airpidrop[.]com

This domain, airpidrop.com, poses as an official Telegram airdrop portal to deceive users into disclosing sensitive credentials or installing malicious software. The site specifically mimics Telegram’s branding under the pretext of a "Pi-Mainnet Airdrop," a fabricated event designed to exploit users’ trust in cryptocurrency distributions. Analysis indicates the domain is engineered to harvest login details, private keys, or other personal information, which can lead to account takeovers or financial theft. The fraudulent nature of the campaign is evident through its misleading interface and false association with Telegram’s legitimate services. Infrastructure analysis reveals multiple technical indicators confirming the domain’s malicious intent. The domain was registered on February 21, 2026, through HOSTINGER operations, UAB, a registrar frequently associated with newly created phishing domains. It resolves to the IP address 216.198.79.1, which has been linked to other suspicious activities in threat intelligence platforms. Detection metrics further substantiate the risk: only 1 out of 95 security vendors on VirusTotal flagged the domain, suggesting either a low detection rate or a newly deployed campaign. Additionally, the domain appears on one security blocklist and was identified in a single AlienVault OTX threat intelligence pulse, reinforcing its classification as a high-risk impersonation site. Users who visited airpidrop.com should take immediate remedial actions to mitigate potential risks. First, revoke any permissions granted to the site, particularly those related to cryptocurrency wallets or Telegram accounts. Change passwords for any accounts accessed while the site was open, and enable multi-factor authentication where available. Monitor financial transactions and account activity for unauthorized access or irregularities. If personal or financial information was submitted, consider reporting the incident to relevant authorities and credit monitoring services. Finally, scan the device used to access the site with updated security software to detect and remove any potential malware.