saylorinvest[.]net

The domain saylorinvest.net was registered on 2 January 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED and resolves to the IP address 188.114.97.3, which is hosted by Cloudflare (AS13335) in the United States. The site returned a HTTP 522 timeout, reflected in the page title "saylorinvest.net | 522: Connection timed out," indicating that the web service is currently unreachable. Threat intelligence sources have linked the domain to an investment‑type phishing campaign; it appears on a single security blocklist and has been explicitly blocked by the PhishDestroy service. Reputation metrics are extremely low, with Gridinsoft assigning a trust score of 1 / 100 and Scamadviser reporting a score of 35 / 100.

The SSL certificate is identified as "WE1," suggesting a weak or self‑signed implementation that does not provide meaningful encryption assurance. On VirusTotal, 12 of 93 scanning engines flagged the domain, confirming malicious indicators despite the offline status. Additionally, AlienVault OTX includes the domain in one threat‑intel pulse, reinforcing its association with malicious activity.

No further content analysis is possible while the host remains offline, so the exact phishing payload or lure details remain unknown. Defenders should add the domain and its resolving IP to network‑level deny lists, enforce URL filtering policies to block any HTTP(S) requests to saylorinvest.net, and monitor DNS logs for any anomalous resolution attempts. Continuous re‑scanning after the site becomes reachable is advised to capture any evolving payloads or infrastructure changes.