payai[.]votetolist[.]app

Analysis of the domain payai.votetolist.app indicates it was actively impersonating Binance as part of a wallet and seed-phishing campaign. The domain, registered on February 21, 2026, through NiceNIC International Group Co., Limited, resolved to the IP address 104.21.14.215, hosted on Cloudflare's infrastructure (AS13335) in the United States. The page title, 'Vote for payai | Vote to List,' suggests an attempt to masquerade as a legitimate token-listing or voting platform, a common tactic to lure cryptocurrency users into disclosing wallet credentials or seed phrases. The domain was flagged by two security blocklists—PhishDestroy and ScamSniffer—and was classified as offline as of the report date, July 24, 2026.

Infrastructure analysis reveals the use of Cloudflare nameservers (adele.ns.cloudflare.com and alberto.ns.cloudflare.com) and HTTP/3, a protocol choice that may complicate detection or takedown efforts. The SSL certificate, issued by Google Trust Services (WE1), does not inherently indicate malicious activity but is consistent with the domain's attempt to appear legitimate. Two of 93 security vendors on VirusTotal flagged the domain, though the absence of broader detection does not confirm safety. The domain's registration details and hosting provider align with patterns observed in phishing operations targeting cryptocurrency users.

Defenders should treat this domain as a confirmed threat vector for Binance impersonation. While the site is currently offline, the infrastructure remains a potential risk for re-deployment. Organizations should block the domain and its resolved IP at the network level, monitor for related subdomains or newly registered lookalike domains, and alert users to the specific threat of wallet-phishing schemes tied to token-listing scams. The page content itself has not been fully analyzed, but the combination of branding, page title, and scam classification strongly suggests a focus on credential harvesting.