talk-customers[.]online

This domain, talk-customers.online, is identified as a credential harvesting site designed to impersonate Coinbase, a major cryptocurrency exchange platform. The site presents a fraudulent login interface under the page title 'CoinBase,' aiming to deceive users into submitting their account credentials, which are then captured by threat actors. Such attacks typically lead to unauthorized account access, financial theft, or further exploitation through compromised credentials. The domain specifically targets users seeking customer support or account verification, leveraging urgency and brand trust to facilitate credential theft. Analysis of the domain's infrastructure reveals multiple indicators of malicious intent. The domain was registered on November 18, 2025, through NameCheap, Inc., a registrar frequently observed in phishing campaigns. It resolves to the IP address 91.215.85.214, located in Russia under AS200593 (PROSPERO OOO), an autonomous system with a history of hosting fraudulent domains. The domain lacks an SSL certificate, increasing the risk of interception during data transmission. Detection metrics further confirm its malicious nature: 19 out of 95 security vendors on VirusTotal flag the domain as malicious, and it appears on one security blocklist. Additionally, the domain has been taken offline, likely due to enforcement actions or detection by security systems. Users who visited talk-customers.online or entered credentials on the site should take immediate remedial actions. First, any passwords or sensitive information submitted to the site must be considered compromised and changed immediately across all platforms where identical credentials were reused. Affected users should enable multi-factor authentication on their accounts to mitigate unauthorized access. Monitoring for unauthorized transactions or account activity is critical, particularly for financial or cryptocurrency-related services. If personal or financial data was exposed, users should report the incident to relevant authorities and consider credit monitoring services to detect potential identity theft. Finally, users are advised to verify the legitimacy of any communication claiming to be from Coinbase by accessing the platform directly through official channels rather than clicking on links.