aroxplay[.]com

PhishDestroy identifies aroxplay.com as an active crypto drainer site currently impersonating a login portal, likely targeting cryptocurrency users with fake authentication pages designed to steal credentials and drain wallets. The domain was registered on April 05, 2026, and resolves to IP 172.67.218.109. Threat analysis indicates the use of a drainer kit intended to automate unauthorized transfers from compromised wallets upon login submission.

This domain exhibits multiple red flags confirmed by external threat intelligence. VirusTotal reports a detection score of 3 out of 95 security vendors as of the latest scan. It is registered through NICENIC INTERNATIONAL GROUP CO., LIMITED and secured with a Let's Encrypt SSL certificate. The domain has been active for less than 30 days, increasing the risk of exposure to early victims. Public blocklists and Google Safe Browsing (GSB) have not yet flagged this domain, indicating a window of opportunity for cybercriminals.

As of this report, aroxplay.com remains online and operational with an elevated risk level. PhishDestroy recommends immediate blocking at the network and endpoint level. Users should avoid visiting the domain and verify any similar-looking links using PhishDestroy’s real-time lookup tool. Although the current blocklist coverage is low, proactive blocking and user awareness are critical to prevent successful wallet drain attacks. Remaining risk is high due to the domain’s recent creation and untracked status across major threat feeds.