zerty899[.]lol

This domain, zerty899.lol, operates as a crypto drainer scam designed to deceive users into connecting wallets to a fraudulent trading platform under the pretext of trading the USD1 pair as part of a "War on USD" campaign. The page title, "$WAR - War on USD | Trade USD1 Pair | Join the Resistance," suggests a targeted effort to exploit cryptocurrency traders by leveraging social engineering tactics, such as fabricated narratives of financial resistance or exclusive investment opportunities. Crypto drainers typically function by tricking users into signing malicious transactions that authorize the transfer of funds from their wallets to attacker-controlled addresses, often resulting in complete asset loss with no recourse for recovery.

Analysis of the domain infrastructure reveals multiple indicators of malicious activity. The domain was registered on March 14, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with high-risk domains due to lax abuse handling. It resolves to the IP address 188.114.96.3 and employs Cloudflare for hosting and DDoS protection, a common tactic to obscure the true origin of phishing infrastructure. Security vendors on VirusTotal flagged the domain as malicious, with 14 out of 95 engines detecting it as a threat. Additionally, the domain appears on one security blocklist and has been assigned a trust score of 0/100, further corroborating its fraudulent nature. The use of HTTP/3 and HSTS indicates an attempt to mimic legitimate financial platforms, though these technologies do not mitigate the underlying threat.

Users who visited zerty899.lol or interacted with its content should take immediate action to mitigate potential losses. First, disconnect any wallets connected to the site and revoke any suspicious token approvals using a blockchain explorer or wallet management tool. Scan the device for malware, as crypto drainers may deploy additional payloads to maintain persistence or exfiltrate sensitive data. Monitor wallet activity for unauthorized transactions and report the incident to relevant authorities or platforms specializing in cryptocurrency fraud. Given the domain's current offline status, users should remain vigilant for similar scams, particularly those leveraging trending narratives or impersonating legitimate trading pairs.