user-paradex[.]xyz

The domain user-paradex.xyz was observed on 12 July 2026 and classified as a high‑risk generic phishing site. Automated detection systems recorded the site as active, and threat intelligence sources have flagged it for malicious use. The page title returned by HTTP requests is “Just a moment…”, and the server responds with HTTP 403, indicating restricted access to content. Domain registration data shows the name was created on 14 April 2026 through Dynadoc LLC, a registrar known for rapid provisioning. Authoritative nameservers are braden.ns.cloudflare.com and gail.ns.cloudflare.com, both Cloudflare‑managed, and the domain resolves to IP address 188.114.97.3, which is geo‑located in Canada and associated with Cloudflare’s network. The site presents a valid Let’s Encrypt certificate (E8), confirming TLS encryption is in place. Reputation analysis reveals a Gridinsoft trust score of 0 out of 100, the lowest possible rating, and the domain is listed on a single public blocklist. VirusTotal reports that two out of ninety‑five security vendors have flagged the domain as malicious. Additionally, the domain appears in one AlienVault OTX pulse, and PhishDestroy has recorded it as blocked. These independent indicators collectively reinforce the phishing designation. Publicly available information does not include a content snapshot beyond the generic title; therefore the specific luring technique, credential‑capture page structure, or targeted brands remain unknown. The 403 response suggests a possible redirection or dynamic content delivery that has not been captured in the current dataset. Defenders should add user‑paradex.xyz to firewall and DNS block policies, monitor outbound connections to 188.114.97.3, and enforce TLS inspection to capture any hidden payloads. Continuous re‑evaluation is advised, as the domain’s status may evolve; threat hunters should query recent threat‑intel feeds for new pulses or additional vendor flags.