paranaweb[.]lovable[.]app

paranaweb.lovable.app has been identified as a credential theft phishing domain, currently taken offline. The page titled "Pedágio Digital" was designed to impersonate a digital toll payment system, likely targeting Brazilian users. This domain was flagged by 11 of 95 VirusTotal security vendors, underscoring its malicious nature. Registered through Cloudflare, Inc. on March 06, 2026, the domain resolves to IP address 185.41.148.2 and appears on one security blocklist. PhishDestroy notes that while the domain is now offline, the low blocklist count suggests it may have evaded broader detection during its active period. The SSL certificate was issued by Google Trust Services / WE1, which is common for legitimate sites but here was misused for phishing.

Given the domain's recent creation and specific impersonation of a payment brand, users who may have entered credentials should change passwords immediately and enable multi-factor authentication. Organizations should block the domain and associated IP at the network level. PhishDestroy recommends monitoring for any similar domains using the “Pedágio Digital” title or Cloudflare registration patterns, as threat actors often spin up new variants quickly. Although the site is offline, vigilance is advised as cached or redirected versions may appear.