rockwin-aus[.]com

PhishDestroy identifies rockwin-aus.com as an active crypto drainer phishing domain targeting cryptocurrency users. This domain is currently classified under investigation with a high-risk status, indicating ongoing malicious activity. The campaign involves the theft of cryptocurrency assets through deceptive web interfaces designed to mimic legitimate crypto platforms. The domain rockwin-aus.com was registered on January 22, 2026, via Fewmoretaps OU under the trade name Trustname.com. It resolves to the IP address 188.114.96.3 and utilizes a Google Trust Services SSL certificate for legitimacy. As of the latest scan, rockwin-aus.com remains undetected by 0 of 95 VirusTotal vendors, suggesting it has not yet been widely flagged by security solutions. The absence of detections, combined with the recent domain registration, indicates an early-stage campaign designed to evade initial scrutiny. The infrastructure shows no current presence on known blocklists, though trust scores remain unverified due to its recent creation. This domain is actively engaged in a crypto drainer phishing campaign, where victims are lured to a counterfeit crypto platform to initiate unauthorized transactions. Users are advised to avoid interacting with rockwin-aus.com and verify the authenticity of crypto-related domains using PhishDestroy. Network administrators should monitor traffic to 188.114.96.3 and block the domain at the firewall level. Immediate action is recommended to prevent potential financial losses due to cryptocurrency theft.