bulgainme[.]pro

The domain bulgainme.pro has been identified as a crypto drainer phishing site, currently offline but previously active under the guise of a "Grid Responsive Image Gallery." This domain specifically targets users by simulating legitimate web interfaces to illicitly drain cryptocurrency wallets. No direct brand impersonation has been confirmed, though the generic gallery presentation suggests an attempt to appear as a benign or functional web service to evade suspicion. Analysis indicates the domain was registered on February 23, 2026, through PDR Ltd. d/b/a PublicDomainRegistry.com, a registrar frequently associated with high-risk domains. The site resolved to the IP address 172.67.132.15, a Cloudflare proxy endpoint, which obfuscates the true hosting origin and complicates attribution. Detection metrics reveal 0 of 95 VirusTotal vendors flagged the domain at the time of analysis, though it appears on three independent security blocklists. Additional infrastructure analysis reveals the use of Cloudflare Browser Insights and HTTP/3, alongside a Let’s Encrypt SSL certificate, which may lend an air of legitimacy to unsuspecting users. Gridinsoft’s trust scoring system assigned the domain a score of 0 out of 100, further corroborating its malicious classification. As of the latest assessment, bulgainme.pro has been taken offline, though the domain registration remains active. Users who may have interacted with the site are advised to immediately revoke any connected wallet permissions and monitor their accounts for unauthorized transactions. Organizations should update blocklists to include this domain and its associated IP, while security teams are encouraged to review logs for connections to 172.67.132.15 during the period of activity. Given the domain’s recent creation date and the use of Cloudflare proxies, vigilance is warranted for potential resurgence under similar infrastructure or newly registered domains.