portaldeguiasdigitalbrl26[.]lovable[.]app

PhishDestroy identifies portaldeguiasdigitalbrl26.lovable.app as an active crypto drainer posing as a fraudulent login portal, designed to trick users into surrendering wallet credentials or authorizing malicious transactions. This domain is currently under investigation but remains unblocked by major security vendors, posing an elevated risk to cryptocurrency users engaging with fake login interfaces. The threat is operational and actively resolving, with no current detections on VirusTotal despite its malicious intent.

This domain resolves to IP 185.41.148.2 and is hosted on a subdomain of lovable.app, which uses a Google Trust Services SSL certificate. VirusTotal currently shows 1/95 detections as of the latest scan, indicating it has evaded mainstream antivirus and threat intelligence platforms. The domain was flagged under seed 94737d as a generic phishing campaign targeting unsuspecting users. It remains unlisted on major blocklists, including Google Safe Browsing, PhishTank, and OpenPhish, amplifying its deceptive reach. The SSL certificate, while issued by a trusted CA, is being abused to lend false legitimacy to the malicious login portal.

To mitigate exposure to this crypto drainer, users must avoid interacting with portaldeguiasdigitalbrl26.lovable.app entirely. Never enter wallet credentials, private keys, or sign blockchain transactions from links or popups originating from this domain. Verify any suspicious link using PhishDestroy’s real-time scanning tool before proceeding. If exposed, immediately revoke any unauthorized wallet connections via blockchain explorers or wallet interfaces, transfer remaining assets to a secure wallet, and scan devices for malware. Report the domain to PhishDestroy and relevant blocklists to prevent further victimization.