paramountchange[.]org

ParamountChange.org is currently active and responds with HTTP 200 status. The site resolves to IP 163.61.188.7, which maps to a United States location linked to the MIT network. Registration records show the domain was provisioned through TuringSign Inc. d/b/a Cosmotown, and the authoritative name servers are dns1.lytehosting.com, dns2.lytehosting.com, dns3.lytehosting.com, and dns4.lytehosting.com. A valid Let’s Encrypt (YR1) TLS certificate is in use, and the domain publishes an MX record that points to itself (priority 0, host paramountchange.org). Threat intelligence lists the domain on one security blocklist and confirms it is blocked by the PhishDestroy feed; AlienVault OTX references it in two pulses, and VirusTotal reports a single positive detection out of 91 scanners. The available evidence indicates the infrastructure is being leveraged for a generic phishing campaign, though the specific impersonated brand or lure has not been disclosed. Defenders should add the domain and its IP address to deny‑list rules, monitor DNS queries for the LyteHosting name servers, and enforce email filtering for messages originating from the domain’s MX host. Continuous monitoring is advised to capture any future payloads or credential‑collection pages that may be deployed.