# present-wallet-extension-coinbase.pages.dev — MALICIOUS

> present-wallet-extension-coinbase.pages.dev is a high-risk crypto drainer domain. Avoid it to protect your assets. Learn more and stay safe now.

## Summary
PhishDestroy identifies present-wallet-extension-coinbase.pages.dev as a dangerous crypto drainer posing a significant threat to cryptocurrency users. This domain is actively targeting individuals by attempting to steal sensitive wallet credentials and drain digital assets without authorization.

The scam operates by mimicking legitimate wallet extensions, tricking victims into entering their private keys or seed phrases. Once information is submitted, attackers gain full access to the victim’s crypto accounts, quickly transferring funds to their own wallets. This deceptive tactic preys on users’ trust in well-known platforms like Coinbase.

If you have visited present-wallet-extension-coinbase.pages.dev, immediately cease any interaction and avoid entering any personal information. Run a full security scan on your devices and consider moving your crypto assets to a new wallet with fresh credentials. Stay vigilant by using official wallet apps only and verify URLs before any transactions.

## Threat Details
- Verdict: MALICIOUS
- Site status: dead (HTTP 403)
- Target brand: Coinbase
- Page title: Suspected phishing site | Cloudflare

## Domain Intelligence
- Registered: 2026-02-21 07:01:08
- Registrar: Cloudflare, Inc.
- Country: US
- IP: 172.66.47.21
- IP Country: US
- IP City: San Francisco
- IP Org: AS13335 Cloudflare, Inc.
- Nameservers: ["yadiel.ns.cloudflare.com", "lina.ns.cloudflare.com"]
- SSL Issuer: Google Trust Services / WE1

## Detection Status
- VirusTotal: 16 vendors flagged
  Vendors: ["ADMINUSLabs", "ChainPatrol", "alphaMountain.ai", "BitDefender", "CRDF", "CyRadar", "ESET", "Emsisoft", "Fortinet", "G-Data", "Kaspersky", "Lionic", "Netcraft", "Sophos", "VIPRE", "Webroot"]
- Google Safe Browsing: clean
- Blocklists: 3 hits
  Lists: ["PhishDestroy", "MetaMask", "SEAL"]

## Evidence
- Screenshot: https://urlscan.io/screenshots/019cbdd5-0873-7318-8b03-35316a826498.png
- Cloudflare Radar: https://radar.cloudflare.com/scan/3ae2dfe8-2aae-4088-b821-8a69c0fca8d5
- PhishDestroy: https://phishdestroy.io/domain/present-wallet-extension-coinbase.pages.dev/
- LLM endpoint: https://phishdestroy.io/domain/present-wallet-extension-coinbase.pages.dev/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/present-wallet-extension-coinbase.pages.dev/
Last updated: 2026-03-19