airdropgen-o[.]live

The domain airdropgen-o.live is identified as a brand impersonation threat targeting Telegram users. Analysis indicates the site operated as a fake airdrop portal, luring victims with fraudulent token claims under the guise of legitimate Telegram promotions. The domain is currently offline, though prior activity suggests it was designed to harvest credentials or distribute malicious payloads. Infrastructure analysis reveals the domain was registered through Web Commerce Communications Limited and resolved to the IP address 172.67.141.55. Security vendor detections include 4 of 95 flags on VirusTotal, with a Gridinsoft trust score of 0/100. The domain appears on one security blocklist, and technical indicators confirm the use of Cloudflare and HTTP/3 protocols. The page title, "gen-o airdrop | Claim Your Tokens," aligns with common tactics used in cryptocurrency-related phishing schemes. Current status confirms the domain has been taken offline, though residual risks may persist for users who interacted with it prior to deactivation. Organizations and individuals are advised to monitor for unauthorized access attempts linked to this domain, particularly those involving Telegram credentials or cryptocurrency transactions. Blocking the domain and associated IP at the network level is recommended as a preventive measure. Users should verify the legitimacy of airdrop campaigns through official Telegram channels before engaging with any unsolicited offers.