raowox[.]com

PhishDestroy identifies raowox.com as a live crypto-drainer domain designed to steal cryptocurrency from unsuspecting users. The site mimics legitimate wallet login pages to trick victims into entering their private keys or connecting their wallets, enabling immediate fund drainage. Attackers behind this campaign leverage social engineering tactics, such as phishing emails or fake advertisements, to lure targets to the malicious domain. Once a user lands on the page, the crypto-drainer silently exfiltrates wallet credentials or directly drains funds without requiring additional authentication. This domain was flagged by PhishDestroy with an elevated risk rating after analysis revealed critical indicators. VirusTotal data shows raowox.com is recognized by only 1 out of 95 security vendors, highlighting its stealthy nature and the challenge of detection. The domain was registered on March 17, 2026, through GMO Internet, Inc., a registrar often abused by threat actors for quick domain turnover. It resolves to IP address 188.114.96.3 and utilizes a Let's Encrypt SSL certificate to appear legitimate. These factors suggest an opportunistic campaign targeting users in a narrow timeframe before the domain is likely abandoned or taken down. If you visited raowox.com or entered any information, immediately revoke wallet connections via your wallet's security settings and transfer remaining funds to a new wallet. Scan your device with updated antivirus software and reset passwords used on the site. Report the domain to PhishDestroy for investigation and consider enabling multi-factor authentication on all crypto-related accounts. Stay vigilant for follow-up phishing attempts, as threat actors may reuse credentials or contact details obtained from this attack.