Is swap-justlend.com a scam? TrustSniffer's high-risk assessment: 0/100

Security Alert

Fortinet, Kaspersky, Sophos flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

This website is a single-page decentralized-finance front end titled "Staked TRX – JustLend DAO". It presents a TRX staking interface under a "swap-justlend" domain name that evokes an established TRON-based lending protocol. Its apparent purpose is to draw visitors into staking and swapping TRX-denominated assets through a crypto-asset interface.

Scam/Impersonation Risk

Contradictory signals are present and they converge. The domain is confirmed blacklisted by external threat-intelligence sources, with a substantial number of independent security engines rating it malicious. These include several tier-one security vendors, and further engines rate it suspicious. The domain name pairs "swap" with the name of a well-known lending protocol, and the homepage title presents itself as that protocol's staking product. Taken together with the blacklisting, this fits the profile of a lookalike front end built to attract users of the genuine service. Nothing in the evidence establishes that the operator is connected to the genuine project. The site is also very young, and its registration details are incomplete, so no operator identity can be connected to it. Automated testing of the homepage found no wallet-connection prompts, clipboard tampering, hidden forms, or cloaking. This is not exculpatory, because the blacklisting stands independently and a staking interface can turn hostile after a content swap. The homepage did, however, send a notable share of its background requests and data submissions to third-party destinations outside the site's expected set, and it produced repeated script errors. Both are consistent with an unpolished or hastily assembled front end. No conflicting legal entities were found, so there is no identity contradiction in the strict sense. The risk comes from the blacklisting and the lookalike positioning. Evidence:

• Homepage and domain: the domain name combines "swap" with an established protocol's name, and the page title reads "Staked TRX – JustLend DAO".
• Reputation: 17 security engines flagged the domain as malicious and 3 as suspicious, which triggered the highest-severity external blacklist condition.
• Homepage behavior: 9 external data submissions were observed in three test runs, 6 of them to destinations outside the expected set, along with 6 console errors.
• Domain provenance: registered 2026-05-06, about 0.46 years (roughly five and a half months) old, so there is no long-standing record to offset the blacklisting.

Regulatory Verification Notes

The site presents no licensing, registration, or corporate-entity disclosure in the content captured from the homepage. Because it offers staking and swapping of crypto assets, this is a material gap. It is a verification gap in its own right and does not by itself prove deception, but it compounds the blacklisting. Ownership opacity applies: the registration record is incomplete and does not reveal a responsible operator. No third-party broker or regulator profile matched the domain, and the absence of a match carries no weight either way. The technical hygiene is basic and is not evidence of legitimacy. The transport certificate is valid and was issued by a recognised authority, but domain-validated certificates are freely available to any registrant. Evidence:

• Registrar and dates: registered through NICENIC International Group Co., Limited, created 2026-05-06 and expiring 2027-05-06.
• Transport encryption: TLS certificate issued by YE2 (DV), valid to 2026-11-30, with 39 days remaining.
• Hosting: served from AS13335 (Cloudflare, Inc., US).
• Homepage disclosure: the captured content contained no company name, license number, or regulator reference.

What to Verify Next

The priority is establishing whether this domain belongs to the genuine protocol. That means comparing it with the project's official address as published in independently sourced channels, such as the project's verified social accounts or documentation reached through a trusted bookmark. It also means checking whether the project itself lists this domain as official. If the project does not claim it, the site should be treated as a lookalike. Any claim of regulatory authorization should be checked against the relevant public registry, since none is stated on the page. Security teams should treat the domain as hostile in the meantime: block it where policy allows, and do not run the TRON wallet session anywhere it could be exposed. Report the domain to the genuine project's security contact and to the registrar's abuse channel. Evidence:

• Homepage: the page presents a JustLend DAO staking interface under a different domain name.
• Reputation: the blacklisting and the many malicious detections are current and corroborated across independent engines.
• Registration: the NICENIC registration is recent, with no established operator record behind it.

Summary Verdict

The site carries an elevated, high-severity risk posture. Its blacklisting and the many independent malicious detections are decisive and are not offset by the site's basic technical hygiene. Its legitimacy cannot be established, and its apparent link to a known protocol is unconfirmed and treated as likely misleading.

Infrastructure Integrity

The site sits behind Cloudflare's CDN and WAF. All four observed addresses are Cloudflare edge servers, and no origin address was observable. This is a mitigating factor only. It shows the site is not hosted on obviously abusive infrastructure, but it conceals the true origin and can mask rapid content swaps. It cannot offset the reputational risk. The edge addresses are shared infrastructure with no abuse reports against them, so they say nothing about the operator.

Closing Assessment

Interaction should be limited to read-only viewing at most, and ideally avoided. Credentials, wallet connections, signatures, and any transfer of funds should be withheld entirely. Anyone seeking the genuine service should reach it through an independently confirmed official address rather than this domain.