sayrusapp[.]net

The domain sayrusapp.net is currently active and presents a counterfeit interface that mimics Stripe’s branding, as indicated by the page title “Sayrus Pro | Wallet, Chat y Pagos Seguros con Stripe.” The site delivers an HTTP 200 response and hosts a TLS certificate issued by Google Trust Services under the WR3 designation, suggesting the use of a legitimate certificate authority to increase credibility.

Infrastructure analysis shows the domain was registered on May 27, 2026 through NameCheap, Inc. It resolves to the IP address 199.36.158.100, which is geolocated to the United States and associated with Google LLC. Authoritative name servers are dns1.registrar-servers.com and dns2.registrar-servers.com, and the MX configuration includes eforward3.registrar-servers.com with a priority of 10. The low Gridinsoft trust score of 0/100 further underscores the malicious nature of the host.

Detection data indicates the domain is listed on a single security blocklist and has been blocked by the PhishDestroy service. VirusTotal reports that 2 of 95 security vendors have flagged the domain, which aligns with the high‑risk classification assigned by analysts. Despite limited vendor coverage, the combination of a reputable TLS certificate, legitimate‑looking branding, and the low trust score suggests an intentional effort to deceive victims.

Defenders should prioritize blocking traffic to sayrusapp.net at network perimeter devices and update endpoint protection signatures to include the domain and its resolving IP. Monitoring for DNS queries to the registrar‑servers.com nameservers can provide early warning of additional malicious domains using the same infrastructure. Incident response teams should also advise users to verify URLs and TLS certificate details before entering payment credentials, as the site’s visual fidelity may otherwise encourage credential harvesting.