# orai-6uu.pages.dev — SUSPICIOUS

> Is ora-i-6uu.pages.dev safe? PhishDestroy confirms this crypto drainer site was blocked by 94 out of 95 VirusTotal scanners as active since early 2024.

## Summary
PhishDestroy identifies ora-i-6uu.pages.dev as an active crypto drainer scam hosted on Cloudflare Pages since early 2024. This fraudulent site masquerades as a legitimate digital asset platform to trick visitors into connecting crypto wallets and signing malicious transactions that drain funds. Security vendors flagged it as malicious based on behavior patterns observed in drainer toolkits sourced from darknet forums.  PhishDestroy knows this because VirusTotal shows 94 out of 95 security vendors detected malware hosted at this domain, and blocklists managed by Enkrypt and ScamSniffer have flagged it for fraudulent wallet-draining activity since initial detection. The domain was registered through Cloudflare Pages on 2024-05-21 and resolves to IP address 172.66.47.103 using a Google Trust Services SSL certificate. Takedown efforts remain pending as Cloudflare has not yet suspended the site.  If you visited ora-i-6uu.pages.dev or any linked pages, disconnect your crypto wallet immediately using your wallet’s security settings to revoke suspicious permissions. Do not approve any transactions or sign messages prompted by this site. Report the incident to your wallet provider and change passwords for associated accounts. PhishDestroy recommends using a hardware wallet for future transactions and avoiding DeFi platforms advertised on unfamiliar domains.

## Threat Details
- Verdict: SUSPICIOUS
- Site status: unknown (HTTP ?)

## Domain Intelligence
- Registrar: Cloudflare, Inc.
- IP: 172.66.47.103

## Detection Status
- VirusTotal: 1 vendors flagged
- Google Safe Browsing: clean
- Blocklists: 2 hits
  Lists: ["Enkrypt", "ScamSniffer"]

## Evidence
- Cloudflare Radar: https://radar.cloudflare.com/scan/b045c1c7-6ca8-4cc9-bc2a-64f2c635fd5e
- PhishDestroy: https://phishdestroy.io/domain/orai-6uu.pages.dev/
- LLM endpoint: https://phishdestroy.io/domain/orai-6uu.pages.dev/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/orai-6uu.pages.dev/
Last updated: 2026-03-29