justlend-do-wallet[.]typedream[.]app

Analysis of the domain justlend-do-wallet.typedream.app, observed on 24 July 2026, indicates it was used in a crypto‑drainer campaign before being taken offline. The domain was registered on 21 February 2026 through Squarespace Domains II LLC and resolves to the IP address 104.21.37.85, which belongs to Cloudflare, Inc. (AS13335) and is geolocated in the United States. The TLS certificate is issued by Google Trust Services under the WE1 root, confirming the use of legitimate certificate infrastructure. An HTTP request to the host returns a 404 status code, indicating that the expected content is no longer available. According to VirusTotal, four of ninety‑three scanning engines flagged the domain as malicious, and the site appears on a single external blocklist.

Additional defensive services, including PhishDestroy, have listed the domain as blocked. Automated reputation scoring from Gridinsoft assigns a trust score of zero out of one hundred, reinforcing the malicious assessment. Technical footprints reveal a modern web stack: Node.js, React, Next.js, and multiple Google Cloud services such as Cloud Trace and Cloud CDN, combined with Cloudflare Browser Insights and the cdnjs library. These components are typical of legitimate sites but are also frequently leveraged by threat actors to host phishing or credential‑harvesting pages. The page title reported by crawlers is “Official Site® | JustLend DAO Wallet® | Getting started — …”, which aligns with the declared scam type of a crypto scam and suggests an attempt to impersonate a legitimate decentralized finance service.

Uncertainties remain regarding the exact payload delivered to victims, as the site returned a 404 response and no further content was captured. The limited number of detections (four vendors) and the presence on only one blocklist suggest that the campaign may have been short‑lived or that detection coverage is still evolving.