# okx.saharaai.world — MALICIOUS

> Avoid okx.saharaai.world, a medium-risk phishing domain impersonating OKX, now offline but previously flagged as suspicious. Stay vigilant.

## Summary
PhishDestroy identifies okx.saharaai.world as a medium-risk brand impersonation domain targeting OKX users. The domain’s page title referenced a 'Sahara AI: OKX Airdrop,' suggesting an attempt to lure victims with fake promotions.

Registered through Web Commerce Communications Limited on February 21, 2026, the domain resolved to IP 104.21.17.154 and was flagged by 5 out of 95 VirusTotal security vendors. It appeared on two separate security blocklists, indicating prior malicious activity.

Currently, okx.saharaai.world is offline, mitigating immediate risk. PhishDestroy recommends users remain cautious of similar domains and verify official communications from OKX to avoid falling victim to such scams.

## Threat Details
- Verdict: MALICIOUS
- Site status: dead (HTTP 0)
- Target brand: OKX
- Page title: Sahara AI: OKX Airdrop

## Domain Intelligence
- Registered: 2026-02-21 07:01:08
- Registrar: Web Commerce Communications Limited
- Country: MY
- IP: 104.21.17.154
- IP Country: US
- IP City: San Francisco
- IP Org: AS13335 Cloudflare, Inc.
- Nameservers: ["anuj.ns.cloudflare.com", "sureena.ns.cloudflare.com"]
- SSL Issuer: Google Trust Services / WE1

## Detection Status
- VirusTotal: 5 vendors flagged
  Vendors: ["CyRadar", "Forcepoint ThreatSeeker", "Fortinet", "Seclookup", "Sophos"]
- Google Safe Browsing: clean
- Blocklists: 2 hits
  Lists: ["PhishDestroy", "ScamSniffer"]

## Evidence
- Screenshot: https://urlscan.io/screenshots/01984b65-9635-72ec-8396-3237692adc5d.png
- Cloudflare Radar: https://radar.cloudflare.com/scan/0d7d2378-de7e-4b83-84a1-8f533662f7e1
- PhishDestroy: https://phishdestroy.io/domain/okx.saharaai.world/
- LLM endpoint: https://phishdestroy.io/domain/okx.saharaai.world/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/okx.saharaai.world/
Last updated: 2026-03-19