saharaal[.]world

The domain saharaal.world is a confirmed phishing site engaged in brand impersonation targeting MetaMask users. It presents itself as a cryptocurrency airdrop platform under the false pretense of an 'OKX Airdrop' to deceive victims into disclosing wallet credentials or sensitive information. No drainer kit was identified, but the site's cryptocurrency scam focus and MetaMask impersonation classify it as an elevated-risk threat. As of the latest verification, saharaal.world has been taken offline.

Technical indicators confirm the malicious nature of saharaal.world. The domain was flagged by 2 of 95 security vendors on VirusTotal, including CRDF and Gridinsoft, which assigned it a trust score of 0 out of 100. It appears on two security blocklists, PhishDestroy and ScamSniffer, though Google Safe Browsing did not flag it. Registered through Web Commerce Communications Limited dba WebNic.cc on June 21, 2025, the domain resolves to the IP address 104.21.63.158, hosted on Cloudflare's network in the US. The SSL certificate was issued by WE1, and the observed page title was 'Sahara AI: OKX Airdrop'.

Victims of saharaal.world should immediately revoke any token approvals granted to unknown contracts and transfer remaining funds to a new, secure wallet. If credentials were entered, change passwords for all associated accounts and enable two-factor authentication where available. Monitor accounts for unauthorized transactions or suspicious activity. Report the phishing domain to MetaMask's official abuse channels, as well as to platforms like ScamSniffer, PhishDestroy, and Google Safe Browsing to aid in broader mitigation efforts.