claim[.]paradex[.]world

The domain claim.paradex.world was registered on March 5 2026 through PDR Ltd. d/b/a PublicDomainRegistry.com. It resolves to the IPv4 address 172.67.221.78 and is hosted behind Cloudflare’s network (AS13335). The domain’s age and registration channel are consistent with rapid‑deployment malicious infrastructure observed in recent cryptocurrency‑draining campaigns.

TLS termination is provided by a Let’s Encrypt certificate identified as “E8”, indicating a recent, automatically‑issued certificate that does not convey any organizational validation. The authoritative name servers are maya.ns.cloudflare.com and amos.ns.cloudflare.com, both operated by Cloudflare, which masks the true origin server and complicates direct attribution.

Active probing of the site returns HTTP 403 responses and a page title of “Just a moment…”, a pattern often used to stall users while malicious scripts load in the background. The site is currently listed on a single security blocklist and has been flagged by PhishDestroy. VirusTotal reports a single positive detection out of ninety‑five scanners, and Gridinsoft assigns a trust score of 0 / 100, reinforcing its malicious classification despite the low vendor count.

Defenders should block claim.paradex.world at the DNS and proxy layers, monitor outbound connections to the 172.67.221.78 address, and update intrusion‑detection signatures to capture the 403 response combined with the “Just a moment…” title. Continuous re‑evaluation is advised, as the low detection count may change if additional scanners observe the underlying crypto‑draining payload.