okx[.]saharaal[.]world

The domain okx.saharaal.world is a confirmed phishing site engaged in brand impersonation targeting OKX, a cryptocurrency exchange. It posed as a fraudulent airdrop page under the guise of 'Sahara AI: OKX Airdrop' to deceive users into disclosing sensitive information or transferring cryptocurrency. No drainer kit was identified, but the site was actively used for cryptocurrency-related scams. As of the latest verification, okx.saharaal.world has been taken offline.

Technical indicators confirm the malicious nature of okx.saharaal.world. The domain was flagged by 1 of 95 VirusTotal security vendors, including Gridinsoft, which assigned a trust score of 0/100. It appeared on 2 security blocklists, specifically PhishDestroy and ScamSniffer, while Scamadviser rated it 1/100. The domain was registered on February 21, 2026, through Web Commerce Communications Limited dba WebNic.cc, with nameservers ns100.webnic.cc and ns101.webnic.cc. It resolved to the IPv6 address 2606:4700:3031::ac43:ab0a, hosted by Cloudflare in the US (AS13335). The SSL certificate was issued by WE1, and Google Safe Browsing did not flag the domain at the time of analysis.

Users who interacted with okx.saharaal.world should immediately change any exposed credentials, particularly for OKX or other cryptocurrency platforms, and enable two-factor authentication. If cryptocurrency transactions were attempted, revoke any token approvals and consider transferring funds to a new wallet to mitigate potential losses. Report the phishing domain to OKX’s official security team and submit it to platforms like Google Safe Browsing, PhishTank, or the Anti-Phishing Working Group to aid in broader takedown efforts.