justlend[.]justdao[.]sbs

This domain, justlend.justdao.sbs, is flagged as a generic phishing site targeting users of the JustLend decentralized autonomous organization (DAO), a legitimate lending platform on the TRON blockchain. Analysis indicates the site mimics the official JustLend DAO interface, presenting itself as a platform where users can borrow, lend, deposit assets, and earn interest. The page title explicitly states: 'JustLend DAO | JustLend DAO is the first official lending platform on TRON where users can borrow, lend, deposit assets and earn interests.' No specific drainer kit has been conclusively identified, but the infrastructure aligns with credential harvesting and cryptocurrency wallet compromise tactics commonly used in DeFi phishing schemes. Infrastructure analysis reveals the following technical indicators: the domain was registered on February 23, 2026, through NiceNIC International Group Co., Limited. It resolves to the IP address 188.114.96.3 and is currently detected by 7 out of 95 security vendors on VirusTotal. The domain appears on one security blocklist and is blocked by PhishDestroy. Detected technologies include Cloudflare, Cloudflare Browser Insights, and HTTP/3, suggesting the use of content delivery network services to obfuscate hosting origins and enhance site performance. As of the latest verification, justlend.justdao.sbs has been taken offline, reducing immediate exposure risk. However, the domain remains registered, and the infrastructure could be reactivated or repurposed. Users who interacted with the site prior to its takedown may still be at risk of credential compromise or unauthorized asset transfers. It is recommended to monitor associated wallet addresses for suspicious transactions, revoke any connected smart contract approvals, and conduct a security audit of devices used to access the domain. The elevated risk level persists due to the domain's recent activity and the potential for re-emergence under similar infrastructure.