justlend-staking[.]pages[.]dev

This domain is flagged as a high-risk brand impersonation threat targeting Coingecko users. Analysis indicates the site justlend-staking.pages.dev is designed to harvest cryptocurrency wallet credentials through deceptive staking interfaces, presenting itself under the false pretense of the legitimate Coingecko platform. The domain's infrastructure and content closely mimic official cryptocurrency service pages, increasing the likelihood of successful social engineering attacks against unsuspecting users seeking staking opportunities.

Infrastructure analysis reveals the domain was registered on July 29, 2025, through Cloudflare, Inc., and currently resolves to the IP address 104.21.112.1, hosted on Cloudflare's network (AS13335). Detection metrics show minimal coverage, with only 1 out of 95 security vendors flagging the domain on VirusTotal. The domain appears on a single security blocklist, specifically PhishDestroy, and maintains an active SSL certificate issued by Cloudflare TLS Issuing ECC CA 3. The page title, JustLend, further deviates from the expected Coingecko branding, suggesting an attempt to mislead users through unrelated cryptocurrency terminology.

To mitigate risks associated with this brand impersonation threat, users should avoid interacting with justlend-staking.pages.dev and verify all cryptocurrency-related domains through official sources. Organizations should update web filtering rules to block the domain and its resolving IP (104.21.112.1) at the network level. Security teams are advised to monitor for additional domains registered through Cloudflare with similar naming patterns, particularly those combining cryptocurrency terms with staking or yield-related keywords. Endpoint protection should be configured to detect and prevent access to newly registered domains impersonating financial platforms, with particular attention to those created within the last 30 days.