roxbolit[.]lol

PhishDestroy has flagged roxbolit.lol as an active crypto drainer domain designed to trick users into approving fraudulent cryptocurrency transactions. The domain was created on April 04, 2026, and is currently resolving to IP 172.67.153.139 via a Let’s Encrypt SSL certificate. The site exhibits classic drainer behavior, including obfuscated JavaScript logic and prompts for wallet connection permissions. There are no known ties to a specific brand at this time, suggesting a generic but high-risk operation targeting crypto users. The domain shows a current VirusTotal score of 1/95 detections, indicating it remains undetected by most antivirus engines as of the latest scan. The registrant used PDR Ltd. d/b/a PublicDomainRegistry.com, a common low-cost registrar often exploited in bulk phishing campaigns. The domain’s IP, 172.67.153.139, maps to Cloudflare infrastructure, commonly abused to evade takedowns and geographic blocking. The domain is not currently flagged by Google Safe Browsing (GSB) and has not been added to major blocklists, leaving it active and accessible to potential victims. As of this report, the threat status is under investigation, but the domain remains active and poses a moderate to high risk to cryptocurrency users. Immediate action is recommended: block roxbolit.lol at the network and DNS levels, report to threat intelligence platforms such as VirusTotal and URLVoid, and warn users in crypto communities to avoid interacting with unsolicited wallet connection requests. While the site lacks widespread detection, its recent creation and behavior suggest rapid evolution. Users are advised to verify all crypto-related domains and use hardware wallets or transaction simulation tools before approving transfers.