hub-en-legor-start[.]pages[.]dev

PhishDestroy identifies a currently active phishing campaign hosted at hub-en-legor-start.pages.dev, impersonating LEGO Star Wars digital content. The domain has been classified as a generic phishing vector with an under-investigation risk level, indicating active abuse in credential harvesting or malware distribution schemes. This campaign exploits LEGO's brand recognition to deceive users into entering sensitive information or downloading malicious payloads under the guise of exclusive Star Wars content from the toy manufacturer.

This domain resolves to IP address 188.114.97.3 and is registered through Cloudflare, Inc. The SSL certificate is issued by Google Trust Services, providing a false appearance of legitimacy. As of current analysis, the domain remains undetected by VirusTotal scanning infrastructure, with 0 detections reported across 95 participating vendors. The domain is part of Cloudflare Pages hosting infrastructure, which increases operational opacity and complicates takedown efforts. Despite the absence of blocklist entries and low detection rate, the domain shows high-risk operational characteristics due to its active status and thematic alignment with a major consumer brand.

The ongoing investigation confirms this domain is actively engaged in distributing phishing content. Users are advised to avoid interaction with hub-en-legor-start.pages.dev and report any associated malicious activity. Security teams should monitor network traffic for connections to 188.114.97.3 and apply blocking policies at the DNS and firewall levels. Immediate reporting to LEGO’s abuse channels and Cloudflare’s phishing abuse team is recommended to accelerate domain takedown and prevent further victimization. Exercise heightened caution when receiving links or attachments referencing LEGO Star Wars promotions or exclusive digital content.