cvxsaze[.]cfd

Analysis conducted on July 23, 2026 identifies cvxsaze.cfd as a high‑risk brand‑impersonation infrastructure targeting Facebook users. The domain was registered on October 23, 2025 through Aceville Pte. Ltd. and resolves to the IP address 43.160.194.46, which is geolocated to Singapore and belongs to AS132203 (Tencent Building, Kejizhongyi Avenue). No TLS certificate is presented, leaving the site unencrypted and exposing any traffic to interception. The authoritative nameservers a.dnspod.com, b.dnspod.com, and c.dnspod.com are typical of dynamic DNS services, a pattern often observed in malicious hosting.

Google Safe Browsing flags the domain for social engineering, and 14 of 95 security vendors on VirusTotal have reported detections, indicating consensus among detection engines that the site is malicious. Independent reputation services assign extremely low trust scores (Scamadviser 1/100, Gridinsoft 0/100). The domain appears on at least one public blocklist and is actively blocked by PhishDestroy. An AlienVault OTX pulse references the domain, providing additional community corroboration.

The page title observed, "Quality Women's Leather Shoes and Accessories | Maguire Shoes," bears no relation to the claimed Facebook impersonation, suggesting content cloaking or a lure unrelated to the advertised brand. The current operational status is offline, but historical evidence confirms the domain was used for brand‑impersonation. Defenders should continue to block the domain and associated IP, monitor DNS queries to the dnspod nameservers for similar patterns, and update detection signatures to reflect the observed indicators of compromise. Ongoing vigilance is advised, as the infrastructure could be reactivated under a new domain or IP address.