justlend-app[.]org

The domain www.justlend-app.org was registered on March 22, 2026 through Squarespace Domains LLC and resolves to IP address 64.29.17.1, which is hosted by Vercel, Inc. in the United States. The site presents a TLS certificate issued by Let’s Encrypt (R12) and returns HTTP status 200, with Vercel and HSTS identified among the underlying technologies. The page title observed, "JustLend DAO | Official DeFi Protocol on TRON – justlend-app.org," suggests an attempt to masquerade as the legitimate JustLend DAO DeFi service. VirusTotal analysis shows 12 of 94 security vendors flag the domain, and AlienVault OTX lists it in two threat‑intelligence pulses. The domain appears on a single security blocklist and has been specifically blocked by PhishDestroy, while Gridinsoft assigns a trust score of 0 out of 100, reinforcing the high‑risk assessment. Although the exact content of the site has not been examined, the combination of recent registration, Vercel hosting, TLS configuration, and multiple external detections indicates an active generic phishing infrastructure targeting cryptocurrency users. Defenders should add the domain and its resolving IP to network deny lists, monitor DNS queries for the associated nameservers (ns-cloud-a4.googledomains.com, ns-cloud-a1.googledomains.com, ns-cloud-a3...), and consider sinkholing traffic to disrupt potential credential harvesting. Continuous threat‑intel correlation is advised to capture any evolving indicators of compromise related to this infrastructure.