recoverymeridian[.]org

This domain, recoverymeridian.org, is flagged as a brand impersonation threat targeting Across, a recognized financial services entity. Analysis indicates the site was designed to mimic legitimate asset recovery and fraud investigation services, as evidenced by its page title, 'Meridian Holding — Asset Recovery & Fraud Investigation.' The domain is currently classified as an elevated-risk phishing infrastructure due to its deceptive branding and fraudulent intent. Infrastructure analysis reveals the following technical indicators: recoverymeridian.org is flagged by 1 of 95 security vendors on VirusTotal, appears on 1 security blocklist, and resolves to the IP address 185.158.133.1. The domain was registered on February 21, 2026, through NameCheap, Inc., and has been assigned a trust score of 0/100 by Gridinsoft. It was previously blocked by PhishDestroy, further confirming its malicious classification. The domain is currently offline, though its prior activity and registration details remain concerning. Organizations and users are advised to treat any prior communications or references to recoverymeridian.org as fraudulent. Network defenders should update blocklists to include the domain and its associated IP address, 185.158.133.1. Monitoring for similar impersonation attempts targeting Across or related financial service brands is recommended, particularly those leveraging newly registered domains with asset recovery or fraud investigation themes.