fideityportfolloknowiedge[.]lat

This domain, fideityportfolloknowiedge.lat, poses a targeted credential theft threat against users of Fidelity NetBenefits, a financial services platform. Analysis indicates the site was designed to harvest login credentials by mimicking the legitimate Fidelity NetBenefits portal, as evidenced by its page title, 'Log In to Fidelity NetBenefits.' Such impersonation tactics are commonly employed to facilitate unauthorized access to financial accounts, enabling fraudulent transactions or identity theft. The domain’s infrastructure and content were engineered to deceive users into entering sensitive authentication details, which could then be exploited by threat actors for further malicious activities. Technical indicators confirm the domain’s malicious intent. The domain was registered on February 21, 2026, and resolves to the IP address 43.162.112.221, hosted on an autonomous system (AS132203) associated with a data center in the US. It appears on one security blocklist and is flagged by 18 out of 95 security vendors on VirusTotal, indicating widespread detection as a phishing resource. The SSL certificate (E7) provides no meaningful validation, further suggesting its use in fraudulent operations. The domain’s rapid takedown aligns with typical phishing campaign lifecycles, where threat actors frequently rotate infrastructure to evade detection. Users who visited fideityportfolloknowiedge.lat or entered credentials on the site should take immediate action to mitigate risk. First, reset passwords for Fidelity NetBenefits and any other accounts where the same credentials may have been reused. Enable multi-factor authentication (MFA) on all financial and sensitive accounts to add an additional layer of security. Monitor account activity for unauthorized transactions or changes, and report any suspicious activity to the legitimate service provider. If financial data was exposed, consider placing a fraud alert or credit freeze with relevant credit bureaus to prevent identity theft. Organizations should also update their email and web filtering rules to block this domain and its associated IP address to prevent further exposure.