bltflyer[.]app

This domain, bltflyer.app, is an active high-risk phishing site targeting Coinbase users, first registered on October 6, 2025. Infrastructure analysis reveals it resolves to IP 196.251.87.9, hosted in the Netherlands, with nameservers ns1.dns-parking.com and ns2.dns-parking.com. The domain was registered through Hosting Concepts B.V. d/b/a Registrar.eu and currently returns an HTTP 200 status, indicating an operational webpage. The page title, 'Coinbase - Sign In,' directly aligns with the reported scam type of crypto fraud, as noted by Scamadviser with a low trust score of 40/100.

Detection evidence includes flags from 15 security vendors on VirusTotal, though the domain has not undergone full scrutiny by all engines. Google Safe Browsing classifies it as social engineering, and AlienVault OTX lists it in 18 threat intelligence pulses, suggesting recurring malicious activity. The domain appears on at least one security blocklist and is actively blocked by PhishDestroy. Notably, the site lacks an SSL certificate, increasing the risk of credential interception.

Defenders should prioritize blocking this domain at the DNS and network levels, particularly in environments where Coinbase or cryptocurrency-related services are accessed. The absence of SSL and the use of DNS-parking nameservers are common indicators of low-effort phishing infrastructure, but the domain's persistence and detection history warrant immediate action. Additional monitoring for related IPs or domains registered through the same registrar may help identify broader campaign activity. The exact content and functionality of the site remain unanalyzed, but the combination of brand impersonation, active status, and detection flags confirms its malicious intent.