presale-altseason[.]xyz

This domain, presale-altseason.xyz, was created on 21 February 2026 and is presently taken offline. DNS resolution points to the IP address 104.21.32.1, which belongs to Cloudflare, Inc. (AS13335) and is geolocated in the United States. The site served an SSL certificate identified as “WE1”, indicating a publicly‑trusted TLS layer was in place while the site was active. The page title returned from the host was “$ALTSEASON PRE‑SALE”, and the content was classified as a crypto‑scam that impersonates the Coinbase brand, matching the declared brand‑impersonation threat type. The risk level assigned by analysts is elevated, reflecting the potential financial loss associated with crypto‑scams that exploit Coinbase’s reputation.

Two independent phishing blocklists, PhishDestroy and ScamSniffer, have listed the domain, confirming its presence on security‑community feeds. VirusTotal analysis shows that 2 of 95 scanning engines flagged the domain as malicious, providing additional corroboration of its harmful nature. No further public reputation scores or safe‑browsing entries were observed beyond the listed blocklists. Although the HTTP response code was not captured, the offline status indicates that the web service is no longer reachable, limiting current direct exploitation but preserving the indicator for future use. Defenders should ensure that network perimeter controls block any outbound connections to 104.21.32.1 that resolve to presale-altseason.xyz.

Email filters should be updated to drop messages containing the $ALTSEASON PRE‑SALE title or references to Coinbase impersonation. Continuous monitoring of Cloudflare‑hosted IP ranges for similar patterns is recommended, as threat actors often reuse the same CDN nodes. Security operators should incorporate the domain fingerprint into threat‑intelligence platforms, automate its inclusion in blocklist feeds, and enable logging of DNS queries for the domain to detect any lingering internal resolutions.