The function indexOf() returns -1 if the substring is not found, so you should check for that value. Try this:

function onSubmit() {
    if (g_form.getValue('select_the_tool') == 'box' && g_form.getValue('url_of_file_sharing_site_zscaler').indexOf('.box.') == -1) {
        alert('Make sure the URL to unblock is related to Box or select the tool as "Other" to proceed.');
        return false;
     }
}