drop-saharaai[.]xyz

Analysis of drop-saharaai.xyz indicates this domain was registered on March 6, 2026, through NiceNIC International Group Co., Limited, and is currently offline. The domain resolved to 188.114.96.3, an IP address assigned to AS13335 (Cloudflare, Inc.) in the United States. Nameservers adam.ns.cloudflare.com and danica.ns.cloudflare.com confirm Cloudflare infrastructure was used for DNS resolution. The SSL certificate was issued by Let's Encrypt (serial E7), a common choice for both legitimate and malicious domains.

The domain appears on three security blocklists, including PhishDestroy, MetaMask, and SEAL, suggesting prior phishing activity. Five of 94 security vendors on VirusTotal flagged the domain as malicious, though the specific nature of the threat remains unconfirmed. The page title 'Just a moment...' is consistent with Cloudflare's default interstitial page, often seen during initial setup or when a site is taken offline, but it does not provide insight into the intended scam type or targeted brand. No evidence links this domain to a specific phishing kit, targeted brand, or scam category (e.g., credential harvesting, crypto drainer, or fake giveaways).

The domain's creation date and Cloudflare hosting are typical of short-lived phishing campaigns, but without access to the active content, the exact threat remains unverified. Defenders should treat this domain as high-risk and block it at the DNS or network level. If historical logs or proxy data exist, review for connections to 188.114.96.3 or interactions with Cloudflare's nameservers. Further analysis may require sandboxing or retrieval of archived content to determine the phishing payload.