fideliltyadvice[.]shop

The domain fideliltyadvice.shop impersonated the Fidelity NetBenefits login portal, a banking scam designed to harvest user credentials. The page title, "Log In to Fidelity NetBenefits," indicates the site posed as a legitimate financial authentication interface. This threat targets users by capturing sensitive account login data, potentially leading to unauthorized access and financial fraud.

Technical evidence confirms the site's malicious nature. VirusTotal flagged it with 14 out of 95 security vendors, including ADMINUSLabs, alphaMountain.ai, BitDefender, CyRadar, and Forcepoint ThreatSeeker. The domain was created on 2026-02-21, hosted on IP 43.162.112.232 (United States), assigned to AS132203 Tencent Building, Kejizhongyi Avenue. It utilized an E7 SSL certificate and appeared on two blocklists.

As of the report, the domain is offline or down. The GridinSoft trust score is 0 out of 100, and the DOM risk score is 83, indicating a high risk. The site no longer poses an active threat but represents a significant credential-harvesting campaign targeting Fidelity users.