**Scam Campaign Report: Fraudulent Domain Network Targeting Social Media Users**
Our analysis has identified a coordinated scam operation involving seven interconnected domains that share common infrastructure and registrar services. All domains in this cluster—rosenid.com, cboter.com, m.bullionwatch.com, bullionwatch.com, tuztua.com, www.actilure.com, and actilure.com—were registered through Gname.com Pte. Ltd. between September 5-12, 2025. The domains are connected through 15 distinct infrastructure relationships, with tuztua.com and rosenid.com serving as central hubs in the network, each connecting to all other domains in the cluster.
Consumer reports reveal this network is actively targeting social media users, particularly on TikTok, with fraudulent merchandise advertisements. Multiple victims reported seeing ads for Pink Palm Puff merchandise advertised at steep discounts of 90% off, with promotional campaigns specifically timed around Black Friday shopping periods. When consumers clicked on these advertisements, they were redirected to rosenid.com to complete purchases, but payments were processed under different business names than advertised. Victims reported never receiving confirmation emails or merchandise after completing transactions, indicating classic fulfillment fraud tactics.
Additional community reports suggest the campaign extends beyond fake merchandise to include romance scams, with at least one victim reporting contact from an individual named "Syndra Lin" through Facebook groups targeting California residents. This indicates the infrastructure may be supporting multiple fraud schemes simultaneously, leveraging the shared domain network to maximize criminal operations while minimizing detection risks.
To protect yourself from these and similar scams, always verify website legitimacy before making purchases by checking domain registration dates and looking for established customer reviews from verified sources. Be especially cautious of social media advertisements offering steep discounts on popular merchandise. If contacted by unknown individuals through social media or unfamiliar websites, hang up phone calls immediately, do not click on suspicious links, and report incidents to the FTC at reportfraud.ftc.gov or the FCC. You can verify the safety of phone numbers and domains by searching them on consumer protection websites and scam databases before engaging.
This campaign represents a moderate threat level with active consumer targeting through social media platforms and coordinated infrastructure designed to evade detection. We recommend consumers exercise heightened caution when encountering advertisements for discounted merchandise on social media platforms, particularly those directing to recently registered domains. The coordinated timing of domain registrations and shared infrastructure suggests an organized operation that may expand or evolve tactics rapidly.