paradex-mainnet[.]trade

This domain was registered on March 6, 2026 through PDR Ltd. d/b/a PublicDomainRegistry.com and resolves to 188.114.97.3, an address owned by Cloudflare, Inc. (AS13335) located in the United States. Authoritative nameservers giancarlo.ns.cloudflare.com and maleah.ns.cloudflare.com confirm Cloudflare DNS hosting. No TLS certificate was observed, indicating the site was served without HTTPS. The only page title retrieved was “$DIME Genesis | Paradex”, which references a cryptocurrency token (“DIME”) and the Paradex platform, a pattern commonly leveraged in credential‑harvesting or token‑theft campaigns.

The domain is currently offline, but historical scans show it was flagged by two of ninety‑four VirusTotal security vendors and appears on three external blocklists, including PhishDestroy, MetaMask, and SEAL. These blocklists specifically target malicious cryptocurrency‑related phishing sites, reinforcing the assessment that the domain was used for a phishing operation aimed at crypto users. Evidence is limited to the page title and infrastructure data; the exact malicious payload, login flow, or content beyond the title has not been captured.

Defenders should continue to deny DNS resolution for paradex-mainnet.trade, add it to internal URL filtering and threat‑intel feeds, and monitor for any re‑use of the same IP address or Cloudflare nameservers. Network traffic to 188.114.97.3 should be logged and investigated if observed, as it may indicate continuation of the campaign. Analysts should also watch for new domains employing similar “$DIME Genesis” titles, as this may signal a broader phishing kit or campaign.