chain-meld[.]com

Analysis indicates that chain-meld.com is a high-risk phishing domain impersonating the Across protocol, specifically targeting users with a fraudulent Coinbase reward scheme. The domain was registered on February 21, 2026, through NameCheap, Inc., and resolved to IP 199.188.201.215, hosted on AS22612 (Namecheap, Inc.) in the US. The observed page title, 'Coinbase - Claim Reward - Onchain App (Manage)', explicitly references Coinbase, suggesting an attempt to deceive users into believing they are interacting with a legitimate reward or on-chain application. Infrastructure evidence reveals the domain was flagged by 15 of 93 security vendors on VirusTotal, though this does not represent a complete scan.

It appears on four security blocklists and is referenced in one AlienVault OTX threat intelligence pulse, confirming its classification as malicious. Detection engines such as PhishDestroy, Polkadot, Enkrypt, and Codeesura have blocked the domain, further supporting its identification as a wallet/seed phishing operation. The SSL certificate, issued by Sectigo Public Server Authentication CA (DV R36), is consistent with low-effort phishing infrastructure, offering no assurance of legitimacy. As of July 23, 2026, chain-meld.com is offline, though this does not preclude future reactivation.

Defenders should treat the domain as compromised and maintain blocklist entries. Organizations should monitor for related infrastructure, particularly domains registered via NameCheap with similar naming patterns or Coinbase-themed page titles. No evidence confirms the exact phishing kit or backend services used, but the scam type aligns with common wallet credential harvesting tactics. Further analysis of historical HTTP responses or captured payloads may provide additional indicators.