bzstart[.]com

Analysis of www.bzstart.com indicates that the domain was created on 22 March 2026 through Dynadot Inc and resolves to the IPv4 address 123.108.75.6, which is geolocated to Singapore (ELD). The only observed page element is a title tag reading “Start”. Technical fingerprints show the use of Vue.js for client‑side rendering and the presence of HTTP Strict Transport Security (HSTS). The TLS certificate is signed by Sectigo Limited under the Sectigo Public Server Authentication CA DV R36 chain, confirming that the site was served over HTTPS. Reputation scoring is extremely low: Gridinsoft assigns a trust score of 0 out of 100, while Scamadviser records a score of 10 out of 100.

The domain appears on a single security blocklist and has been taken offline by the PhishDestroy takedown service. VirusTotal reports that 5 of 94 scanning engines flagged the domain as malicious, reinforcing the suspicion of abuse. The identified scam category is an investment scam, although no further details about the fraudulent offering or victim interaction have been published. Nameservers ns1.dyna-ns.net and ns2.dyna-ns.net are standard Dynadot defaults and do not provide additional attribution.

Because the site is currently offline, active exploitation is likely halted, but the underlying infrastructure—IP address, registrar, and nameserver pattern—could be reused for future campaigns. Defensive recommendations include immediately blocking the domain and its hosting IP at perimeter and DNS layers, adding the observed nameservers to any internal deny lists, and propagating the indicator set to shared threat‑intelligence feeds. Continuous monitoring of the 123.108.75.6 address block, as well as newly registered domains using Dynadot’s default nameservers, is advised to detect any resurgence of the same threat actor.