paradigmagbi[.]ru

Analysis of paradigmagbi.ru indicates an active brand-impersonation phishing domain targeting users of Argent, a cryptocurrency wallet. The domain was registered through the RIPE NCC and currently resolves to 185.215.4.54, an address hosted on AS57724 (DDOS-GUARD LTD) in Russia. Infrastructure analysis reveals the use of DDoS-Guard protective services and HTTP/3 protocol, alongside a Let's Encrypt SSL certificate issued under the R12 root. The page title, 'Paradigma ЖБИ,' does not directly reference the targeted brand, suggesting either a placeholder or localized content unrelated to the phishing theme. As of July 12, 2026, the domain returns an HTTP 403 status, indicating access restrictions or a non-publicly accessible phishing kit. The domain appears on two security blocklists and is flagged by one of 95 vendors in a recent scan. Defenders should treat this domain as high-risk due to its confirmed impersonation of a cryptocurrency service, association with known bulletproof hosting, and active status. Recommended actions include blocking the domain and IP at network perimeters, monitoring for related infrastructure (e.g., subdomains or newly registered lookalikes), and alerting users of the targeted brand to potential credential theft or wallet-draining attempts. Further investigation into the phishing kit or backend infrastructure is not possible without additional telemetry.