orion-ex.icu
Appeared in the .icu zone on Monday, August 31, 2026; by the end of that day the census found active website about crypto web3. Full domain report
Signals, not verdicts. A domain appears here because heuristics matched its name, its infrastructure or the page it served on its first day. Where a model has looked at it, that is shown as an opinion with a confidence, not as a finding. Nothing on this page says a site is malicious. Read the evidence and decide for yourself.
Own one of these names and think the listing is wrong? Tell us and a person will look.
What matched
Model opinions
Brand-new .icu domain hosting a Russian-language anonymous crypto-to-rubles 'exchanger' with no registration, no legal/company details, rates 'confirm with the operator', and a form that only harvests a Telegram username to push the victim into a bot chat where they are told to send USDT/BTC first — the classic advance-send exchanger fraud shape; no impersonation of Telegram (it is merely the contact channel), so this is fraud rather than phishing.
A cryptocurrency exchange site (Orion) with its own branding and logo presenting a form that collects Telegram username, crypto type, amount, and payout method, then routes users to Telegram for completion. This is a P2P crypto-to-rubles exchange fraud (likely exit scam or money laundering), not brand impersonation—the site owns the Orion name and operates under it. The sealed-room form (posts to self, no offsite legitimate links except to Telegram operator) and requirement for Telegram contact
A model looked at the screenshot and page text and wrote what it thought. It can be wrong, and it is not a finding.
What the page looked like on Monday, August 31, 2026
Same data as JSON: /api/zone/domain/orion-ex.icu. This page is not indexed by search engines and does not link to the site it describes.