Is dao-justlend.com a scam? TrustSniffer's high-risk assessment: 0/100

Security Alert

Fortinet, Kaspersky, Sophos flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

This website operates under the domain dao-justlend.com, a recently registered address whose name pairs "dao" with "justlend", wording typical of decentralised-finance lending protocols. When analysed, the only content served to automated visitors was a security interstitial headed as a suspected-phishing warning, with no readable product, company or service information beyond it. Its apparent purpose is therefore unconfirmed, though the naming suggests it positions itself as a crypto lending or governance portal.

Scam/Impersonation Risk

Contradictory signals are present and decisive. The domain is blacklisted: multiple established security vendors independently classify it as malicious, including several top-tier vendors, and the external reputation picture is consistent across sources. The domain was registered only a few months ago, which is typical of short-lived infrastructure used for phishing against DeFi users. Its name also imitates the naming conventions of a recognised lending-protocol brand. The analysis did not independently confirm impersonation of a specific brand, so the name is a contextual concern rather than a proven finding. Behavioural testing showed unusually heavy outbound request traffic relative to the site's own content, a very large volume of page-structure changes after interaction, and a high rate of script errors. No wallet-connection, clipboard-tampering or hidden-form activity was recorded in the sessions that ran. That absence does not offset the reputation findings, because the real page content sat behind a bot challenge. No identity contradiction between legal entities was observed. Evidence:

• Homepage: the page served to the analysis was a security interstitial titled as a suspected phishing site, and the capture was refused with a 403 status.
• Reputation: 19 engines flagged the domain as malicious and 3 as suspicious, including three tier-one vendors, and the external blacklist condition was confirmed.
• Domain provenance: registered 2026-07-31 (~0.22 years, about 82 days old), with a one-year term to 2027-07-31 through the registrar Atak Domain.
• Behaviour: across 3 sandbox runs, 54 external XHR/fetch calls, 7 external POST requests and 17 console errors were logged, with 1,518 DOM mutations after interaction.

Regulatory Verification Notes

No licensing, registration or corporate-identity disclosure could be assessed, because the only content observed was the interstitial rather than a legal, about or terms page. The absence of any observable regulatory standing is secondary here, since the reputational findings are the operative concern. No third-party broker or regulator record was matched to this domain. The domain's registrant fields carry only generic administrative placeholders, which establishes no connection to any real-world operator or to the protocol brand the name evokes. Technical hygiene is basic: the transport encryption is valid, but it only confirms an encrypted connection, not who operates the site. Evidence:

• Registration record: registrant shown as "Domain Administrator" for the organisation "Registrant of dao-justlend.com", which links the domain to no verifiable entity.
• Hosting: served from AS13335 (Cloudflare, Inc., US).
• Transport security: TLS certificate issued by WE1 at domain-validation (DV) level, valid to 2026-12-27.

What to Verify Next

Anyone who received this address through a message, advertisement or social post should trace it back to the official channel of the protocol it appears to reference, using the project's documented website reached independently rather than via the received link. Official announcement channels and community pages should be checked to see whether they list this exact domain. If a wallet connection or token approval was already made on this address, the wallet's approval list should be reviewed and any permissions revoked. Official support or contact channels should be confirmed through an independent route. Evidence:

• Domain naming: the registered name is a hyphenated combination of a governance term and a lending-brand term, which is a common lookalike construction.
• Domain age: the registration is only a few months old, so no long-standing public record of legitimate use exists.
• Browser warning: the interstitial itself flags the domain as suspected phishing, so access attempts may be blocked by protective services.

Summary Verdict

The available evidence places this domain in a clearly high-risk category. Confirmed negative reputation from independent security sources, together with a very recent registration and an unverified identity, outweighs the basic technical hygiene present. The site cannot be treated as a legitimate or established service on the current evidence.

Infrastructure Integrity

The site sits behind Cloudflare's CDN and web application firewall, and every observed address is a Cloudflare edge address, so the origin server is not visible. This is a mitigating factor only: it adds no legitimacy and indicates nothing about the operator. Edge-only visibility also prevents independent verification of where the content is actually hosted, and it can conceal rapid content changes. The network profile is also consistent with a young domain with few subdomains, an unconfirmed heuristic that fits the reputation findings but does not add to them.

Closing Assessment

This site should not be used for any sensitive purpose. Logging in, entering credentials, connecting a wallet, approving token permissions or making any payment or deposit should be avoided entirely. Any visit should be limited to passive, non-interactive viewing from an isolated environment, and the address should be reported to the relevant security teams or platforms if it was received unsolicited.