flowrodovias-pag[.]lovable[.]app

The domain flowrodovias-pag.lovable.app is currently active and identified as a credential theft operation targeting users of digital toll payment systems. Analysis indicates the site impersonates legitimate toll collection services, specifically mimicking the "Pedágio Digital Free Flow" brand to deceive victims into submitting sensitive login credentials, payment details, or personal information. The infrastructure is designed to harvest data for financial fraud or account takeover attacks, with no legitimate affiliation to official toll operators. Infrastructure analysis reveals the domain was registered through Lovable, a platform often exploited for rapid deployment of phishing sites. It resolves to the IP address 185.41.148.1, which has been associated with prior malicious activity. The SSL certificate is issued by Google Trust Services, providing a false sense of security to visitors. As of the latest scan, 5 of 95 security vendors on VirusTotal have flagged the domain as malicious, a low detection rate that underscores the sophistication of the campaign. No creation date or additional blocklist data is currently available, but the domain's active status and targeted branding suggest ongoing operational intent. The domain remains active and poses a high risk to users unfamiliar with official toll payment portals. Organizations and individuals are advised to block access to this domain at the network level and report it to relevant abuse contacts. Users who may have interacted with the site should immediately reset credentials for any associated accounts, enable multi-factor authentication, and monitor financial statements for unauthorized activity. Security teams should treat this domain as part of a broader credential theft campaign and investigate for related indicators of compromise within their environments.