v2-zero-lend[.]com

PhishDestroy identifies v2-zero-lend.com as an active crypto drainer posing as a DeFi lending service, leveraging brand impersonation to trick users into connecting wallets for fund exfiltration. The domain’s naming convention mimics legitimate platforms like 'V2 Zero Lend,' suggesting a deliberate attempt to exploit trust in zero-interest or experimental lending protocols. While no specific drainer kit signatures are publicly available, the threat actor’s infrastructure is designed to facilitate unauthorized cryptocurrency transfers, making this a high-risk domain.

This domain was flagged under generic phishing with exact technical indicators including a VirusTotal detection ratio of 1/95, registration via NICENIC INTERNATIONAL GROUP CO., LIMITED, and resolution to IP 188.114.96.3. Notably, the domain was created on March 22, 2025, and holds a valid SSL certificate issued by Google Trust Services, which may be weaponized to bypass basic security checks. As of the latest scan, the domain remains unlisted on major blocklists, further highlighting the stealth and recency of this campaign. The mismatch between the page title (www.www.v2-zero-lend.com) and the domain itself suggests possible obfuscation techniques to evade scrutiny.

Currently, the domain is active and under investigation, with no confirmed takedown actions as of this advisory. Users are advised to block the domain at the network level and avoid accessing it to prevent potential wallet compromises. The low detection rate on VirusTotal warrants immediate caution, as threat actors often exploit undetected infrastructure for fraudulent schemes. Organizations should update DNS blocklists and educate users on recognizing crypto drainer tactics.