heroiplataformavibratriaaparelho[.]lovable[.]app

The domain heroiplataformavibratriaaparelho.lovable.app is currently active and serves a generic phishing campaign as indicated by its page title referencing a vibratory platform product. Infrastructure analysis shows the domain resolves to IP address 185.41.148.1 and is hosted behind Cloudflare, with HTTP responses issuing a 302 redirect. Transport security is enforced via HSTS, and the TLS certificate is issued by Google Trust Services under the WE1 hierarchy, suggesting a valid SSL chain despite the malicious intent. The registrar listed is Lovable, and no authoritative nameservers were discovered, implying either a misconfiguration or intentional omission of NS records.

VirusTotal scans report that seven out of ninety‑one security vendors flag the domain, reinforcing the suspicion of malicious use, and the domain appears on one external blocklist. Additionally, the site is already blocked by the PhishDestroy consortium, confirming external recognition of its threat. Uncertainties remain regarding the precise hosting provider, ASN, and geographic attribution beyond the generic "SE (Lovable APP)" label, as well as the full scope of victim targeting.

Defenders should immediately add the domain and its resolving IP to network deny lists, enforce URL filtering to block any HTTP requests to the host, and monitor for similar Cloudflare‑proxied redirects that return a 302 status. Incident response teams should also update threat‑intelligence feeds with the observed indicators, including the SSL issuer, HSTS presence, and the specific page title, to improve detection of copycat campaigns. Continuous re‑evaluation is advised, as the active status and limited blocklist coverage suggest the campaign may evolve or relocate to new infrastructure.