paradex[.]biz

PhishDestroy identifies paradex.biz as an active crypto-drainer domain impersonating the Paradex exchange. The site is configured to intercept wallet connections and siphon assets under the guise of a legitimate trading interface. Security telemetry shows a drainer kit embedded in the page load, automating token approvals and transfer calls once a victim connects a wallet. The domain leverages visual cues such as logo, color scheme, and page layout to mirror the official Paradex site (paradex.io), increasing the likelihood of credential theft and fund misappropriation among traders familiar with the brand.

Technical indicators confirm the hostile nature of paradex.biz. VirusTotal currently scores the domain 1/95 detections (no AV signatures), suggesting it is newly weaponized and undetected by most engines. The domain resolves to IP 54.215.31.113 and is registered through Dynadot Inc on October 27, 2025, indicating very recent acquisition. A Let’s Encrypt SSL certificate lends superficial legitimacy, while Google Safe Browsing has not yet flagged the host. Current blocklist coverage is minimal, leaving most users exposed.

The domain remains active and under investigation with medium confidence in the threat classification. PhishDestroy recommends immediate network-level blocking of 54.215.31.113 and DNS sinkholing of paradex.biz. Users should verify exchange domains via official channels and avoid clicking links from unsolicited messages. Remaining risk is elevated due to undetected status and high mimicry fidelity; proactive takedowns and AV signature updates are the fastest mitigation paths.