sahara-ai[.]top

Analysis of sahara-ai.top, observed as offline on July 25 2026, indicates that the domain was actively used for a generic phishing campaign before its takedown. The site returned an HTTP 403 Forbidden response, and the page title captured during the scan was exactly “403 Forbidden”. The domain resolves to the Cloudflare‑owned address 104.21.32.1, which belongs to AS13335 (Cloudflare, Inc.) and is geolocated in the United States. The TLS certificate presented is the Cloudflare TLS Issuing ECC CA 1 certificate, confirming that Cloudflare acted as the front‑end CDN for the host. Registration data shows the domain was created on 21 February 2026 and is listed under the registrar Web Commerce Communications Ltd. Nameserver records point to ns100.webnic.cc.

and ns101.webnic.cc. The domain appears on two public phishing blocklists – PhishDestroy and ScamSniffer – and both services currently list it as blocked. VirusTotal analysis recorded four detections out of ninety‑three scanning engines, reinforcing the malicious classification. Independent reputation scoring from Gridinsoft assigned a trust score of 0 out of 100, indicating a high likelihood of abuse. The limited visible content (only a 403 page) prevents extraction of specific lure tactics or credential‑stealing pages, so the exact phishing payload remains unknown.

However, the combination of blocklist listings, multiple vendor detections, low trust score, and Cloudflare‑based hosting is consistent with infrastructure commonly leveraged for short‑lived phishing domains. Defenders should ensure that sahara-ai.top is added to network and endpoint blocklists, monitor for any resurgence of the domain or its IP address, and consider flagging associated nameservers and the Cloudflare IP range for heightened scrutiny. Ongoing observation of the registrar Web Commerce Communications Ltd may reveal additional domains registered in a similar timeframe.