cxrimaxpay[.]frbg[.]biz[.]id

Analysis of the domain cxrimaxpay.frbg.biz.id shows that it was registered on 22 February 2026 and is currently reported as offline. VirusTotal scans have returned 18 positive detections out of 95 AV engines, indicating that a substantial portion of security products classify the site as malicious. The page served a title rendered in Unicode characters – “𝗗𝗔𝗡𝗔 | 𝗖𝘂𝘀𝘁𝗼𝗺𝗲𝗿 𝗖𝗮𝗿𝗲 𝗗𝗔𝗡𝗔” – which is consistent with a targeted credential‑harvesting lure.

Infrastructure fingerprints reveal the use of the Bootstrap front‑end framework, Slick carousel, and a collection of third‑party libraries delivered via jsDelivr, cdnjs, and jQuery. Traffic was routed through Cloudflare, with the presence of Cloudflare Browser Insights and support for HTTP/3, suggesting an attempt to mask origin and leverage performance optimizations. The domain appears on a single known phishing blocklist and is explicitly blocked by PhishDestroy, confirming that at least one dedicated anti‑phishing service has taken it down.

No public SSL certificate details, IP address, or ASN information are available in the current dataset, limiting deeper network attribution. Given the combination of multiple vendor detections, the malicious page title, and confirmed blocklist presence, defenders should add cxrimaxpay.frbg.biz.id to URL filtering policies, monitor for any resurgence of the host, and ensure endpoint protection suites are updated to include the latest detection signatures. Continuous observation of Cloudflare‑associated traffic for similar patterns is advised, as threat actors often reuse the same CDN configuration for subsequent campaigns.