presale-altcoin[.]xyz

The domain presale-altcoin.xyz has been identified as a brand impersonation threat specifically targeting Coinbase, currently taken offline. This domain was created on February 21, 2026, and its page title, "$ALT PRE-SALE," was designed to lure victims into a fraudulent cryptocurrency presale scheme. The domain resolves to IP address 2606:4700:3033::6815:304 and uses an SSL certificate from WE1, which may provide a false sense of security to unsuspecting users.

Technical analysis reveals that presale-altcoin.xyz appears on five security blocklists and is flagged by 3 out of 95 VirusTotal vendors as malicious. The domain was registered with an undisclosed registrar, and its recent creation date combined with the Coinbase impersonation strongly indicates a phishing campaign. The elevated risk level underscores the sophisticated nature of this threat, which leverages the trusted Coinbase brand to deceive users into connecting their wallets or sharing sensitive information.

Although the domain is currently offline, users should remain vigilant against similar threats. PhishDestroy recommends avoiding any unsolicited pre-sale offers and verifying cryptocurrency platforms through official channels. If you have interacted with this domain, monitor your accounts for unauthorized activity and consider using hardware wallets for enhanced security. Always double-check URLs and report suspicious domains to security teams.