ai-glasses[.]next-cryptolist[.]net

PhishDestroy identifies ai-glasses.next-cryptolist.net as an active crypto drainer domain, likely targeting users with false AI glasses promotions. The site impersonates legitimate product offerings to trick victims into connecting cryptocurrency wallets, where drainer scripts would exfiltrate funds. No specific drainer kit (e.g., MetaMask phishing scripts or clipboard malware) was identified in the initial analysis, but the domain’s structure and registration details align with known cryptocurrency scam patterns. This domain resolves to IP address 172.67.181.166 and was registered on September 16, 2025, through Key-Systems GmbH. VirusTotal currently reports 2/95 detections, indicating it remains undetected by most antivirus engines as of this report. The domain utilizes a Google Trust Services SSL certificate, which is a common tactic to lend false credibility to scam sites. It has not been flagged by Google Safe Browsing (GSB) and has no known blocklist entries at this time. The threat remains active and under investigation, with no mitigation actions taken beyond initial reporting. Users are advised to avoid interacting with the domain or any associated URLs. The lack of detections suggests this is a newly deployed threat, and its risk may escalate as more victims are targeted. Security teams should monitor for related infrastructure and update blocklists accordingly. Remaining risk is high due to the domain’s recency and unflagged status.