justlend-defi[.]org

justlend-defi.org was registered on July 29, 2026 through Fewmoretaps OU d/b/a Trustname.com. The domain resolves to the IPv4 address 186.2.175.35 and uses four name servers: ares.trustname.com, zeus.trustname.com, ns1.anycastdns.cz and ns2.anycastdns.cz. It has been added to a single security blocklist and is currently listed as blocked by PhishDestroy. VirusTotal reports that the domain has been scanned by 91 AV engines, none of which have raised a detection; this result should not be interpreted as a safety assurance.

The threat classification supplied in the intelligence is "crypto drainer," indicating that the site is intended to solicit cryptocurrency deposits and then exfiltrate the funds. No public SSL certificate information, HTTP response codes, or page title data are available, so the surface‑level behavior of the web server cannot be verified at this time. The lack of additional blocklist entries or reputation scores suggests that the infrastructure is newly deployed, consistent with the recent registration date. Defenders should treat the domain as active and potentially malicious, especially in environments that process cryptocurrency transactions.

Recommended actions include adding the domain and its resolved IP address to deny lists, monitoring DNS queries for lookups to ares.trustname.com, zeus.trustname.com, ns1.anycastdns.cz and ns2.anycastdns.cz, and enabling outbound traffic controls that block unauthorized transfers to addresses associated with the domain. Continuous re‑scan of the domain with multiple AV engines and periodic checks against emerging blocklists are advised to capture any future detections. Until further forensic evidence is obtained, the safest posture is to assume the site will attempt to drain crypto assets and to enforce strict network segmentation for wallet services.