storevexa[.]com

This domain, storevexa.com, is actively flagged as a generic phishing site specializing in brand impersonation, specifically targeting the Lego brand. The page title explicitly displays 'Lego Store,' indicating an attempt to deceive users into believing they are interacting with an official Lego retail platform. No direct evidence of a crypto drainer kit or credential-harvesting framework was identified in initial scans, though the site’s infrastructure aligns with common phishing tactics used to capture payment details or personal information under false pretenses. Infrastructure analysis reveals the following technical indicators: the domain was registered on March 24, 2026, through Fewmoretaps OU operating under Trustname.com. It resolves to the IP address 188.114.96.3 and is currently detected by 2 out of 95 security vendors on VirusTotal. The domain appears on one security blocklist, though it remains unlisted in Google Safe Browsing (GSB) at the time of analysis. The SSL certificate is issued by Let’s Encrypt (serial number E7), a common choice for both legitimate and malicious sites due to its free and automated issuance process. The domain remains active and poses an elevated risk to users, particularly those seeking Lego products. No takedown or sinkholing actions have been observed, and the registrar has not responded to abuse reports as of this assessment. Users are advised to avoid interacting with the domain, verify the legitimacy of retail sites through official brand channels, and employ browser-based phishing protections. Organizations should update blocklists to include this domain and monitor for related infrastructure, such as the associated IP address, which may host additional malicious content.