applebillingsupport[.]lovable[.]app

This domain, applebillingsupport.lovable.app, is identified as an elevated-risk brand impersonation threat targeting Apple users. Analysis indicates the infrastructure was designed to mimic legitimate Apple billing portals, likely for credential theft or financial fraud. The domain does not exhibit direct indicators of a crypto drainer kit but aligns with patterns observed in large-scale credential harvesting campaigns targeting consumer technology brands. Infrastructure analysis reveals the following technical indicators: the domain resolves to IP address 185.158.133.2, registered through Cloudflare, Inc. on February 21, 2026. VirusTotal detection metrics show 12 out of 95 security vendors flagging the domain as malicious. The domain appears on one security blocklist and is currently offline, displaying a takedown notice page titled 'Website Takedown Notice - Lovable Trust.' The SSL certificate is issued by Google Trust Services (WE1), and the IP geolocates to Poland under AS13335, Cloudflare’s autonomous system. The domain’s current offline status suggests successful mitigation, though residual risk remains for users who may have interacted with the site prior to takedown. The presence of a takedown notice does not eliminate the possibility of cached pages or secondary distribution channels. Organizations should monitor for related domains using similar naming conventions (e.g., 'applebilling' or 'support') and validate any user-reported interactions with this infrastructure. End users are advised to verify domain authenticity through official brand channels and report suspicious activity to relevant security teams.