deroxplay[.]com

PhishDestroy identifies deroxplay.com as an active crypto drainer domain impersonating a gaming platform to trick users into connecting crypto wallets and signing malicious transactions.

This domain, created on April 16, 2026, operates under a Let's Encrypt SSL certificate and resolves to the IPv4 address 188.114.96.3. According to VirusTotal, only 1 out of 95 security vendors currently flag this domain, indicating a low initial detection rate despite its malicious activity. The domain is registered through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar known for hosting high-risk domains. The domain has not been identified on Google Safe Browsing (GSB) lists, and current blocklist data shows minimal coverage, leaving users vulnerable to exposure.

As of the latest intelligence, deroxplay.com remains active and poses an elevated risk to users who may interact with it. Immediate actions include blocking the domain at the network level, updating threat intelligence feeds to include this indicator, and notifying affected organizations. While the domain is currently live, continuous monitoring is required to track any shifts in infrastructure or tactics. The remaining risk is elevated due to the domain's recent creation, low detection rates, and the likelihood of further cryptocurrency theft campaigns leveraging similar domains. Users are strongly advised to verify any suspicious domains on PhishDestroy before engaging and to avoid connecting wallets or entering sensitive information.