jusltend[.]org

The domain jusltend.org was registered on February 21, 2026 through NiceNIC International Group Co., Limited. Its registration date places it well within the current threat landscape, and the domain is presently active. The page title observed during analysis is "www.www.jusltend.org," indicating a possible typo‑squatting technique aimed at confusing users.

Infrastructure analysis shows that jusltend.org resolves to the IP address 172.67.137.100, which is hosted on the Cloudflare network and located in Canada. The domain is served by the nameservers amos.ns.cloudflare.com and tricia.ns.cloudflare.com, and the HTTP response is a 302 redirect. Detected technologies include Cloudflare services and HTTP/3, suggesting the use of a modern content delivery infrastructure to obscure the origin of the malicious payload.

Reputation data from multiple security vendors indicates that 8 out of 95 scans have flagged the domain as malicious. Independent reputation scoring provides a zero‑out‑of‑hundred trust rating. The domain appears on two public blocklists and is currently listed by two phishing‑monitoring feeds, reinforcing its classification as a high‑risk, active phishing infrastructure. The combination of a recent creation date, low trust score, and multiple detections aligns with the observed generic phishing behavior.

Defenders should add jusltend.org to network and endpoint denial lists and monitor DNS queries for the associated IP and nameserver patterns. Email gateways should enforce URL filtering for the domain and its redirect chain. Continuous threat‑intel monitoring is advised to capture any future shifts in the hosting or payload delivery mechanisms, and incident response teams should be prepared to block any related phishing communications targeting end users.