blum-tokken[.]io

The domain blum-tokken.io is a confirmed phishing site engaged in brand impersonation targeting Coinbase users. It presents itself as a cryptocurrency-related platform but is designed to deceive victims into disclosing login credentials or sensitive information, classifying it as a cryptocurrency scam. As of the latest verification, blum-tokken.io has been taken offline, though prior activity indicates elevated risk due to its fraudulent intent.

Technical analysis reveals blum-tokken.io was flagged by 2 of 95 security vendors on VirusTotal, including Fortinet and Gridinsoft, which assigned a trust score of 0/100. The domain appears on 1 security blocklist (PhishDestroy) and was created on February 21, 2026. It resolved to the IP address 104.21.16.1, hosted by Cloudflare in the US (AS13335), and used an SSL certificate issued by WE1. The observed page title was 'Ape Rides Mint', though the site impersonated Coinbase, a well-known cryptocurrency exchange. No registrar information is available for this domain.

Individuals who interacted with blum-tokken.io should immediately change any passwords used on the site, enable two-factor authentication (2FA) on all accounts, and monitor for unauthorized transactions or login attempts. Since this was a credential phishing scam, victims should also review connected devices for malware and report the incident to Coinbase’s security team. To prevent further exposure, users can submit the domain to additional blocklists or report it to their browser’s phishing reporting tool. If cryptocurrency was involved, revoking token approvals and transferring funds to a new wallet is recommended.