oramcoin[.]com

PhishDestroy identifies oramcoin.com as a fraudulent cryptocurrency exchange domain hosting a crypto drainer kit designed to siphon funds from unwitting users. The page title explicitly claims "Cryptocurrency Exchange | Buy cryptocurrency on ORAMCOIN," indicating a deliberate impersonation of a legitimate trading platform. This domain does not represent any genuine financial service and instead serves as a malicious interface to deceive victims into connecting crypto wallets or entering seed phrases, enabling direct asset theft.

Technical indicators confirm the malicious nature of oramcoin.com. The domain was registered through Hello Internet Corp on March 12, 2026, and resolves to IP address 188.114.96.3. It utilizes a Let's Encrypt SSL certificate, likely to appear legitimate, and has been flagged by 1 out of 95 security vendors on VirusTotal. Google Safe Browsing (GSB) has not yet blacklisted this domain, and public blocklists show minimal coverage, suggesting a recently activated campaign. The combination of a freshly registered domain, low detection rates, and a crypto-drainer payload elevates the risk profile.

Currently, oramcoin.com remains active and poses an elevated threat to cryptocurrency users. PhishDestroy recommends immediate avoidance and blocklisting of this domain. Users are advised to verify all crypto-related domains on PhishDestroy before interacting. While the domain exhibits clear malicious intent, its recent creation and low blocklist presence indicate it may still be propagating. Remaining risk is moderate due to the potential for new victims to fall prey before broader detection occurs. Immediate action from security teams and users is critical to mitigate further exploitation.