justlend[.]io

Analysis of justlend.io shows the domain was created on February 21, 2026 and registered through Web Commerce Communications Limited. The site resolves to IP address 104.21.2.93, which is hosted by Cloudflare (AS13335) and geolocated in the United States. The domain uses Cloudflare’s default nameservers lara.ns.cloudflare.com and ruben.ns.cloudflare.com, but no SSL certificate is present, indicating that any HTTP connections would be unencrypted. The page title returned from the site, "Staked TRX - JustLend DAO," directly references the JustLend brand and aligns with the reported scam type of wallet/seed phishing, suggesting an attempt to harvest cryptocurrency wallet seeds from unsuspecting users.

Reputation metrics are extremely low: Gridinsoft assigns a trust score of 0 / 100, the domain is listed on a single security blocklist, and PhishDestroy has flagged it as malicious. VirusTotal scanning recorded detections from 2 of 93 security vendors, reinforcing the malicious classification. The site is currently offline, but the combination of brand impersonation, absent TLS, low trust score, and vendor detections provides strong evidence of a phishing operation targeting JustLend users.

Defenders should block the domain and its associated IP at perimeter firewalls, add the host to internal deny lists, and monitor for any re‑registration attempts using the same registrar or Cloudflare nameservers. Network monitoring should include inspection for HTTP traffic lacking SSL to this IP, as the lack of encryption may be used to exfiltrate credential material. While the exact page content has not been captured, the available indicators are sufficient to treat justlend.io as a confirmed wallet seed phishing threat and to apply proactive mitigation measures.