trise-srv2[.]pages[.]dev

This domain, trise-srv2.pages.dev, is flagged as an active phishing portal designed to harvest credentials through a fake login interface impersonating topenrega.lt, a legitimate Lithuanian government service portal. Analysis indicates the threat type is a generic phishing scheme with no direct evidence of a crypto drainer kit or advanced malware payloads. The page title explicitly displays topenrega.lt, suggesting an attempt to deceive users into entering sensitive login credentials for unauthorized access or identity theft purposes.

Infrastructure analysis reveals multiple high-confidence technical indicators. The domain resolves to IP address 188.114.97.3, hosted on Cloudflare’s network (AS13335), a common tactic to obscure origin servers. It was registered through Cloudflare, Inc. on June 20, 2025, indicating recent deployment. VirusTotal reports 11 out of 95 security vendors flagging the domain as malicious, while Google Safe Browsing has not yet listed it. The domain appears on one security blocklist, specifically PhishDestroy, and uses an SSL certificate issued by Google Trust Services (WE1), which may lend a false sense of legitimacy to unsuspecting users.

Current status remains active, with no evidence of takedown or mitigation at the infrastructure level. The domain continues to resolve and serve content, posing an ongoing risk to users who may encounter it through phishing emails, compromised advertisements, or social engineering campaigns. Immediate response actions should include blocking the domain at the network level, reporting to additional threat intelligence platforms, and alerting the impersonated brand (topenrega.lt) for potential legal or abuse team intervention. Despite Cloudflare’s hosting, the remaining risk is classified as high due to the domain’s recent creation, active status, and direct targeting of government service credentials.