pvausaseller[.]com

Analysis of pvausaseller.com shows a newly registered domain created on 21 February 2026 that is currently offline. The site was hosted behind Cloudflare (AS13335) with the public address 104.21.29.122, a US‑based location typical for many legitimate services but also frequently leveraged by malicious actors to hide origin. No SSL certificate was presented, indicating that HTTPS was not enforced. The registrar listed for the domain is Web Commerce Communications Limited and the authoritative nameservers are ns100.webnic.cc and ns101.webnic.cc. The page title returned by the server was "pvausaseller - pvausaseller.com", which does not contain branding or other contextual clues beyond the domain name itself.

The domain is classified as a brand‑impersonation scam targeting Binance, and five of ninety‑three VirusTotal security vendors have flagged it as malicious. It is also listed on three external blocklists and has been actively blocked by PhishDestroy, MetaMask, and SEAL. An AlienVault OTX pulse references the domain in a single threat‑intel record, further corroborating its association with malicious activity. Gridinsoft assigned a trust score of 0 / 100, reinforcing the low credibility of the site.

While the offline status limits immediate payload delivery, the presence of multiple independent detections and blocklist listings indicates that the domain was used, or intended for use, in a phishing campaign aimed at Binance users. Defenders should continue to block the domain at perimeter filters, update URL reputation feeds, and monitor for any resurgence of the domain or related subdomains. Incident response teams should also correlate any Binance‑related credential theft alerts with this indicator and consider adding the IP address 104.21.29.122 to watchlists, recognizing that Cloudflare‑hosted addresses may serve multiple unrelated sites.