event-bulktrade[.]com

This domain is flagged as an active cryptocurrency phishing infrastructure targeting digital asset holders. Analysis indicates a deliberate attempt to impersonate legitimate bulk trading platforms, leveraging deceptive branding to harvest wallet credentials or private keys. The elevated risk classification stems from confirmed malicious activity, including credential theft attempts and unauthorized transaction redirection, as documented by multiple independent security feeds. Infrastructure analysis reveals the following technical indicators: the domain event-bulktrade.com was registered on June 01, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, an offshore registrar frequently associated with high-risk registrations. It resolves to the IP address 188.114.97.3 and employs Cloudflare for traffic obfuscation and DDoS protection. The site uses Framer Sites, React, jQuery, and HTTP/3, with an SSL certificate issued by Google Trust Services. Detection metrics include 6 out of 95 security vendors flagging the domain on VirusTotal, while three distinct blocklists (including MetaMask and SEAL) have actively blocked it. The Gridinsoft trust score for this domain is 0 out of 100, further corroborating its malicious classification. The page title, Bulk Trade, mimics legitimate trading platforms to deceive users. Mitigation measures should prioritize immediate blocking of the domain and its associated IP across all network security layers. Organizations handling cryptocurrency transactions should deploy strict access controls, including multi-factor authentication and hardware-based key storage, to prevent credential compromise. End users are advised to verify domain registration details via WHOIS queries before interacting with any trading platform, particularly those promising bulk transactions or high-yield returns. Security teams should monitor for similar domains registered through NICENIC INTERNATIONAL GROUP CO., LIMITED or resolving to 188.114.97.3, as these may indicate related phishing campaigns. Automated threat intelligence feeds should be updated to include this domain and its infrastructure indicators to prevent future exposure.