groupbuy[.]bdshop[.]com

The domain groupbuy.bdshop.com was registered through GoDaddy.com, LLC on February 21, 2026 and currently resolves to the Cloudflare‑owned address 172.67.205.37, AS13335 in the United States. DNS resolution uses the Cloudflare name servers lily.ns.cloudflare.com and theo.ns.cloudflare.com, indicating that the infrastructure is fronted by a widely trusted CDN. An HTTPS certificate issued by Google Trust Services (WE1) is present and the site returns HTTP 200, confirming that the server is actively serving content. The page title observed is "GroupBuy - Group Based Deals & Massive Savings," which does not directly reference the targeted brand but the domain is explicitly listed as impersonating the brand scroll.

Security telemetry shows that the site is classified as a crypto scam and is flagged by one security blocklist. Gridinsoft assigns a trust score of 1 out of 100, reflecting an extremely low reputation. VirusTotal analysis reports that one of ninety‑three scanned vendors has flagged the domain, reinforcing the malicious assessment. The domain is currently blocked by the PhishDestroy network, yet it remains active and reachable.

Defenders should treat any traffic to groupbuy.bdshop.com as hostile. Recommended actions include adding the domain to URL filtering and DNS blocklists, enforcing TLS inspection to detect the Cloudflare‑issued certificate, and monitoring outbound connections to the associated IP address. Since the site uses Cloudflare, consider employing SNI‑based blocking or response‑body inspection to mitigate false positives for legitimate Cloudflare services. Continuous observation of any new detections from additional vendors or blocklists is advised, as further indicators may emerge as the campaign evolves.