stake-justlend[.]org

The domain stake-justlend.org was registered through Web Commerce Communications Limited on August 2, 2025. It resolves to the Cloudflare address 104.18.6.36, which is advertised as belonging to AS13335 (Cloudflare, Inc.) and geolocated to the United States. The authoritative nameservers leonard.ns.cloudflare.com and raegan.ns.cloudflare.com confirm that the domain is hosted behind Cloudflare’s edge network. No TLS certificate is presented, meaning the site would have been served over plain HTTP if it were reachable. The page title observed during the brief crawl was “The Official Trump Meme | GetTrumpMemes”, a content label that bears no relation to the claimed impersonation of Apple, suggesting the operator may have reused a generic meme landing page to host the malicious payload.

Infrastructure analysis shows a Gridinsoft trust score of 0 out of 100, indicating an extremely low reputation. VirusTotal recorded a single detection out of ninety‑five scanning engines, confirming that at least one vendor flagged the domain as malicious. The domain is listed on one public security blocklist and has been actively blocked by the PhishDestroy service. Its current status is offline, and no SSL certificate is available, which limits immediate network interaction but does not preclude future re‑activation.

Defenders should add stake-justlend.org to internal deny‑list policies and ensure that any outbound traffic to the associated Cloudflare IP (104.18.6.36) is monitored for anomalous requests. Because the domain uses a widely shared CDN, threat‑hunters should also watch for other newly registered domains that resolve to the same IP range or that share the same registrar, as attackers frequently rotate domains while retaining the same hosting provider. Continuous feed updates from PhishDestroy and other blocklist sources are recommended to capture any re‑emergence.