Is justlend-defi.org a scam? TrustSniffer's high-risk assessment: 0/100

Security Alert

Fortinet, Kaspersky, Sophos flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

The website presents itself as a decentralized-finance lending service, with a homepage titled around earning interest and borrowing TRX, USDT and USDC. Its apparent purpose is to draw visitors into depositing crypto-assets for yield or taking collateralised loans through an on-page interface. The domain is a hyphenated ".org" name that pairs a lending-protocol brand with the generic term "defi".

Scam/Impersonation Risk

Contradictory signals are present and convergent. Multiple major security vendors currently flag the domain as malicious or suspicious, enough to constitute a confirmed blacklist listing. A separate external blacklist source corroborates it. Taken together, these detections are decisive and outweigh the site's technical hygiene. No conflicting legal-entity names were observed, and the evidence does not independently connect the site to any real-world brand or operator. The identity behind the "lending protocol" presentation is therefore unestablished. Behavioural testing of the homepage found no wallet-drainer routines, clipboard manipulation, hidden forms or credential posts to outside hosts, and no cloaking. The page did make heavy use of third-party calls, however. A large share of its XHR and POST traffic went to external destinations, a few of them outside the commonly recognised service set, and the page logged repeated console errors. For a site inviting wallet-linked deposits and borrowing, outbound data flows of this kind add to the cautionary picture. The domain is also very recent, which fits the profile of short-lived, purpose-built DeFi lookalike sites. Evidence:

• Homepage: titled as a lending and borrowing service for TRX, USDT and USDC, with no verifiable operator attached.
• Domain registered 2026-07-29 (~0.24 years old), so the site has existed for only a few months.
• Web archive holds a single snapshot, dated 2026, so there is no prior history that would establish continuity.
• Homepage behaviour: 15 external XHR calls and 12 external POSTs across 3 test runs, with 3 of each going to non-whitelisted destinations, plus 9 console errors.

Regulatory Verification Notes

No regulator, licence or registration is evidenced for a service that presents itself as taking deposits and issuing loans. This is a verification gap. By itself it would not indicate a scam, but here it coexists with confirmed threat detections. No third-party broker-reputation match exists for the domain, so no external regulatory standing can be inferred. The site's technical credentials show only baseline hygiene. Transport encryption is valid, with a domain-validated certificate that proves control of the domain and says nothing about who operates it. The hosting provider has also drawn a small number of abuse reports against the shared server address. Those reports attach to shared infrastructure and are weak evidence about this specific site, but they were not discounted in the assessment. Evidence:

• Homepage and legal content: no licence, registrar or corporate registration identified for the lending and borrowing service.
• TLS certificate issued by YR1 (DV), valid to 2027-01-18.
• Served from AS59692 (IQWEB - IQWeb FZ-LLC, AE).
• Six abuse reports on the hosting IP (186.2.175.35), classed as shared-infrastructure data-center traffic, with a low confidence score of 11.

What to Verify Next

Any claim to be an official lending protocol should be tested against that protocol's own channels, reached through bookmarks, official documentation or an independently sourced listing, not through this domain. The site's own contract and wallet addresses should be checked against that independent source before anything is signed. Official support and contact channels should also be confirmed through an offline or independent route. Any regulator named in the future should be searched directly in its public register. Evidence:

• Homepage: lending and borrowing claims cannot be reconciled with any independently confirmed operator.
• The domain is not recognised in DeFi protocol directories, so no independent listing corroborates the service.
• Active security-vendor detections mean any wallet-connection or approval prompt on the site should be treated as untrusted.

Summary Verdict

The site carries an elevated, high-risk trust posture. Confirmed threat-intelligence detections, a very young domain with no established history, and an unverified operator identity converge into a clearly adverse conclusion. The valid encryption and the absence of detected drainer behaviour are insufficient to offset this.

Infrastructure Integrity

The site resolves to a single address at IQWeb, a data-center hosting provider in the United Arab Emirates, with no CDN or WAF in front of it. The origin server is directly exposed, so infrastructure offers no mitigating layer. Automated heuristics flagged a thin DNS footprint and sparse subdomains typical of a new domain. These flags are unconfirmed and carry little weight beside the confirmed external detections.

Closing Assessment

Interaction should be limited to passive viewing. Wallets should not be connected, no transaction or token approval should be signed, no credentials or funds should be submitted, and nothing should be downloaded until the site is independently cleared. Anyone who has already interacted with it should revoke any token approvals and consider moving assets to a new wallet.

Signals weighed against the site

• AbuseIPDB: 6 reports on hosting IP 186.2.175.35 (IQWeb FZ-LLC, Data Center/Web Hosting/Transit), 11% confidence. The reports are attributed to shared infrastructure, not specifically to this website.