclosed. The authoritative name server for the domain is ghost.map.fastly.net, and HTTP queries return a 301 redirect. DNS resolution resolves the name to the IPv6 address 2a04:4e42:400::775, which belongs to AS54113 Fastly, Inc. and is geolocated to the United States. The site presents a valid Let's Encrypt R12 certificate and the underlying web stack reports Varnish, Nginx and OpenResty components. Reputation scoring shows a Gridinsoft trust value of 0 out of 100, and VirusTotal records a single positive detection out of 95 scanned security vendors. The domain appears on one public blocklist and is actively blocked by the PhishDestroy mitigation service. These indicators collectively reinforce the high‑risk assessment despite the limited number of vendor flags. Defenders should immediately add strtportal.ghost.io and its resolved IPv6 address to deny‑list controls at DNS and firewall layers. Continuous monitoring of the Fastly edge host for any change in HTTP response codes or page content is recommended, as the current “Site unavailable” title provides no insight into the phishing payload. Correlating internal logs for any connections to the domain or its IP can help identify compromised endpoints, and threat‑intel feeds should be updated to reflect the confirmed phishing status.