buldep[.]com

PhishDestroy’s forensic analysis identifies buldep.com as an active Base brand impersonation site hosting a cryptocurrency drainer kit. The domain leverages blockchain technology themes to deceive visitors into connecting wallets and initiating unauthorized transfers. The page title explicitly markets itself as 'Most Popular Online Crypto Casino Based on Blockchain,' masking its true intent as a crypto drainer scam. This domain is currently resolved to malicious infrastructure and actively promoted under false pretenses. The impersonation targets users familiar with Base, the Ethereum Layer 2 network, by mimicking its branding and ecosystem terminology to establish false legitimacy. No overt malware is hosted, but the site’s core functionality is designed to drain digital assets from connected wallets through deceptive transaction prompts. This domain exhibits multiple technical indicators of malicious intent. According to VirusTotal, only 1 out of 95 security vendors flagged buldep.com as malicious as of seed report 4edb92, indicating low detection despite active abuse. The domain was registered on March 12, 2026, through Hello Internet Corp and resolves to IP address 104.21.52.85, which is associated with high-risk hosting environments. The SSL certificate is issued by Let's Encrypt, a common provider in both legitimate and malicious deployments. As of now, this domain has not been blocked by Google Safe Browsing (GSB), and its total blocklist count remains undocumented in public feeds. The late registration date—projected to be only days old at the time of analysis—suggests a rapidly deployed campaign, likely operating under a short-lived domain strategy to evade long-term detection. The current status of buldep.com is active and unresponsive to takedown efforts based on seed intelligence 4edb92. PhishDestroy recommends immediate blocking at DNS, network, and browser levels due to confirmed drainer functionality targeting Base users. All organizations and individual users interacting with Base or related Layer 2 ecosystems should treat this domain as hostile and avoid any interaction. The elevated risk posed to crypto holders requires proactive threat intelligence sharing and domain blocking through threat feeds. Remaining risk remains high as long as the domain remains accessible and undetected by mainstream security platforms. Users are advised to verify all crypto transaction URLs via official Base channels and use hardware wallets with transaction simulation features to prevent unauthorized asset transfers.