saylorbtc[.]io

Analysis of the domain saylorbtc.io shows a short-lived infrastructure that was registered on 13 December 2025 through NiceNIC International Group Co., Limited. The domain resolves to the Cloudflare IP address 172.67.194.53, belonging to ASN 13335 (Cloudflare, Inc.) and is hosted in the United States. No TLS certificate is presented, indicating the site was served over plain HTTP when it was online. The HTTP response returned a page whose title consisted solely of the domain string “saylorbtc.io”. The lack of a custom title or branding suggests a generic landing page typical of phishing or crypto‑scam campaigns.

Reputation services have flagged the domain: two independent security blocklists list it, and PhishDestroy and CryptoFirewall have explicitly blocked it. VirusTotal scans show that 13 of 93 scanning engines flagged the domain as malicious, reinforcing the suspicion. The Gridinsoft trust score is 0 out of 100, and AlienVault OTX contains a single pulse referencing the domain, further confirming its association with malicious activity. The site is currently taken offline, and the authoritative nameservers are curt.ns.cloudflare.com and summer.ns.cloudflare.com. Given the observable indicators—recent registration, Cloudflare hosting, absence of SSL, low trust score, multiple vendor detections, and placement on blocklists—the domain is consistent with a crypto‑related phishing operation.

The precise content served, targeted victims, or payment mechanisms have not been captured, leaving those details uncertain. Defenders should continue to block the domain at perimeter and DNS filtering layers, monitor for any re‑registration attempts, and consider adding the associated IP address to deny‑list rules. Incident responders that encounter emails or messages referencing “saylorbtc.io” should treat them as malicious and advise affected users to avoid any credential or cryptocurrency wallet entry on that site.