portal[.]ct-gn[.]cc

The domain portal.ct-gn.cc was registered on September 27, 2025 through Dominet (HK) Limited, a registrar known to host a mix of legitimate and illicit sites. It resolves to the IP address 104.21.51.161, an address that is commonly associated with shared hosting services and content‑delivery networks, suggesting the operator may be leveraging a high‑availability infrastructure to increase uptime. The domain is currently listed as active and has been classified with an elevated risk level.

Detection evidence shows that 12 out of 91 security vendors on VirusTotal have flagged the domain, indicating that multiple independent scanners have observed malicious characteristics. Additionally, the domain appears on a single security blocklist and has been explicitly blocked by the PhishDestroy sinkhole, confirming that at least one coordinated anti‑phishing effort has taken action against it. No public information is available regarding the site’s SSL configuration, HTTP response codes, or page title, and there is no evidence of a specific brand being impersonated.

Consequently, the precise content and credential‑harvesting mechanisms remain unverified, but the aggregate technical signals—recent creation, use of a high‑profile hosting IP, multiple vendor detections, and blocklist inclusion—strongly indicate a phishing operation. Defenders should add portal.ct-gn.cc to URL filtering, DNS blocklists, and intrusion‑prevention signatures, monitor outbound connections to the associated IP for anomalous traffic, and consider sinkholing the domain to disrupt further victim exposure. Continuous re‑evaluation is advised as additional telemetry, such as page content or SSL details, becomes available.