eng-legor-start-io[.]pages[.]dev

PhishDestroy identifies eng-legor-start-io.pages.dev as a crypto-drainer impersonating the official LEGO Start branding to trick users into connecting cryptocurrency wallets and approve malicious token approvals. The page masquerades as a ‘LEGO Start’ promotional site, leveraging Cloudflare Pages hosting and a Google-issued SSL certificate to appear legitimate at first glance. Security analysts observe that infected domains typically request wallet connections and execute ‘approve’ transactions to drain tokens directly from connected wallets without user confirmation once malicious smart-contract interactions are initiated.

This domain was flagged by PhishDestroy with 0 detections on VirusTotal out of 95 engines as of the latest scan, indicating it remains largely undetected by mainstream security tools. It is registered through Cloudflare, Inc., hosted on IP 172.66.46.235 (ASN 13335), and contains no active blocklist entries at this time—though risk remains active and evolving. The use of a Google Trust Services certificate adds a false sense of security, typical of modern crypto phishing campaigns that rely on misplaced trust in SSL and reputable CDNs.

Users who have visited eng-legor-start-io.pages.dev or interacted with it—especially by connecting a cryptocurrency wallet—must immediately revoke any token approvals via blockchain explorers like Etherscan or Sourcify and transfer remaining funds to a new, isolated wallet. Do not approve any pending transactions. Disconnect the domain from your wallet history, clear browser cache and cookies, and run a malware scan. Report the domain to PhishDestroy and relevant authorities. Remain cautious of similar LEGO-branded crypto promotions—verify authenticity via official channels only. Time-critical response is essential to prevent irreversible fund loss.