Criticalscore 68 · flagged Friday, October 30, 2026

passdabaton.xyz

Appeared in the .xyz zone on Friday, October 30, 2026; by the end of that day the census found active website about crypto web3. Full domain report

Signals, not verdicts. A domain appears here because heuristics matched its name, its infrastructure or the page it served on its first day. Where a model has looked at it, that is shown as an opinion with a confidence, not as a finding. Nothing on this page says a site is malicious. Read the evidence and decide for yourself.

Own one of these names and think the listing is wrong? Tell us and a person will look.

What matched

TLD with a high abuse rate
matched: xyz
+8
page impersonates a brand
matched: Binance
+22
brand in page title, not in the name
matched: binance
+20
form on a brand-styled page
matched: has_form
+18
Registrar
—
Nameserver provider
Nameservers
bowen.ns.cloudflare.com, grannbo.ns.cloudflare.com
First-day state
active website
HTTP status
200
Page title
The Baton — an on-chain relay for Binance AI agents
Has a form
yes
Brand echoed
—

Model opinions

Second opinionsuspiciousconfidence 55%· claude-opus-5-5

The page carries its own brand ('The Baton') and names Binance only as the platform it targets ('a relay game for Binance AI agents'), with no Binance login or password form (the form is a GET to itself with text and number fields), so it is not phishing. However, it is a new .xyz pay-to-play crypto pot game ($1.20 per Baton, top 50 split the pot) that tells users to enable Developer Mode for contract calls on a contract not yet posted, which makes it a plausible rug or gambling lure but not yet

First passsuspicioustarget: Binanceconfidence 72%· claude-haiku-4-5

The page title and content mention 'Binance AI agents' and 'Binance App' repeatedly, and the scorer flagged brand impersonation. However, the site appears to be a legitimate game/dapp (The Baton) running on BNB Chain with contract calls, NFT mechanics, and links to real blockchain explorers (bscscan.com, sourcify.dev). The form is a contract-interaction interface, not a credential-harvesting phish. The ambiguity lies in whether this is an official Binance product or a third-party game falsely cl

A model looked at the screenshot and page text and wrote what it thought. It can be wrong, and it is not a finding.

What the page looked like on Friday, October 30, 2026

Screenshot of passdabaton.xyz taken by the zone census on 2026-10-30

Same data as JSON: /api/zone/domain/passdabaton.xyz. This page is not indexed by search engines and does not link to the site it describes.