# PhishDestroy domain threat record: legoland.co.il Content language: English Canonical HTML report: https://phishdestroy.io/domain/legoland.co.il/ Machine-readable companion: https://phishdestroy.io/domain/legoland.co.il/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: observed active - First observed by PhishDestroy: 2026-09-02 16:40:08 UTC - Last availability or vendor check: 2026-10-22 10:29:36 UTC - Stored record updated: 2026-10-22 16:07:29 UTC - VirusTotal detections in the stored snapshot: 5/92 - Independent public blocklist matches in the stored snapshot: 0 - Google Safe Browsing stored result: no stored flag ## Stored classification - Targeted brand: Google ## Stored infrastructure - Observed IP address: 172.67.211.144 - Registrar in stored WHOIS data: Communigal Communication Ltd - Last stored HTTP status: 301 ## Evidence links - VirusTotal domain view: https://www.virustotal.com/gui/domain/legoland.co.il - Certificate Transparency search: https://crt.sh/?q=%25.legoland.co.il - Web Archive lookup: https://web.archive.org/web/*/https://legoland.co.il/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview legoland.co.il is an impersonation phishing site that borrows the Legoland name to appear as an official Israeli outlet for the theme park brand. Its likely targets are parents and visitors searching for tickets, discounts or reservations. PhishDestroy first flagged it on 2026-09-02, and on 2026-10-19 it was still online and serving a redirect. How the scam works Brand-impersonation pages like this use a familiar name and a convincing local domain to make a ticket offer or booking form look trustworthy. Visitors are pushed to enter personal details, account logins or payment card data for tickets that never arrive. The loss is usually money charged to the card plus personal information that can be reused in follow-up fraud. The page currently shows the title "Just a moment...", a generic browser-check screen rather than Legoland-branded content, while we classify the site as Legoland impersonation. Evidence Five of 92 engines on VirusTotal flagged the domain as of 2026-10-16: alphaMountain.ai, CRDF, Forcepoint ThreatSeeker, Gridinsoft and SOCRadar. That is a small share, but these vendors reached their verdicts independently, and a low count is common for brand-lookalike sites that have not yet been widely reported. The domain also appears in 4 AlienVault OTX threat pulses, so other researchers have linked it to malicious activity. It is listed on the PhishDestroy blocklist. Infrastructure The domain was registered through Communigal Communication Ltd, an Israeli registrar for .co.il names. A local-looking address is part of the pitch, because it helps the site pass as a domestic Legoland outlet. Traffic is fronted by Cloudflare, with the serving address geolocated to Canada. That setup hides the real origin server, so takedown requests have to go through the domain registrar and Cloudflare. What to do Do not buy tickets or enter details on legoland.co.il. Book only through Legoland's official channels. If you paid there, call your card issuer now to dispute the charge and ask for a replacement card. If you entered a password, change it everywhere you reuse it and turn on two-factor authentication. Expect follow-up phishing that uses the details you gave, and treat calls or emails about refunds with suspicion. Security teams should block the domain at DNS and web proxies and add it to email filtering. Abuse reports should go to Communigal Communication Ltd and to Cloudflare. Useful links VirusTotal report: https://www.virustotal.com/gui/domain/legoland.co.il Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=legoland.co.il Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-19 09:51:44 UTC ## Stored page captures - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/fe1f0e23-7d34-4f72-8379-4341d024cacd.png Captured: 2026-09-13 14:14:30 UTC Source report: https://radar.cloudflare.com/scan/fe1f0e23-7d34-4f72-8379-4341d024cacd SHA-256: dbb2948c2aba8611a4449e6748a6e11448057819696ad075a062b441d43b699a ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "cf": { "v": 1, "fetched_at": "2026-10-21T00:27:15Z", "uuid": "fe1f0e23-7d34-4f72-8379-4341d024cacd", "scanned_at": "2026-09-13T14:14:30Z", "final_url": "https://www.legoland.co.il/", "status": 200, "redirected": "subdomain", "history": [ { "url": "https://legoland.co.il/", "status": 301 }, { "url": "https://www.legoland.co.il/", "status": 200 } ], "dom_hash": "2a8bcd5f150ff82e8865b851f0c3c178f7c82d5216c5a1463edeaa542249ac63", "doc_hash": "e7f84e5defa152ae3001f18a2e66095c911cc21b696ee60e57443b53568cd2e5", "domain_risks": [ "Lifestyle", "Society & Lifestyle" ], "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "legoland.co.il", "type": "A", "value": "104.21.67.23" }, { "name": "legoland.co.il", "type": "A", "value": "172.67.211.144" }, { "name": "legoland.co.il", "type": "AAAA", "value": "2606:4700:3033::ac43:d390" }, { "name": "legoland.co.il", "type": "AAAA", "value": "2606:4700:3035::6815:4317" }, { "name": "www.legoland.co.il", "type": "A", "value": "172.67.211.144" }, { "name": "www.legoland.co.il", "type": "A", "value": "104.21.67.23" }, { "name": "www.legoland.co.il", "type": "AAAA", "value": "2606:4700:3033::ac43:d390" }, { "name": "www.legoland.co.il", "type": "AAAA", "value": "2606:4700:3035::6815:4317" } ], "dnssec_valid": false, "ip": "172.67.211.144", "whois": { "registrar": "Communigal Communication Ltd", "nameservers": [ "ram.ns.cloudflare.com", "walk.ns.cloudflare.com" ] } }, "vt": { "v": 1, "fetched_at": "2026-10-22T13:26:44Z", "analysis_at": "2026-10-16T02:01:27Z", "stats": { "timeout": 0, "harmless": 54, "malicious": 4, "suspicious": 1, "undetected": 33 }, "detections": { "CRDF": "malicious", "SOCRadar": "phishing", "Gridinsoft": "suspicious", "alphaMountain.ai": "phishing", "Forcepoint ThreatSeeker": "phishing" }, "reputation": 0, "categories": { "alphaMountain.ai": "Phishing (alphaMountain.ai)", "Forcepoint ThreatSeeker": "phishing and other frauds. travel" }, "first_seen": "2024-05-08T01:43:30Z", "dns": [ { "ttl": 14400, "type": "MX", "value": "_dc-mx.20d6c3b1e482.legoland.co.il", "priority": 0 }, { "ttl": 21600, "type": "NS", "value": "ram.ns.cloudflare.com" }, { "ttl": 300, "type": "A", "value": "172.67.211.144" }, { "ttl": 1800, "type": "SOA", "rname": "dns.cloudflare.com", "value": "ram.ns.cloudflare.com" }, { "ttl": 300, "type": "TXT", "value": "google-site-verification=GtyUGiDCME-dV-ZLIzoLUxaN_QUevLBb2l7GpoB1_P4" }, { "ttl": 300, "type": "AAAA", "value": "2606:4700:3035::6815:4317" }, { "ttl": 300, "type": "TXT", "value": "v=spf1 ip4:185.56.74.69 ip4:185.56.74.69 +a +mx ~all" }, { "ttl": 300, "type": "AAAA", "value": "2606:4700:3033::ac43:d390" }, { "ttl": 300, "type": "A", "value": "104.21.67.23" }, { "ttl": 21600, "type": "NS", "value": "walk.ns.cloudflare.com" } ], "dns_at": "2026-10-16T02:01:51Z", "jarm": "27d40d40d00040d1dc42d43d00041d6183ff1bfae51ebd88d70384363d525c", "cert": { "san": [ "legoland.co.il", "*.legoland.co.il" ], "issuer": "Google Trust Services / WE1", "serial": "284e2e956ab442390d8db2451bbd8cd3", "sha256": "d9e2f1ec754fe185fa04a7ad2bcb682e74c99468518dd2495e111e80639703dd", "subject": "legoland.co.il", "valid_to": "2026-11-26T10:10:19Z", "valid_from": "2026-08-28T09:12:37Z" }, "whois": { "dnssec": "unsigned" } } } ```