attr[.]lovable[.]app

The domain attr.lovable.app is identified as a brand impersonation threat targeting individuals through a fraudulent investment scheme. Analysis confirms this domain operates as a fake crypto investment platform, specifically mimicking a legitimate financial service under the guise of 'Atlas Treasury & Trading Resources.' The current status of the domain is offline, though prior activity indicates a high-risk investment scam designed to deceive users into transferring funds or disclosing sensitive financial information. Infrastructure analysis reveals multiple technical indicators of malicious intent. The domain resolves to the IP address 185.158.133.2 and was flagged by 11 of 95 security vendors on VirusTotal. It was registered on February 21, 2026, through Cloudflare, Inc., and holds an SSL certificate issued by Google Trust Services (WE1). Google Safe Browsing explicitly classifies this domain as phishing, and it appears on three distinct security blocklists. The creation date, combined with the rapid flagging by multiple threat intelligence sources, suggests a deliberate and short-lived operation typical of financially motivated fraud campaigns. Given the domain’s current offline status, immediate interaction risks are mitigated; however, the infrastructure remains a latent threat. Users who may have engaged with this domain are advised to monitor financial accounts for unauthorized transactions, revoke any linked credentials, and report the incident to relevant cybersecurity authorities. Organizations should update internal blocklists to include the domain and its associated IP address (185.158.133.2) to prevent future access attempts. Continuous vigilance is recommended, as threat actors frequently repurpose domains or deploy similar infrastructure in subsequent campaigns.