justdao[.]run

The domain justdao.run was registered on February 21, 2026 and is currently taken offline. Technical analysis shows that it resolves to the IP address 172.67.200.23, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. The domain is served by the Cloudflare nameservers bingo.ns.cloudflare.com and curt.ns.cloudflare.com, and presents an SSL certificate identified as WE1. Threat intelligence indicates that the site was used to impersonate Coinbase as part of a crypto‑related brand‑impersonation campaign.

The page title observed during the short window of activity was “JustLend DAO | JustLend DAO is the first official lending platform on TRON where users…”, suggesting a focus on TRON‑based lending services rather than legitimate Coinbase functionality. Detection footprints include listings on three security blocklists and active blocking by PhishDestroy, MetaMask, and SEAL. VirusTotal scans recorded two positive detections out of ninety‑five participating scanners, reinforcing the malicious classification. The risk rating is elevated, reflecting the combination of brand impersonation, cryptocurrency focus, and the presence on multiple defensive feeds.

Defenders should continue to block the domain at network perimeter devices, update URL filtering policies to include the observed IP and DNS entries, and consider adding the domain to internal threat‑intelligence feeds. Monitoring for any re‑registration of the same second‑level domain or similar look‑alike names is advised, as actors often recycle infrastructure after takedown. Since the site is offline, incident response can focus on containment of any previously harvested credentials or funds and on user awareness messaging that warns of unsolicited Coinbase‑related requests tied to TRON lending terminology.